EU AI Act Article 9: risk management system requirements

For CTOs and product leads running high-risk AI systems in the EU, Article 9 is the operational core of compliance. It does not ask you to eliminate risk; it requires you to systematically identify, analyse, evaluate, and mitigate it throughout your system's entire lifecycle. This is not a one-time audit. It is an ongoing process that must be embedded into how your engineering and product teams work, and it must be documented in a way that a market surveillance authority can inspect at any time.

What the EU AI Act requires

Article 9 requires providers of high-risk AI systems to establish, implement, document, and maintain a risk management system. This system must run throughout the entire lifecycle of the AI system, from design through deployment and post-market monitoring. Specifically, Article 9(2) requires the identification and analysis of known and reasonably foreseeable risks, the estimation and evaluation of risks that may emerge during intended use and reasonably foreseeable misuse, and the adoption of risk management measures. Article 9(4) specifies that residual risks must be judged acceptable, weighing the benefits of the system against its risks. Article 9(6) requires that risk management measures be tested for their effectiveness before the system is placed on the market. Article 9(7) obliges providers to consider the effect of the system on vulnerable groups, including children, when relevant to the use case.

What this means for your business

A startup with an AI-powered hiring tool must not only identify the risk that the model discriminates against protected characteristics; it must document how that risk was assessed, what mitigations were put in place, how those mitigations were tested, and what residual risk remains. The same applies to a fintech using AI for credit scoring, a healthtech using AI for patient prioritisation, or an insurtech using AI for risk underwriting. Any system in an Annex III category carries this obligation. The risk management process must be updated whenever the system changes materially, which means your change management process needs to integrate compliance review as a standing step. The compliance deadline for Annex III high-risk systems is December 2, 2027.

Steps to get compliant

1. Define the scope of your risk management system in writing, covering the specific AI system, its intended purpose, and the deployment contexts covered by your conformity assessment.
2. Conduct a structured risk identification workshop with engineering, product, legal, and operations teams to surface known risks and plausible misuse scenarios, and record every finding in a risk register.
3. Map each identified risk to a mitigation measure, assign an owner, and schedule testing of the mitigation before your next product release cycle.
4. Establish a quarterly review cadence to update the risk register as your model, data, or deployment context changes, and document each review cycle to demonstrate the ongoing nature of the process to auditors.

Free EU AI Act risk assessment

Not sure where your AI system stands? The free ActComply risk screener classifies your system in under 5 minutes. No sign-up required.