# Establish a risk management system for high-risk AI

- **Record type**: Obligation
- **Instrument**: Regulation (EU) 2024/1689 — Artificial Intelligence Act
- **Jurisdiction**: European Union
- **Category**: risk_management
- **Binding**: Yes
- **Applies from**: 2027-12-02
- **Provision**: Article 9

## In brief

Establish a risk management system for high-risk AI is a legal requirement under the EU AI Act in the European Union (Article 9). It applies from 2 December 2027. The record carries 2 evidence examples and mappings to 2 frameworks. In practice: Set up a lifecycle risk register per high-risk system with test evidence and residual-risk acceptance.

## What the duty requires

Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.

## What an organisation does about it

Set up a lifecycle risk register per high-risk system with test evidence and residual-risk acceptance.

## Controls that meet this duty

- AI risk assessment and lifecycle risk register (satisfies): https://aipolicytracker.org/controls/ai-risk-assessment
- Accuracy, robustness, fairness and security testing (supports): https://aipolicytracker.org/controls/accuracy-robustness-security-testing
- Post-deployment monitoring and drift detection (supports): https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection

## Parent instrument

- Regulation (EU) 2024/1689 — Artificial Intelligence Act
  - Record: https://aipolicytracker.org/policies/eu-ai-act
  - Context file: https://aipolicytracker.org/policies/eu-ai-act.md

## Provenance

- **Permanent id**: AIPT-OBL-0006 (https://aipolicytracker.org/id/AIPT-OBL-0006; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system
- **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- **Provision**: Article 9
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Establish a risk management system for high-risk AI (EU AI Act)" [AIPT-OBL-0006, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0006 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.