Builds on AR-000188 (Technical Documentation) — the post-market monitoring plan is Annex IV Item 9 in the technical documentation dossier. This article covers the Article 72 system and plan obligations in full. Article 73 (Incident Reporting, AR-000380) is the downstream obligation triggered when monitoring identifies a serious incident.
Executive summary
What this means
Who this applies to
Regulatory context
The monitoring plan as pre-market technical documentation
The Commission implementing act template
The Annex I Section A and financial institution integration option
Relationship with Article 73 incident reporting
Requirements
What organizations must do
- Design the post-market monitoring system and plan before market placement — Annex IV requires the plan as part of the pre-market technical documentation, not as a post-launch task.
- Build active data-collection mechanisms into the system or into the provider’s commercial relationship with deployers — “actively and systematically” requires proactive collection, not passive log access.
- Exclude law-enforcement deployers’ sensitive operational data from the monitoring data set — and design the monitoring programme to function with that data gap.
- Check whether the Commission has published the Article 72(3) implementing act template — if it has, use it; if it has not, document why the chosen plan structure meets the equivalent purpose.
- Connect monitoring outputs to the Article 9 risk management system and the Article 20 corrective action process — monitoring data that does not trigger compliance review and corrective action where needed does not satisfy the Article 72 purpose.
Common mistakes
Treating post-market monitoring as an incident-response activity rather than an ongoing proactive programme is a common mistake — Article 72 requires active and systematic data collection throughout the system’s lifetime, not only after problems surface.
Drafting the monitoring plan after market placement is a second mistake — the plan is Annex IV Item 9 and must be part of the pre-market technical documentation.
Assuming the Annex I Section A integration option in Article 72(4) waives any of the substantive monitoring requirements is a third mistake — it permits integration into an existing system, not exemption from the obligations.
Not accounting for the law-enforcement sensitive operational data exclusion when designing the monitoring data architecture is a fourth mistake — systems deployed primarily by law enforcement will have structurally limited monitoring data, and the programme must be designed to function within that constraint.
Open questions
- Whether the Digital Omnibus changed Article 72’s monitoring system or plan requirements — Article 72 carries the Omnibus disclaimer; the text described here is pre-amendment.
- Whether the Commission adopted the Article 72(3) implementing act template by the 2 February 2026 deadline — not confirmed against a primary source on this research pass.
- How “equivalent protection” under the Article 72(4) integration option is assessed in practice — no Commission guidance specifically addressing this test was identified on this research pass.