EU AI Act Risk Management System

Article 9 EU AI Act requires providers of high-risk AI systems to establish, implement, document and maintain a risk management system. The system must be planned and run as a continuous iterative process throughout the entire lifecycle of the AI system. Specifically, it covers: (a) identification and analysis of known and foreseeable risks, (b) estimation and evaluation of risks arising from intended use and reasonably foreseeable misuse, (c) evaluation of further risks based on post-market monitoring data under Article 72, and (d) adoption of appropriate risk management measures. The implementation deadline for high-risk AI systems is August 2026.

The risk management process under Article 9 AI Act comprises four core steps: First, risk identification — the systematic determination of all known and foreseeable risks to health, safety and fundamental rights. Second, risk assessment — the estimation of identified risks considering intended use and reasonably foreseeable misuse. Third, risk mitigation — determining appropriate measures following the principle: first elimination, then reduction, finally documented acceptance of residual risks. Fourth, validation — testing against predefined metrics and probabilistic thresholds before placing on the market.

The risk management system under Article 9 AI Act differs from traditional risk management in several ways: It is specifically designed for the entire lifecycle of an AI system — from conception to decommissioning. It requires consideration of AI-specific risks such as algorithmic bias, lack of explainability and unintended impacts on fundamental rights. The system must also account for interactions between the various requirements in Chapter III Section 2 (Article 9(4)). Unlike traditional risk approaches, the AI Act also mandates specific testing requirements with predefined metrics and probabilistic thresholds.

Article 9(7) AI Act requires high-risk AI systems to be tested at appropriate points throughout the development process — and in any case before placing on the market or putting into service. Tests must be performed against predefined metrics and probabilistic thresholds appropriate for the intended purpose. Particular consideration must be given to whether the system is intended for minors or other vulnerable groups (Article 9(9)). Testing under real-world conditions may be conducted in accordance with Article 60.

Under Article 9(6) AI Act, residual risks that cannot be fully eliminated through mitigation measures must be classified as acceptable and documented. The residual risks, taken together with the measures adopted, must not pose an unacceptable risk. The provider must inform users about residual risks and provide appropriate instructions for use. Documentation of residual risk acceptance forms part of the technical documentation under Article 11 and is reviewed by market surveillance authorities.

For high-risk AI systems under Annex III of the EU AI Act, the transition period runs until 2 December 2027. From that date, all providers of such systems must be able to demonstrate a complete risk management system in accordance with Article 9. For AI systems used as safety components of products under Annex I, the requirements apply from 2 August 2028. We recommend starting implementation now, as building a comprehensive risk management system typically takes 6 to 12 months.

ADVISORI supports the complete implementation of Article 9 AI Act in four phases: (1) inventory and classification of your AI systems according to the AI Act risk categories, (2) building the risk management system with risk assessment procedures, metrics and documentation templates, (3) integration into existing governance structures such as ERM frameworks or ISO 31000, and (4) support with testing and validation before placing on the market. We account for interactions with other requirements including the quality management system (Article 17), technical documentation (Article 11) and post-market monitoring (Article 72).