Rule set sha256:5f51c649da68
rego-art9-001
One rule of the rule set with digest 5f51c649da68af0ecaa5c68cf661a38494e679fd256373f2ef9f959f54671693. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
rules/rego/complyedge/highrisk/art9_risk_management.rego
- Citation
- Regulation (EU) 2024/1689, Article 9(1)
- Condition
- Placing or running a high-risk AI system with no risk management system across its lifecycle, or an instruction to skip or bypass risk management.
- Layer 1 detects
- "without", "no", or a word starting "skip" or "bypass", directly followed by "risk management" ("bypass risk management", "no risk management system"); "high-risk AI" (with a hyphen, a space or neither), "system" optional, then "without", "lacking" or "no", then "risk management" or "lifecycle risk"; and "risk management not required", "not needed", "not implemented" or "not established", or "risk management required", "needed", "implemented" or "established" followed, with only spaces between, by "false" or "no" and then punctuation or the end of the text. It matches wording, not meaning: it misses the practice told in other words ("Ship the credit scoring model to production today; we will write up the hazard analysis some time after launch"), it does not read whether the system is high-risk, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- approved