The model that validated well in January can be quietly worse in December. Nothing announces it.
Model drift is the degradation of an AI system's performance after deployment, caused by changes in the patient population, documentation practices, upstream systems or clinical workflows that make live data differ from the data the model was trained and validated on. It is gradual and produces no error message, so it is invisible without deliberate monitoring. HSA's December 2025 GL-04 update requires documented post-market performance monitoring processes covering drift, distribution shift and degradation in prediction quality.
A model learns relationships in the data it was trained on. It keeps applying those relationships regardless of whether they still hold.
That last one is specific to deployed clinical AI and is the least appreciated. A tool that flags high-risk patients causes those patients to be treated differently, which alters the outcomes the model was predicting.
Drift produces no error. The system continues returning confident, plausible outputs. It is simply wrong more often than it used to be, and the increase is gradual enough that no individual clinician encounters a moment that feels like a system failure.
By the time it is visible without monitoring, it is usually visible as an incident.
HSA's December 2025 GL-04 revision requires documented post-market performance monitoring processes that include detecting model drift, distribution shift and degradation in prediction quality over time, plus documented controls for models that update based on post-deployment data.
AIHGle 2.0 places the deployer responsibility for AI in service with the healthcare organisation, which means the monitoring question is yours whether or not your vendor performs the monitoring.
Drift monitoring is the item most often assumed by both parties in a contract and owned by neither. The vendor assumes the institution is watching clinical outcomes. The institution assumes the vendor is watching model performance. Both assumptions are reasonable and they do not add up to coverage.
Make it explicit at contract stage. Who computes what, how often, against which threshold, and who receives the alert. If the answer involves anyone reviewing a dashboard voluntarily, it will not happen after month three.
The harder point: monitoring requires ground truth, and in clinical settings the true answer often arrives months later or never. A model predicting deterioration can only be evaluated against what actually happened, which means your monitoring lags your exposure. Organisations that have thought about this build proxy measures and accept they are proxies. Organisations that have not tend to discover the problem when someone asks how they know the model still works.