Most AI governance effort goes into the decision to launch. Most AI failures happen later, when the data, the users or the model itself have changed.
Monitoring
Drift. A model trained on last year’s data may perform worse as customer behaviour, products or the economy change. Track accuracy and error rates against the baseline set at launch, and set thresholds that trigger a review.
Use. Check that people are using the system for the purpose it was approved for, and that human reviewers are not simply rubber-stamping its outputs.
Changes. Supplier updates can change a model overnight. Contracts should require notice, and significant changes should go back through your approval process.
What the law requires
Under the EU AI Act, from December 2027, providers of high-risk systems must run post-market monitoring. Deployers must monitor operation, keep automatically generated logs for at least six months, and suspend use if they believe the system presents a risk. Under data protection law, accuracy and security are continuing duties, not launch-day checks.
Decommissioning
When a system is retired, decide what happens to its training data, logs and outputs, and to any personal data. Keep the records you may need to defend past decisions, delete what you no longer need, and confirm the supplier has done the same.
A system nobody is monitoring is a system nobody can defend.
What to do
Give each system an owner, a set of metrics and a review date. Put “how will we switch it off?” in the launch checklist.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.