Post-market monitoring

Overview

Post-market monitoring (PMM) tracks how a high-risk AI system behaves after it goes live. EU AI Act Article 72 requires providers of high-risk AI systems to establish and document a monitoring plan. VerifyWise turns this into a repeatable process: you set a schedule, the system creates monitoring cycles, stakeholders answer structured questions and a PDF report gets generated automatically when a cycle is submitted.

PMM lives inside each use case. Open a use case, then go to the Monitoring tab to configure it.

How it works

1. An admin or editor enables monitoring on a use case and sets a schedule (e.g. every 30 days).
2. The system creates a monitoring cycle and assigns it to the use case stakeholder.
3. The assigned stakeholder receives an email with a link to the monitoring form.
4. They open the form, answer each question and can flag concerns along the way.
5. Drafts are saved so they can come back later.
6. When they submit, VerifyWise captures a context snapshot (risk counts, model counts, vendor counts) and generates a PDF report.
7. The report is stored in the reports archive for download at any time.
8. If the cycle isn't completed by its due date, a reminder goes out. If it stays overdue past the escalation threshold, the escalation contact gets notified.

Enabling monitoring

Open a use case and go to the Monitoring tab. You'll see a card labeled Post-market monitoring with a toggle on the right side. The card shows the use case name and references EU AI Act Article 9 and Article 72.

1. Flip the toggle to enable monitoring.
2. If this is the first time, VerifyWise creates a configuration and seeds it with seven default questions based on EU AI Act requirements.
3. The schedule and questions sections appear below the toggle.
4. You can flip the toggle off at any time to pause monitoring without deleting your configuration or question set.

Configuring the schedule

Once monitoring is enabled, the Monitoring schedule card appears. It uses a two-column layout with the setting name on the left and the input on the right. Here's what each field does.

After filling in the fields, click Save configuration at the bottom right. Changes don't take effect until you save.

Monitoring questions

Below the schedule card you'll find the Monitoring questions card. This is the question set that stakeholders answer during each cycle.

Default questions

When you first enable monitoring, VerifyWise creates seven default questions. Six are yes/no questions mapped to EU AI Act articles. The seventh is a free-text field for additional observations.

Default questions are tagged with a Default chip. They can be edited but not deleted.

Question types

Each question has a response type that determines how the stakeholder answers it.

Adding a question

1. Click Add question in the top right of the questions card.
2. The question editor modal opens with these fields:
3. Question text (required). Write the question the stakeholder needs to answer.
4. Response type (required). Pick Yes/No, Multiple choice or Text response.
5. If you chose Multiple choice, add at least two options using the Add option button. Remove an option by clicking the X next to it.
6. If you chose Yes/No, you can add optional suggestion text that shows when the answer is "No".
7. EU AI Act reference (optional). Link the question to a specific article, like "Article 9" or "Article 72". This appears in the PDF report.
8. Required question checkbox. When checked, the stakeholder must answer this question before submitting.
9. Allow flag for concern checkbox. When checked, the stakeholder can flag this question for immediate attention during the cycle.
10. Click Add to save the question.

Editing and deleting questions

Each question row shows a pencil icon (edit) and a trash icon (delete) on the right side. Click the pencil to open the same editor modal with the question's current values pre-filled. Click Update to save your changes.

Custom questions can be deleted by clicking the trash icon. Default questions can't be deleted, only edited.

Reordering questions

Each question has a drag handle (six-dot grip icon) on the left. Click and drag to reorder. The new order is saved to the server automatically. If the save fails, the order reverts to where it was.

Required questions show a Required chip. Default questions show a Default chip. Each row also displays the question type and EU AI Act reference if one is set.

Monitoring cycles

A cycle is one round of monitoring. The system creates cycles automatically based on your schedule. Each cycle has a number (#1, #2, #3...), a due date and a status.

Once a cycle is completed, the system doesn't create the next one until the notification hour you configured. A new cycle won't be created if there's already an active (non-completed) cycle.

How cycles are created

A background job runs every hour. At the notification hour you set, it checks each active configuration:

1. Is there already an active cycle? If yes, skip.
2. Has the start date passed (or is there no start date set)? If yes, create a new cycle.
3. The due date is calculated by adding the frequency value to the start date (or current date if no start date).
4. The cycle gets assigned to the use case's stakeholder.

Manually starting a cycle

Admins can trigger a new cycle on demand through the API without waiting for the scheduler. This is useful for ad-hoc reviews or when you need to run an unscheduled check.

Completing the monitoring form

When a cycle is active, the assigned stakeholder can open the monitoring form at /monitoring/cycle/{cycleId}. They can also reach it through the link in the notification email.

Form layout

The form page has three sections:

• Status bar: Shows the cycle status (in progress, overdue or completed), the due date and a completion percentage based on required questions answered.
• Question cards: One card per question, numbered sequentially. Each card shows the question text, a required indicator (*) if applicable and the EU AI Act article reference below it.
• Action buttons: Save draft and Submit at the bottom of the page.

Answering questions

• Yes/No questions: Select one of the two radio buttons. If you pick "No" and the question has suggestion text, a yellow guidance box appears below your answer.
• Multiple choice questions: Check one or more options from the list.
• Text response questions: Type your answer in the multi-line text area.

Flagging concerns

If a question has Allow flag for concern enabled, you'll see a Flag concern button in the top right corner of the question card. Click it to flag that question. The button turns red with a filled background when active. Click again to un-flag.

Flagged questions appear highlighted in the PDF report. They can also trigger an immediate notification to the escalation contact so issues get attention fast.

Saving drafts

Click Save draft to save your progress without submitting. All current answers and flag states are preserved. You can close the browser and come back later. The form shows a "Last saved" timestamp in the status bar after each save.

When you reopen the form, your previous answers are loaded automatically.

Submitting the form

1. Answer all required questions (marked with *).
2. Review your flags. Make sure anything that needs escalation is flagged.
3. Click Submit.
4. If any required questions are unanswered, you'll see an error message telling you how many are missing.
5. On success, the system marks the cycle as completed, captures a context snapshot and generates a PDF report.
6. You're redirected back to the previous page after a brief confirmation message.

Context snapshot

When a cycle is submitted, VerifyWise captures a snapshot of the use case's current state. This snapshot is stored with the report so you can track how the risk profile changes over time.

The snapshot includes:

• Use case title and current status
• Total risk count and breakdown by level (high, medium, low)
• Number of linked AI models and their risk count
• Number of linked vendors and their risk count
• Timestamp of when the snapshot was taken

Comparing snapshots across cycles #1, #2, #3 etc. gives you a clear trend line of whether risk is increasing, stable or decreasing.

PDF reports

A PDF is generated automatically when a cycle is submitted. The report is rendered from an HTML template using Playwright (headless Chromium) and uploaded to VerifyWise's file storage.

Each report includes:

• Organization name and logo (if configured)
• Use case title and ID
• Cycle number and completion date
• Name of who completed the cycle
• The full context snapshot (risks, models, vendors)
• Every question with its response
• Flagged concerns highlighted visually
• EU AI Act article references for each question
• A summary of all referenced EU AI Act articles

Report filenames follow the pattern PMM_Report_{UseCaseTitle}_Cycle{N}_{timestamp}.pdf.

Reports archive

The reports archive page is at /monitoring/reports. It shows a filterable, paginated table of all completed monitoring reports across your use cases.

Filters

The filter bar at the top lets you narrow results:

• Date range: Pick a "From" and "To" date to filter by completion date. The system validates that "From" isn't after "To".
• Flagged only: Check this box to show only reports where at least one question was flagged for concern.
• Reset filters: A text button that appears when any filter is active. Click it to clear all filters.

Table columns

Pagination controls at the bottom let you pick 5, 10, 25 or 50 rows per page.

Email notifications

The background scheduler handles all email notifications through the BullMQ automation queue. Five types of emails are sent during the monitoring lifecycle.

Each email includes a direct link to the monitoring form so the recipient can open it with one click. The scheduler runs every hour and checks all active configurations at their configured notification hour.

Stakeholder reassignment

If the person assigned to a cycle is unavailable, an admin can reassign it to a different team member. The new stakeholder will receive future notifications for that cycle. Previous responses (if any) are preserved.

Who can do what

When a user with view-only access (Auditor) opens the monitoring tab, the schedule and question cards appear dimmed with a View only chip. All inputs are disabled.

Tips for effective monitoring

• Start with the defaults.: The seven default questions cover the core EU AI Act requirements. Try them for a few cycles before customizing.
• Keep the question count manageable.: Long forms lead to rushed answers. Aim for 8-12 questions total.
• Use the flag feature.: Flags create a fast path from observation to action. Encourage stakeholders to flag anything that needs follow-up, not just serious issues.
• Set a realistic frequency.: High-risk systems in production might need monthly cycles. Lower-risk systems could use quarterly checks.
• Review the context snapshots.: The risk counts captured with each cycle let you spot trends. If high-risk counts are climbing, investigate before the next cycle.
• Name your escalation contact.: Without one, overdue cycles go unnoticed. Pick someone with authority to act.
• Use EU AI Act references.: Mapping questions to specific articles makes the PDF report audit-ready.