Rule set sha256:026d59ecf618
rego-art9-001
One rule of the rule set with digest 026d59ecf6186f63d5f16b503c9429b896cee28ca509559704824e11f4530007. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
rules/rego/complyedge/highrisk/art9_risk_management.rego
- Citation
- Regulation (EU) 2024/1689, Article 9(1)
- Condition
- Placing or running a high-risk AI system with no risk management system across its lifecycle, or an instruction to skip or bypass risk management.
- Layer 1 detects
- "without", "no", or a word starting "skip" or "bypass", directly followed by "risk management" ("bypass risk management", "no risk management system"); "high-risk AI" (with a hyphen, a space or neither), "system" optional, then "without", "lacking" or "no", then "risk management" or "lifecycle risk"; and "risk management not required", "not needed", "not implemented" or "not established", or "risk management required", "needed", "implemented" or "established" followed, with only spaces between, by "false" or "no" and then punctuation or the end of the text. It matches wording, not meaning: it misses the practice told in other words ("Ship the credit scoring model to production today; we will write up the hazard analysis some time after launch"), it does not read whether the system is high-risk, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- approved