This step watches important risks through indicators while AI is in use, and has changes to models, instructions and so on go through an impact review. Even a one-line change to an instruction can change the result. You receive the monitoring table, the change control record and the revision control register.
While approved AI is in use, important risks are monitored with indicators and thresholds (including performance degradation). When a model, instruction, data, supplier or use is changed, change control with impact review, reverification and approval is carried out. The inventory, risk assessment table, SoA, guidelines and model versions are under revision control, and incident response and AI awareness training are also operated.
Monitoring results and change history are continued in the Step 9 operational control register. Approval compliance (AI used without approval, use outside the approved scope, expiry of conditions or reassessment deadlines, unauthorized change after approval) is checked as the first important issue of monitoring.
Incident response is placed as a subprocess within this step: an incident register (type and grade S1 to S3), initial actions by grade, reporting and external notification deadlines, and cases meeting the criteria are passed to Step 15 Nonconformity and Corrective Action and Step 5 risk reassessment (Step 6 impact assessment for impacts on people and society).
Output
- Monitoring table of approved AI use status and important risks: indicator / measurement method and logs / frequency / alert criterion / action to take when exceeded
- Change control record and revision control register (version, revision date, reason, reassessment needed, approval)
- Incident response procedure and AI awareness training plan
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Model performance degradation, retraining and version control, reverification when changed, model and dataset versions in the revision register | Receipt of problems and accidents during customer use, notification to customers at changes, revision history of the provided version | Checking of usage logs and output, monitoring of supplier changes (models and terms), revision of use guidelines |
Next steps
Previous steps: 9 Operational Control · 5 AI Risk Assessment · 6 AI System Impact Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 8 Verification and Use Approval · 2 AI Policy, Roles and Objectives · 10 Documented Information Control · The output of this step is carried forward in: 2 AI Policy, Roles and Objectives · 5 AI Risk Assessment · 6 AI System Impact Assessment · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring · 14 Management Review · 15 Nonconformity and Corrective Action · 16 Improvement
