EU AI Act
EU AI Act Article 9: Risk management system
UpcomingApplies from 2 Dec 2027. Applies from 2 Aug 2028 for high-risk AI systems under Article 6(1) and Annex I.
A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.
Article 9, paragraph 1. Regulation (EU) 2024/1689, consolidated text of 27 July 2026. Read the full text on EUR-Lex
EUR-Lex text is reused under Commission Decision 2011/833/EU. Guidance is stored as an interpretation, not as a statute.
What evidence usually supports this
- Risk register for the system, with owners and mitigations
- Records that the register was reviewed for this release
Maps to the RISK_MANAGEMENT control in the Assurance OS catalog.
How Assurance OS gates it
When a system is classified high-risk, the release gate requires cited evidence for this control before it returns PASS. Missing or stale evidence shows up as a named blocker in CI.
This page shows an excerpt of the law and the evidence teams commonly keep for it. It is not legal advice and does not say whether your system complies. Read the full text and take legal advice for your case.
Gate Article 9 evidence in CI.
Free plan, no card. Assurance OS checks the evidence on every release and hands buyers a signed pack.