Article 9: risk management system
A continuous, documented risk management system across the entire lifecycle of a high-risk AI system.
The official source remains authoritative. This general interpretation is not legal advice.
- Status
- Upcoming
- Application date
- 2 December 2027
- Version
- 1.0.0
- Last reviewed
- 8 August 2026
Who this is relevant to
When this applies
Provider of an AI system
A party that develops or has an AI system developed and places it on the market under its own name.
- 1The system is high-risk under Article 6 and the provider places it on the market or puts it into service.
What the official source establishes
Article 9 requires a risk management system as a continuous, iterative process across the entire lifecycle, with identification, analysis, evaluation and mitigation of risks to health, safety and fundamental rights, and testing to determine the most appropriate measures.
For the Annex III route this requirement applies from 2 December 2027; for high-risk AI in regulated products (Annex I) from 2 August 2028.
Our interpretation
This is not a one-off risk analysis but a living process: most organisations have an assessment, but no cycle that reruns on every change. The cycle is what a supervisor will request.
What you can do now
Start the risk management file now for systems that will become high-risk towards 2 December 2027: today’s design and procurement choices determine tomorrow’s residual risks.
- 01
Set up an iterative risk management process
Identify and analyse known and reasonably foreseeable risks, evaluate them and take measures, repeating the cycle on every change.
What to retain
Risk management file
Versioned record of risk analyses, chosen measures, residual risks and test results per system version.
Control and reassessment
Reassessment on every material change
Reopen the risk management process on changes in purpose, data, model or use context and before every release.
Public tools
Full text of Article 9
The full legal text in the public AI Act Explorer.
Conditions and exceptions
- Risks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.
Official sources and locators
EU Artificial Intelligence Act 2024/1689
European Parliament and Council | original-oj-2024-07-12
Source locator: Article 9(1)-(10)
Digital Omnibus on AI 2026/1744
European Parliament and Council | official-journal-2026-07-24
Source locator: Amended Article 113 application dates
Version history
v1.0.0
27 July 2026
Article 9: risk management system
A continuous, documented risk management system across the entire lifecycle of a high-risk AI system.
Execution
From obligation to arranged and demonstrable
Knowing where you stand is step one. Embed AI translates this obligation into a concrete approach for your organisation: scope, ownership, register and evidence.
See the Embed AI approachFor AI agents and integrations
This page and the machine output derive from the same versioned object. Use the API for deterministic filters by role, topic and time.