Rule set sha256:c63def17fac2
rego-art9-001
One rule of the rule set with digest c63def17fac2df12ab70941d8fcb7678e9a670479ea0d6dce87e7ddd4dc96079. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art9-001 |
|---|---|
| Rule version | 4155149917bc337aa9de32f8651fcb679fd7bb87108c76b7e8e14545715c9788 |
| Provision | Regulation (EU) 2024/1689, Article 9(1) ELI: http://data.europa.eu/eli/reg/2024/1689/art_9/par_1/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-22 (via agent review per §5.1 amendment v1.1) |
rules/rego/complyedge/highrisk/art9_risk_management.rego
- Citation
- Regulation (EU) 2024/1689, Article 9(1)
- Condition
- Placing or running a high-risk AI system with no risk management system across its lifecycle, or an instruction to skip or bypass risk management.
- Layer 1 detects
- "without", "no", or a word starting "skip" or "bypass", directly followed by "risk management" ("bypass risk management", "no risk management system"); "high-risk AI" (with a hyphen, a space or neither), "system" optional, then "without", "lacking" or "no", then "risk management" or "lifecycle risk"; and "risk management not required", "not needed", "not implemented" or "not established", or "risk management required", "needed", "implemented" or "established" followed, with only spaces between, by "false" or "no" and then punctuation or the end of the text. It matches wording, not meaning: it misses the practice told in other words ("Ship the credit scoring model to production today; we will write up the hazard analysis some time after launch"), it does not read whether the system is high-risk, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- approved