Release, monitoring and change control

The release gate

Before go-live, an accountable owner who did not build the system approves release based on evidence:

• Assessments complete and risks accepted at the right level
• Test results meet acceptance criteria
• Documentation, instructions for use and transparency notices ready
• Human oversight trained and in place
• Monitoring and incident response ready
• Legal steps done (EU conformity assessment, CE marking and database registration for high-risk systems)

Staged rollout (pilot, limited release, then wider) limits harm if something was missed.

Monitoring

• Data drift: input distribution changes.
• Concept drift: the relationship between inputs and outcomes changes (customer behavior shifts).
• Performance and fairness decay over time and across groups.
• Misuse and off-label use.
• Feedback and complaints from users and affected people.

Set thresholds that trigger review, retraining or rollback.

Change control

Retraining, new data sources, new features or a new purpose are changes that go back through assessment proportionate to their risk. Under the EU AI Act a substantial modification can require a new conformity assessment.

Post-market monitoring and incidents

High-risk providers need a post-market monitoring plan and must report serious incidents to authorities, generally within 15 days of becoming aware (shorter for the most serious cases).