Drift is the failure mode you will not notice

Validation is a photograph, not a warranty

Every model is validated against data from a particular set of places, at a particular time, with whatever coding and recording habits were in force. That is a snapshot of a moving thing.

The population changes. A hospital opens a new unit and the case mix shifts. A coding practice is updated and a field that used to be populated one way is now populated another. An upstream system is upgraded and starts sending a value in different units.

None of those events look like a failure. Nothing throws an error. The model carries on producing output that is the right shape and increasingly the wrong answer.

You usually cannot measure accuracy in production

The instinct is to monitor accuracy directly, and in most clinical settings you cannot, because the ground truth arrives late or never. If a model flags deterioration risk, the confirmation is a clinical outcome that may be days away and confounded by the intervention the flag itself triggered.

So accuracy monitoring alone gives you a number that is stale, noisy and partly caused by the thing it is meant to evaluate.

That does not mean nothing can be watched. It means the useful signals are earlier in the chain.

Watch the inputs first

The distribution of each input is observable immediately, without waiting for an outcome. If a feature that has always been present in almost every record is now missing in a noticeable share, something upstream changed, and that is worth knowing today rather than next quarter.

The same applies to ranges and units. A value that has quietly moved by a factor of ten is not a modelling problem; it is an integration problem wearing a modelling problem's clothes, and looking at inputs is how you tell the difference.

We treat these checks as part of the integration surface rather than as data-science tooling, because that is where the cause almost always is.

Watch the outputs for shape, not correctness

The rate at which a model fires is informative even when you cannot yet say whether each firing was right. A model that suddenly flags twice as many patients has either encountered a genuine change in the population or has broken. Both warrant a look, today.

Confidence distribution matters too. A model that has become uniformly more confident is usually not more knowledgeable.

Overrides are the earliest honest signal

As we have written elsewhere, the override is a first-class action. It is also the most valuable monitoring input in the system, because it is a clinician telling you in real time that the output did not match the patient in front of them.

A rise in override rate confined to one ward, one shift pattern or one cohort is a far sharper signal than an aggregate accuracy figure, and it arrives weeks earlier.

This is one of the reasons we resist making overrides costly. A friction that suppresses them does not improve the model; it hides the evidence.

Decide the response before you need it

Monitoring without a pre-agreed response produces dashboards nobody acts on. So the thresholds and the actions are decided in advance: what change warrants investigation, what warrants narrowing the model's scope, and what warrants turning the advisory off entirely while it is looked at.

Turning it off has to be genuinely available. A model that cannot be disabled without a release is a model that will stay on through a problem, because the alternative is worse.

And the clinicians who rely on it need to know it has changed. A silent scope reduction is its own kind of drift.