{"slug":"eu-ai-act-risk-management-system","id":"AIPT-OBL-0006","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0006","title":"Establish a risk management system for high-risk AI","short_title":"Risk management system","category":"risk_management","summary":"Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.\n","practical_action":"Set up a lifecycle risk register per high-risk system with test evidence and residual-risk acceptance.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 9","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","education","public_services","safety_critical"],"applicability":[{"description":"Providers of AI systems classified as high-risk under Article 6.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Risk register and treatment plan","description":null,"artifact_type":"register"},{"title":"Pre-market test reports","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clauses 6.1.2, 6.1.3, 8.2, 8.3 and Annex A controls on AI risk","note":"Original editorial mapping.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP, MEASURE and MANAGE functions","note":"The AI RMF's core functions map closely to Article 9's iterative process.","confidence_level":"high","is_original":true}],"controls":[{"slug":"ai-risk-assessment","title":"AI risk assessment and lifecycle risk register","kind":"process","relationship":"satisfies","note":"Continuous lifecycle risk process with register, testing evidence and residual-risk acceptance.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-risk-assessment"},{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"supports","note":"Testing confirms that mitigations work.","confidence_level":"high","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Post-market data feeds risk re-evaluation.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}