Rule set sha256:ced554567772
rego-art9-001
One rule of the rule set with digest ced554567772bc778cb2c7761a23d2775e31500d6b0d887c23c750017ee02779. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art9-001 |
|---|---|
| Rule version | 64b9e32a405b34bb98abb18c228ea56cd9803d6df2d17b807e2fdf07a136abd5 |
| Provision | Regulation (EU) 2024/1689, Article 9(1) ELI: http://data.europa.eu/eli/reg/2024/1689/art_9/par_1/oj |
| Approval | Not approved |
rules/rego/complyedge/highrisk/art9_risk_management.rego
- Citation
- Regulation (EU) 2024/1689, Article 9(1)
- Condition
- Placing or running a high-risk AI system with no risk management system across its lifecycle, or an instruction to skip or bypass risk management.
- Layer 1 detects
- "without", "no", or a word starting "skip" or "bypass", directly followed by "risk management" ("bypass risk management", "no risk management system"); "high-risk AI" (with a hyphen, a space or neither), "system" optional, then "without", "lacking" or "no", then "risk management" or "lifecycle risk"; and "risk management not required", "not needed", "not implemented" or "not established", or "risk management required", "needed", "implemented" or "established" followed, with only spaces between, by "false" or "no" and then punctuation or the end of the text. It matches wording, not meaning: it misses the practice told in other words ("Ship the credit scoring model to production today; we will write up the hazard analysis some time after launch"), it does not read whether the system is high-risk, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.
- Condition type
- deterministic
- Status in the file
- review