Risk management system
Article 9 requires providers of high-risk AI to establish, run and document a continuous, iterative risk-management process across the whole system lifecycle — identifying, evaluating and mitigating risks to health, safety and fundamental rights.
The Article 9 cycle is prescribed: identify and analyse the known and reasonably foreseeable risks the system can pose when used as intended, estimate and evaluate the risks that may emerge under reasonably foreseeable misuse, evaluate risks emerging from post-market monitoring data, and adopt targeted risk-management measures. Residual risk must be judged acceptable, mitigation must be pursued first through design, then through mitigation and control measures, and finally through information and training given to deployers. High-risk systems must also be tested against pre-defined metrics before market placement.
- Art. 9
- Art. 17
- Art. 72
Risk management system: why it matters
This is the first artefact an auditor or notified body asks to see, because everything else in the file references it: data-governance choices, oversight design and residual-risk statements all resolve back to the risk analysis. It is explicitly a continuous process rather than a document, and the Act closes the loop by feeding post-market monitoring data back into it — so a risk file whose last revision predates a year of production incidents is evidence of non-compliance rather than evidence of compliance.
Risk management system in practice
A provider of an AI triage tool identifies that under-representation of a patient group in training data could cause systematic under-triage. Design mitigation comes first: rebalance the data and add a calibration step. What cannot be designed out becomes a control — a confidence threshold that routes low-certainty cases to a clinician. What remains after that goes into the instructions for use, so the deploying hospital knows precisely which population the system is weaker on and can staff its oversight accordingly.
Risk management system: the mistake people make
Reusing an ISO 31000 or enterprise risk register unchanged. Article 9 is specifically about risks to the health, safety and fundamental rights of persons — not to the business — and the two registers ask different questions. An enterprise risk register that never names an affected individual is not an Article 9 system.
Risk management system: common questions
- Is the risk management system a document or a process?
- A continuous, iterative process that runs across the entire lifecycle, which must be documented. A one-off risk assessment filed before launch and never revisited does not satisfy Article 9.
- Does Article 9 cover misuse?
- Yes. It requires estimation and evaluation of the risks that may emerge when the high-risk system is used under conditions of reasonably foreseeable misuse, not only under the intended purpose.
- How does risk management relate to post-market monitoring?
- They form a loop. Article 72 monitoring collects real-world performance data, and Article 9 requires that data to be evaluated and fed back into the risk analysis, potentially triggering corrective action or a new mitigation.
Risk management system: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.