Run a lifecycle risk-management system
Establish, implement, document and maintain a continuous risk-management system: identify and evaluate known and reasonably foreseeable risks, adopt targeted mitigation, and test throughout the lifecycle.
- Applies to
- Provider
- Applies from
- 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply
- Derives from
- Article 9
- Primary source
- Art. 9 AIA
Evidence an auditor expects
- Risk-management file — Living record of the Article 9 risk-management system: identified risks, evaluation, mitigation measures adopted, and test results across the lifecycle.
- Annex IV technical file — The full technical documentation package; primary evidence at conformity assessment; must be a living, versioned document.
Audit red flags
Fails an audit
- Documentation created after the fact rather than contemporaneously with the decision — national competent authorities apply the contemporaneous standard.
- No clear version control / traceability between document versions and system versions.
FAQ
What evidence do I need for Article 9?
Risk-management file, Annex IV technical file. Each should be contemporaneous, versioned, and traceable to the system version.
When does “Run a lifecycle risk-management system” apply?
From 2027-12-02 — Stand-alone high-risk (Annex III) obligations apply. It applies to: Provider.
What fails an audit here?
Documentation created after the fact rather than contemporaneously with the decision — national competent authorities apply the contemporaneous standard.; No clear version control / traceability between document versions and system versions.
Legal source
Stay audit-ready as the Act changes
EU AI Regulation Decoded tracks each obligation and the evidence auditors expect — one practitioner email a week.
Subscribe — free, weeklyNot legal advice. This is a practitioner reference generated from a cited knowledge base built on the primary legal text and official Commission guidance. Verify against the cited primary sources before relying on it for a compliance decision. See editorial standards & methodology.