EU regulatory register · AI Act
Article 9Risk management system
CELEX 32024R1689 · Read on 2026-08-18 · Chapter III
Short answer
1. A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/ai-act-2024-1689/artikel-9 · Short answer as data · Official text
AI Act in short
Some AI uses are banned, high-risk AI requires risk management and human oversight, and deployers must ensure AI literacy.
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
1. A risk management system shall be established, implemented, documented and maintained in relation to high-risk AI systems.
2. The risk management system shall be understood as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, requiring regular systematic review and updating. It shall comprise the following steps:
(a)
the identification and analysis of the known and the reasonably foreseeable risks that the high-risk AI system can pose to health, safety or fundamental rights when the high-risk AI system is used in accordance with its intended purpose;
(b)
the estimation and evaluation of the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of reasonably foreseeable misuse;
(c)
the evaluation of other risks possibly arising, based on the analysis of data gathered from the post-market monitoring system referred to in Article 72;
(d)
the adoption of appropriate and targeted risk management measures designed to address the risks identified pursuant to point (a).
3. The risks referred to in this Article shall concern only those which may be reasonably mitigated or eliminated through the development or design of the high-risk AI system, or the provision of adequate technical information.
4. The risk management measures referred to in paragraph 2, point (d), shall give due consideration to the effects and possible interaction resulting from the combined application of the requirements set out in this Section, with a view to minimising risks more effectively while achieving an appropriate balance in implementing the measures to fulfil those requirements.
5. The risk management measures referred to in paragraph 2, point (d), shall be such that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems is judged to be acceptable.
In identifying the most appropriate risk management measures, the following shall be ensured:
The article continues in the official text.
Follow-up questions
Other articles in this chapter
Knowledge card
- Applies
- provider: Establish and maintain a risk management system.
- Risk if ignored
- high
- What to do
- Establish and maintain a risk management system.
- Deadline
- Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).
card:eu:article:ai-act--art-9 · sha256 13a9d4ec6474 · Source: NovaCopilot
Obligations, actions and sanctions
Article 9 · Role: provider
Establish and maintain a risk management system.
Deadline: Applies from 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 under Article 6(1) and Annex I (Article 113 as amended by Regulation (EU) 2026/1744).
Decision chain (JSON)
Sanction: Administrative fine: prohibited practices up to EUR 35 million or 7 % of worldwide annual turnover; other obligations up to EUR 15 million or 3 %; incorrect information up to EUR 7.5 million or 1 %. For general-purpose AI models the Commission (AI Office) decides, up to EUR 15 million or 3 %.
Summary of the obligation in the register; the official language versions on EUR-Lex are authoritative. Source: NovaCopilot
Risk, sanction and outcome
Art. 9 · provider
Risk: high · Sanction: administrative_fine, högst EUR 15 000 000 · Authority: Market surveillance authority
Decisions applying the provision: none in the register
Full chain (JSON)
Outcomes are counted from stored judgments that cite the provision verbatim. Source: NovaCopilot
Recitals that carry the interpretation
The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.
Skäl 89 · Article 9
The risk-management system as a continuous process over the system's whole lifecycle.
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit