AI Act Post-Market Monitoring Plan & Incident Template

Document 23 of the RegShelf kit has three parts. Part A is the post-market monitoring plan template — data sources, KPIs with thresholds and owners, review cadence and the feedback loop into your risk management system. Part B is the serious-incident procedure under Article 73: what counts, which deadline applies, who does what. Part C is a ready-to-fill Serious Incident Report form your support and engineering teams can find at 2 a.m. The plan belongs in your Annex IV technical documentation (doc 15, Section 10); the incident procedure is written so deployers can reuse it too.

Providers of high-risk AI systems must establish and document the monitoring plan before market placement, as part of the technical documentation. Deployers have a parallel stake: on identifying a serious incident they must inform the provider immediately (Article 26(5)), and report directly to the market surveillance authority if the provider cannot be reached — which is why Parts B and C are written to work from either role. If you sell into regulated buyers, expect this plan to be requested in procurement long before 2 December 2027.

Article 72 requires providers to actively and systematically collect, document and analyse relevant data — from deployers or other sources — on performance throughout the system's lifetime, including interaction with other AI systems where relevant, and to evaluate continuous compliance with the Chapter III Section 2 requirements. Passive waiting for complaints is not a monitoring system. On the template question: the former Article 72(3) empowerment for a Commission implementing act (originally due 2 February 2026, never adopted) was deleted by the Digital Omnibus; instead the Commission must adopt guidance, including a template, by 2 September 2027. For incidents, Article 73's definition is narrow — an incident or malfunctioning leading directly or indirectly to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of fundamental-rights obligations, or serious harm to property or the environment (Article 3(49)). Deadlines run from awareness, not from completed investigation: 15 days standard, 2 days for widespread infringement or serious and irreversible critical-infrastructure disruption, 10 days for a death — plus "immediately" once a causal link is established or reasonably likely. Reports generally go to the market surveillance authority of the Member State where the incident occurred; for AI systems based on a general-purpose AI model where system and model come from the same provider (and systems integrated into very large online platforms), the AI Office acts as market surveillance authority (Article 75(1)).

Across the three parts:

• Plan identification linking the plan to your Article 9 risk file;
• A data-sources table — deployer feedback and complaints, logs and telemetry, incident reports, sampled case review, public sources, and interaction with other AI systems, each with collection method and frequency;
• KPI table with action thresholds — e.g. live-sample accuracy, human override rate (both too high and too low are warnings), complaints per 1,000 cases, demographic performance gaps — because a KPI without a threshold and an owner is decoration;
• Review cadence and feedback loop, including the note to restructure onto the Commission's template once the 2 September 2027 guidance lands;
• The Article 73 procedure — the Article 3(49) definition, the 15/2/10-day deadline table with statutory bases, a six-step internal procedure (detect and log awareness time, triage same day, report, preserve evidence, investigate and correct, deployer path), and the rule against altering the system or incident data in ways that could affect cause evaluation before informing the authority (Article 73(6));
• The 17-field incident report form, supporting initial-then-complete filing under Article 73(5).

Complete Part A per high-risk system before market placement and file it in your Annex IV documentation. Adopt Part B as your incident procedure, name the roles, and log the moment of awareness for any potential incident — the clock runs from it, and when in doubt you start the clock and close the event as a non-incident after investigation, because a missed deadline cannot be recovered. Keep submitted reports and evidence for at least 10 years with the technical documentation, and rehearse the procedure annually with a fictional incident.