Continuous oversight of AI performance after deployment ensured
In the rapidly evolving world of artificial intelligence (AI), post-deployment monitoring has become a crucial aspect of responsible AI development and deployment. This approach involves ongoing oversight of model integration and usage, application usage, and impact and incident information.
The need for transparency is evident, with ideally, model integration and usage information being disclosed and shared with regulators to inform decisions on how to regulate developers, hosts, application providers, and deployers. However, it remains unclear if entities like courts or utility companies in various countries are using AI, and if so, how it is being employed.
Current regulations and best practices emphasize the importance of post-deployment monitoring and safeguards. In the United States, for instance, several states, including Texas, have legally mandated post-deployment monitoring. The Responsible Artificial Intelligence Governance Act, effective from January 1, 2026, requires organizations to demonstrate documentation of governance elements such as data inputs, outputs, evaluations, post-deployment monitoring, and safeguards.
Maintaining an AI Model Register is a best practice, with organizations keeping a centralized inventory of AI systems that details each model’s purpose, risk category, stakeholders, regulatory obligations, and deployment status. This enables effective governance and auditing.
Continuous monitoring after deployment involves automated systems and human reviewers tracking how models are used for abusive or unintended behavior. Auditability protocols are also crucial, including standardized procedures for technical, compliance, and ethical evaluations, ensuring traceability linking model inputs, processes, and outputs, precise version control and change logs across model updates, and structured incident reporting systems to document failures, ethical concerns, or user complaints with clear remediation and escalation pathways.
Regulatory frameworks increasingly require AI impact assessments and ongoing inventory updates of AI use cases, plus evaluations of data fitness and operational impacts on privacy, civil rights, and discrimination risks. Some laws provide safe harbors that exempt entities from liability if they voluntarily adopt comprehensive AI risk management and post-deployment monitoring frameworks aligned with recognized standards like the NIST AI Risk Management Framework.
However, a significant gap exists between the current state of post-deployment monitoring and reporting and the ideal scenario, attributed to lack of overall post-deployment information, information asymmetry, and privacy and business sensitivity. Monitoring AI systems after their deployment is necessary to understand their impacts and prevent potential harms. Trusted flagger mechanisms empower local users with existing, distributed access to flag and correct AI outputs.
Ideally, developers, regulators, and civil society organizations would be able to track instances of misuse of a model and severe malfunctions. Regulators might identify very consequential uses of a model like in hiring or critical infrastructure and demand higher levels of reliability, safety, and assured benefits. Transparency on post-deployment downstream indicators is only partly measured and lower than pre-deployment upstream and model information.
As defined in Figure 1, most companies have disclosure-focused information, but are lacking assessment-focused information. Governments, in most cases, do not know when they are subject to AI decisions, and the public is often unaware of how AI algorithms influence their behavior. Currently, such information is available only through high-level survey data and online activity, and business competition and privacy concerns limit hosts' willingness to disclose information.
Along the AI value chain, hosts, application providers, application users, and affected people all have relevant post-deployment information that can be monitored and reported. The EU's Digital Services Act and Digital Markets Act introduced partial regulatory monitoring in the last years. As of March 2024, 100% of Fortune 500 companies use AI systems like GPT-4, Claude 3, Llama 3 or Gemini.
The development of comprehensive post-deployment monitoring and reporting for AI will be a gradual process, requiring collaboration between industry, regulators, and civil society to establish what works best. The goal is to ensure that AI is deployed safely, ethically, and responsibly, supporting innovation while minimizing potential harms.
Technology and artificial-intelligence-driven gadgets are revolutionizing various industries, but their post-deployment monitoring becomes increasingly vital in the context of responsible AI development. In light of the Responsible Artificial Intelligence Governance Act, effective January 1, 2026, organizations must demonstrate documentation of governance elements such as data inputs, outputs, evaluations, post-deployment monitoring, and safeguards.
