Practice Operator

Defined escalation paths for AI system incidents: who to notify, when, through which channels. Automated escalation based on incident severity classification. A minor data quality issue escalates to the data team. A fundamental output deviation escalates to leadership and triggers the serious incident reporting workflow. Every escalation is logged, timed, and traceable.

Emergency override protocols for AI system shutdown, rollback, or manual override, documented, tested, and audited. When an AI system must be stopped immediately, operators follow a tested procedure, not improvised panic. Break glass events are logged with full context: who triggered it, why, what happened next, and when the system was restored.

Step-by-step operational procedures for AI system management: monitoring checks, scheduled reviews, maintenance windows, and update procedures. Created in Practice Compliance by officers who understand the regulatory requirements, executed here by operations personnel who manage the systems day-to-day. Every step has a regulatory reference explaining why it exists.

Continuous monitoring of model performance drift, data distribution shift, and output deviation from expected ranges. Configurable thresholds with automated alerting; when a credit scoring model's approval rate drifts beyond the configured boundary, the operator is alerted before the drift becomes a compliance issue. Historical drift data supports trend analysis and root cause investigation.

Real-time detection of AI system behaviour that deviates from documented intended purpose, expected output ranges, or regulatory boundaries. StackSeal integration provides cryptographic compliance verification, proving that the system in production matches the system that was assessed and approved. When deviation is detected, the system flags the discrepancy and triggers the appropriate escalation path.

Structured post-market monitoring as required by Article 72. The platform collects and analyses data on AI system performance throughout its lifecycle, not just at deployment. Monitoring plans define what data to collect, how to analyse it, and what thresholds trigger action. Monitoring results feed into the conformity assessment evidence base.

When a serious incident occurs, Article 73 requires reporting to the relevant market surveillance authority within 72 hours. Practice Operator structures this obligation: pre-populated reporting templates, automated timeline tracking, authority contact details, and submission confirmation. The 72-hour clock is visible from the moment an incident is classified as serious.

Compliance evidence is collected continuously during operations, not assembled retrospectively before an audit. Monitoring logs, oversight actions, incident responses, and drift analyses are automatically catalogued as compliance evidence. When the auditor arrives, the evidence already exists. When the regulator asks, the data is already structured.