ISO 42001 A.6.6: AI System Operational Monitoring
As AI systems drive business decisions, undetected degradation and model drift can silently erode performance and create compliance blind spots. ISO 42001 A.6.6 requires continuous monitoring of AI systems in operation to catch performance decay, data distribution shifts, and emerging risks before they impact your organization. This control ensures you have visibility into what your AI models are actually doing—and can respond when things go wrong.
What this means
This control requires organizations to implement ongoing monitoring of deployed AI systems to detect degradation, unexpected behavior, and emerging risks. Monitoring must track model drift (changes in model performance over time), shifts in input data distributions, compliance with established performance metrics, and adverse outcomes. Results must be reviewed at regular, defined intervals to ensure early detection of issues and timely corrective action.
How to comply
- 1.Establish baseline performance metrics for each deployed AI system (accuracy, precision, recall, latency, fairness measures)
- 2.Implement automated monitoring to detect model drift and track performance degradation over time
- 3.Monitor input data distributions to identify when new data significantly differs from training data
- 4.Log and track adverse outcomes, unexpected behaviors, and edge cases in production
- 5.Define review intervals (daily, weekly, monthly) appropriate to each system's risk level and business criticality
- 6.Document monitoring results and maintain an audit trail of detected issues and remediation actions
- 7.Create alert thresholds that trigger escalation when performance drops below acceptable levels
- 8.Conduct regular (at least quarterly) reviews of monitoring data to identify emerging risks
Evidence auditors look for
- AI model performance monitoring dashboard showing accuracy, drift metrics, and data distribution changes over time
- Automated alerts and logs documenting detected model degradation or unexpected behavior
- Data distribution analysis reports comparing current input patterns to baseline training data
- Adverse outcome registry tracking unexpected or harmful model outputs
- Monitoring review meeting minutes with defined frequency and documented assessment of results
- Alert thresholds and escalation procedures defined in AI governance documentation
- Performance metric baselines and review intervals documented in the AI system inventory
- Corrective action records for issues identified through monitoring
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates AI system monitoring by connecting to your model pipelines, tracking drift and performance metrics in real-time, and surfacing alerts for A.6.6 review intervals—eliminating manual monitoring spreadsheets and ensuring no degradation goes undetected.
See how GRCWatch handles this control automatically
Start free trial