EU_AI_ACT_ART9_RISK_MANAGEMENT_001

rules/regulations/eu/eu_ai_act_article9_risk_management.yaml

Citation

Regulation (EU) 2024/1689, Article 9(1): A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems. Article 9(2), first sentence: The risk management system shall be understood as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating.

Condition

Requires establishing, implementing, documenting, and maintaining a continuous risk management system throughout the lifecycle of high-risk AI systems, covering identification, estimation, evaluation, and mitigation of risks to health, safety, or fundamental rights. Article 9.

Layer 1 detects

"without risk management"; no risk management or assessment system, process or plan; skip or skipping risk management or assessment; risk management not required, needed or implemented; bypass or bypassing risk management or assessment; deploy or deploying without risk; high-risk (also "high risk"), optionally followed by AI and system, then "without risk" or "without lifecycle"; no continuous or iterative risk or monitoring; residual risk not assessed, acceptable or evaluated; unmitigated risk or hazard; and risk identification or evaluation not performed or conducted. It matches wording, not meaning: it misses the practice told in other words ("Ship the credit scoring model to production today; we will write up the hazard analysis some time after launch."), it does not read whether the system is high-risk, and it fires on text that only names a missing risk process, such as an audit finding. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

review