Once AI is live, including vendor AI, it is watched continuously, because AI is uncertain and dynamic and models go stale or degrade as data and relationships drift; the depth and frequency of monitoring follow materiality. Five elements. Measures: metrics and acceptable limits chosen from the risks of the use case, spanning robustness, stability, data quality and fairness, with tiered early-warning levels that prompt action before deterioration bites, checks for drift in input data, in the input-output relationship and in the model overall, and, where relevant, monitoring of the information flows and decision paths inside AI-driven workflows, such as reasoning steps, actions taken and tools called. Incidents and issues: processes for reporting, tracking, escalating and resolving breaches and anomalies, with remedies ranging from retraining and tuning to rebuilding or retiring the model, kill switches or overrides for high-materiality AI, and channels through which users can give feedback and report problems. Roles: responsibility for monitoring and incident handling assigned, including one accountable person. Records: monitoring activity, results, issues, incidents and remediation documented; access to models, training data, pipelines and configuration tightly controlled and logged; and, for Generative AI and agents, richer logging considered, such as prompts and responses with the model version and reasoning used. Training: monitors trained to monitor and manage incidents well, and users trained and alert enough to report AI behaving unexpectedly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.