Article 9: Risk Management System

Official Statutory Text

Article 9 Risk management system 1. Arisk management system shall be established, imp lemented, documentedand maintained in relation to high-risk AI systems. 2. The risk management system shall be understood as a continuous iterative process plannedand run throughout the entire lif ecy cle of a high-risk AI system, requiring regular systematic review and updating. It shall comprise the following st eps: (a) the identification and analysis of the known and the reasonably foreseeable risks that the high-risk AI system can pose to health, safety or fundamental rights when the high-risk AI system is used in accordance with its intended purpose; (b) the estimation and evaluation of the risks that may emerge when the high-risk AI system is used in accordance with its intended purpose, and under conditions of reasonably foreseeable misuse; (c) the evaluation of other risks possibly ar ising, based on theanalysis of data gathered from the post-mark et monitoring system referred to in Article 72; (d) the adoption of appropriateand targeted risk management measures designed to address the risks identified pursuant to point (a). 3. The risks referred to in this Article shall concernonly those which maybe reasonably mitigatedor eliminated through the developmentor design of the high-risk AI system, or the provision of adequate technical information. 4. The risk management measures referred to in paragraph 2, point (d), shall give due consideration to the effects and possible interaction resulting from the combined application of the requirements setout in this Section, with a view to minimising risks more effectively while achieving an appropriate balance in implementing the measures tofulfil those requirements. 5. The risk management measures refer red to in paragraph 2, point (d), shall be such that the relevant residual risk associated with each hazard, as well as the overall residual risk of the high-risk AI systems is judged to be accep table. In identifying the most appropriate risk management measures, the following shall be ensured: (a) elimination or reduction of risks identifiedand evaluated pursuant to paragraph 2 in as far as technically feasible through adequatedesign and developmentof the high-risk AI system; (b) where appropriate, implementation of adequate mitigation and control measures addressing risks that cannot be eliminated ; (c) provision of information required pursuant to Article 13 and, where appropriate, training to deployers. With a view to eliminating or reducing risks related to the use of the high-risk AI system, due consideration shall be given to the technical knowledge, experience, education, the training to be expected by the deployer , and the presumable context in which the system is intended to be used. 6. High-risk AI systems shall betested for the purpose of identifying the most appropriateand targeted risk management measures. Testing shall ensure that high-risk AI systems perform consistently for their intended purposeand that they are incompliance with the requirements setout in this Section. 7. Testing procedures may include testing in real-world conditions in accordance with Article 60. 8. The testing of high-risk AI systems shall be perfo r med, as appropriate, at anytime throughout the development process, and, in any event, prior to their being placed on the marketor put into service. Testing shall be carried out against prior defined metrics and probabilistic thresholds that are appropriate to the intended purpose of the high-risk AI system. 9. When implementing the risk management system as provided for in paragraphs 1 to 7, providers shall give consideration to whether in view of its intended purpose the high-risk AI system is likely to havean adverse im pacton persons under the age of 18 and, as appropriate, other vulnerable groups. 10. For providers of high-risk AI systems that are subject to requirements regard ing internal risk management processes under other relevant provisions of Union law , the aspects provided in paragraphs 1 to 9 maybe par tof, or combined with, the risk management procedures established pursuant to that law .