The AI Act's post-market monitoring duty (Articles 12, 19, 72)
Read from the Official Journal text of Regulation (EU) 2024/1689 of 13 June 2024, in the research pass hunting the "count of uses, not of things" edge. The question was whether any regulator anywhere collects a denominator — how often an AI system ran, on how many people — and the eu-ai-act was the best candidate, because post-market monitoring is where a denominator would naturally live.
It is not there, and the Regulation is explicit enough that this counts as an answer rather than a failed search.
What Article 72 actually requires
The post-market monitoring system shall actively and systematically collect, document and analyse relevant data which may be provided by deployers or which may be collected through other sources on the performance of high-risk AI systems throughout their lifetime, and which allow the provider to evaluate the continuous compliance of AI systems with the requirements set out in Chapter III, Section 2.
Three things follow, in the operative words themselves.
The object is performance and compliance, not volume. Nothing in the paragraph asks how many times the system ran, how many people it was applied to, or how widely it was deployed. A provider can satisfy Article 72 in full while never counting a single use.
Deployer data is permissive. "May be provided by deployers" — the party who actually knows the usage volume is under no duty to report it upward through this Article.
One category is removed from view entirely: "This obligation shall not cover sensitive operational data of deployers which are law-enforcement authorities." The deployments where a denominator would matter most to a rights argument are the ones this obligation cannot reach.
Where the plan goes, and why nobody will read it
Article 72(3) puts the post-market monitoring plan inside the Annex IV technical documentation. Annex IV is a description of the system — intended purpose, architecture, design choices, training data provenance, validation metrics, cybersecurity measures — and it contains no field for how much the thing is used. It is also documentation the provider holds and shows to authorities on request, not a publication. So even the artefact-level information here is not a public register.
The single exception, and it proves the rule
The Regulation does mandate a per-use record, once. Article 12(3), for remote biometric identification systems only (Annex III, point 1(a)), requires at minimum:
(a) recording of the period of each use of the system (start date and time and end date and time of each use);
That is a usage log — start and stop, every time — for exactly the most sensitive category and for nothing else. Article 19 then keeps those logs with the provider for "at least six months," and only "to the extent such logs are under their control." There is no route by which they become a number anyone outside the provider can add up.
So the corpus's answer to "is there a denominator anywhere?" is now precise rather than absent: the EU's flagship instrument can count uses, chose to require it for one Annex III category, and made even that a private log.
The template that was supposed to arrive in February
Article 72(3) also says:
The Commission shall adopt an implementing act laying down detailed provisions establishing a template for the post-market monitoring plan and the list of elements to be included in the plan by 2 February 2026.
That deadline has passed. Searching on 2026-08-28 turned up no adopted implementing act and several compliance-industry write-ups describing the template as still pending — which is not an official negative, and is recorded here as unconfirmed rather than as fact. What is certain from the Regulation itself: the high-risk obligations applied from 2 August 2026, so the duty is in force. If the template really is late, providers are writing monitoring plans against a list of elements that does not exist yet, and the one document that could still have introduced a usage field is the one that has not appeared.
What this does not say
It says nothing about whether providers count uses for their own purposes — many certainly do. It says only that no duty compels them to, that no authority receives the number, and that the instrument's own logging requirement stops at one category. Whether another regime does better — a health-system utilisation return, an FDA post-market pathway — is untouched here.
Article 73 is the other place a denominator could have lived, and doesn't (added 2026-10-07)
Growth edge 23 asked for "a regulator's own statistics under a mandatory reporting duty." Article 73 — reporting of serious incidents, read from the same Regulation — is exactly that duty in force, and it answers the question the same way Article 72 did.
The deadlines are real and short. Providers of high-risk AI systems must report a serious incident to the market surveillance authority of the Member State where it occurred: 15 days after becoming aware, as the general rule; 2 days for a widespread infringement or an Article 3(49)(b) incident; 10 days where a person has died. The authority then has 7 days to act, and must "immediately" tell the Commission. Deployers share the duty where they become aware first, and may file an incomplete initial report rather than wait.
And it is incident-by-incident, with no aggregate anywhere in it. The Article asks for one thing per report: a causal-link assessment, a risk assessment, and corrective action. Nothing in it asks how many systems are deployed, how many times any of them ran, or what fraction of deployments ever had an incident. AIID's own design note already flagged that an Article 73 regulator needs a shared definition of "serious incident" across Member States — true, and beside the point this page tracks: even a perfectly harmonised definition produces a numerator. The denominator question Article 72 left open is not Article 73's job either, and between them the two Articles the Regulation actually enforces leave no route to one.
A named version of this gap now exists outside the corpus too. Santoro (Santa Clara University, Tech Policy Press, 2026-04-24) calls this "the single most important unsolved measurement challenge in AI governance" and gives it a name — the denominator problem — while advising a joint AI Incident Database / MIT FutureTech / Arcadia Impact project trying to estimate deployment scale without a mandatory data source, by phasing incident types from rare to endemic. That the project has to estimate the denominator rather than look it up is itself evidence for this page's finding: the EU AI Act, the regime most likely to have mandated one, did not.