Setting up and maintaining the risk management system (Article 9)

Short answer: Article 9 of the AI Act requires providers of high-risk AI to establish and maintain a risk management system. It revolves around a continuous cycle: identify, estimate and mitigate foreseeable risks to health, safety and fundamental rights with appropriate measures, and keep monitoring how they perform. It is not a one-off report but a process that runs for the system's whole lifetime.

A continuous process, not a snapshot

Article 9 explicitly describes the risk management system as a continuous, iterative process that runs across the system's entire lifecycle. A risk assessment you do once and then file away does not suffice. With every change to the system, the data or the use, you must run the cycle again. Findings from post-market monitoring feed back into the system.

The steps of Article 9

The regulation prescribes a recognisable cycle:

• Identify and analyse the known and reasonably foreseeable risks the system can pose under intended use.
• Estimate and evaluate risks that may arise under intended use and under reasonably foreseeable misuse.
• Evaluate risks that emerge from post-market monitoring.
• Adopt appropriate measures to manage those risks.

Measures must be chosen so that the residual risk of each hazard — and the overall residual risk — is judged acceptable.

Residual risk and the order of measures

Not every risk can be fully removed. Article 9 calls for a fixed order: first design out or reduce risks in the design itself, then add protective measures for risks that remain, and finally provide information and training for deployers. The remaining residual risk must be assessed and communicated explicitly, not accepted tacitly.

Attention to vulnerable groups

Article 9 calls for particular attention to systems that may impact vulnerable groups, including children. When estimating risks you must consider whether a system could unintentionally harm certain groups. That connects risk management to the broader fundamental-rights consideration in the AI governance framework.

Relation to documentation and assessment

The risk management system does not stand alone. Its outcomes belong in the technical documentation (Annex IV) and form part of the conformity assessment. See also the high-risk obligations overview.

What to do

• Set up a fixed cycle with clear owners and recurring review moments.
• Document each step: identification, estimation, measure and residual risk.
• Apply the order of measures: design first, then protection, then information.
• Feed monitoring back: let real-world signals adjust the risk assessment.
• Assess residual risk explicitly and record why it is acceptable.

A risk management system that does not move with the system is compliant on paper and empty in practice.