Skip to content

Lifecycle & third parties

Post-deployment monitoring: what AI regulations require

Production monitoring, drift, continual improvement, decommissioning.

18 requirements · 8 regulations · 7 checks

Requirements by regulation

EUAI Act3

EX-009

Accuracy, robustness, cybersecurity Art. 15

EX-021

Post-market monitoring Art. 72

EX-022

Serious incident reporting Art. 73

EUCRA1

CRA-I.2

Vulnerability handling: SBOM, updates over the support period Annex I part II

EUPLD1

PLD-11

Post-market control: security updates Art. 11

USNIST AI RMF8

GOVERN-1.7

Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness. GOVERN

MEASURE-1.2

Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities. MEASURE

MEASURE-2.4

The functionality and behavior of the AI system and its components - as identified in the map function - are monitored when in production. MEASURE

MEASURE-4.3

Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented. MEASURE

MANAGE-2.2

Mechanisms are in place and applied to sustain the value of deployed AI systems. MANAGE

MANAGE-3.2

Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance. MANAGE

MANAGE-4.1

Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management. MANAGE

MANAGE-4.2

Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors. MANAGE

USUS federal1

USF-03

Minimum practices for high-impact AI: testing, impact assessment, oversight, monitoring, appeal M-25-21 §4

BRPL 23381

BR-13

Monitoring of results Art. 18 I.b

CNChina GenAI1

CN-05

Handle illegal content and correct the model GenAI Art. 14

INTLISO 420012

ISO-A.6

Lifecycle: design, verification, deployment, operation, event logs A.6

ISO-10

Nonconformity and continual improvement Cl. 10

Checks in this theme

Most shared first

Code	Check	Used by
VER-021-F-01	Operational monitoring plan	AI Act ISO 42001 NIST AI RMF PLD US federal
VER-AUTO-05	Accuracy monitoring in operation	AI Act PL 2338 NIST AI RMF
VER-021-D-03	Operation monitoring	AI Act PL 2338 China GenAI
CHK-CONTINUAL-IMPROVE	Continual-improvement activities are integrated with stakeholder engagement	ISO 42001 NIST AI RMF
CHK-DECOMM	A documented process exists for safe decommissioning and phase-out of AI systems	NIST AI RMF
CHK-METRIC-REVIEW	Metric appropriateness and control effectiveness are regularly assessed and updated	NIST AI RMF
CHK-MODEL-MONITORING	Pre-trained models used in development are monitored and maintained	NIST AI RMF

Related themes

Incidents & corrective action Authorities & registration Third parties & value chain Intellectual property

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.