Risk management system (AI)
A continuous process, throughout the life of a high-risk AI system, to identify, evaluate and reduce its risks.
Article 9 requires providers of high-risk systems to maintain a risk management system: not a one-off document, but a process repeated throughout the system's life cycle.
Its steps are: identify known and foreseeable risks to health, safety and fundamental rights; estimate those that may arise under intended use and reasonably foreseeable misuse; evaluate those that emerge from post-market monitoring data; and adopt measures to eliminate or reduce them. Remaining risks must be acceptable and communicated to the user.
It also requires testing the system before placing it on the market and paying special attention to its impact on minors and other vulnerable groups. Frameworks such as the NIST AI RMF or ISO/IEC 42001 help structure it.
Read more: ISO/IEC 23894: AI risk management in 5 steps.
Reference: Art. 9 AI Act
Related terms
Take the free assessment and find out in a few minutes which obligations your company has and where to start.
← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.