AI Act Article 9: Obligations, Deadlines & Penalties

A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems. Regulation (EU) 2024/1689, Article 9, Article 9

The risk management system shall be a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating. Regulation (EU) 2024/1689, Article 9, Article 9

Identify and analyze the known and reasonably foreseeable risks that the high-risk AI system can pose to health, safety or fundamental rights when used in accordance with its intended purpose. Regulation (EU) 2024/1689, Article 9, Article 9

Estimate and evaluate the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of reasonably foreseeable misuse. Regulation (EU) 2024/1689, Article 9, Article 9

Evaluate other risks possibly arising, based on the analysis of data gathered from the post-market monitoring system referred to in Article 72. Regulation (EU) 2024/1689, Article 9, Article 9

Adopt appropriate and targeted risk management measures designed to address the risks identified pursuant to point (a). Regulation (EU) 2024/1689, Article 9, Article 9

Risk management measures shall give due consideration to the effects and possible interaction resulting from the combined application of the requirements set out in this Section, with a view to minimising risks more effectively while achieving an appropriate balance. Regulation (EU) 2024/1689, Article 9, Article 9

Ensure that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems is judged to be acceptable. Regulation (EU) 2024/1689, Article 9, Article 9

Eliminate or reduce risks identified and evaluated pursuant to paragraph 2 in as far as technically feasible through adequate design and development of the high-risk AI system. Regulation (EU) 2024/1689, Article 9, Article 9

Where appropriate, implement adequate mitigation and control measures addressing risks that cannot be eliminated. Regulation (EU) 2024/1689, Article 9, Article 9

Provide information required pursuant to Article 13 and, where appropriate, training to deployers, giving due consideration to the technical knowledge, experience, education, and training expected by the deployer. Regulation (EU) 2024/1689, Article 9, Article 9

High-risk AI systems shall be tested for the purpose of identifying the most appropriate and targeted risk management measures. Regulation (EU) 2024/1689, Article 9, Article 9

Testing shall ensure that high-risk AI systems perform consistently for their intended purpose and that they are in compliance with the requirements set out in this Section. Regulation (EU) 2024/1689, Article 9, Article 9

Testing of high-risk AI systems shall be performed, as appropriate, at any time throughout the development process, and, in any event, prior to their being placed on the market or put into service. Regulation (EU) 2024/1689, Article 9, Article 9

Testing shall be carried out against prior defined metrics and probabilistic thresholds that are appropriate to the intended purpose of the high-risk AI system. Regulation (EU) 2024/1689, Article 9, Article 9

When implementing the risk management system, providers shall give consideration to whether in view of its intended purpose the high-risk AI system is likely to have an adverse impact on persons under the age of 18 and, as appropriate, other vulnerable groups. Regulation (EU) 2024/1689, Article 9, Article 9