EU AI Act — Risk Assessment

Yes. EU AI Act addresses Risk Assessment through 1 provision.

Does EU AI Act require Risk Assessment?

European Union • phased enforcement

Yes — 1 provision

This regulation imposes 9 specific requirements for Risk Assessment across 1 provision:

Risk management system — Establish and maintain throughout AI lifecycle (Article 9(1))
Identify and analyze — Identify known and reasonably foreseeable risks to health, safety, and fundamental rights during intended use (Article 9(2)(a))
Estimate and evaluate — Estimate and evaluate risks that may emerge under intended use and reasonably foreseeable misuse conditions (Article 9(2)(b))
Post-market evaluation — Evaluate risks based on data from post-market monitoring (Article 9(2)(c))
Risk mitigation — Take appropriate and targeted mitigation measures addressing identified risks (Article 9(2)(d))
Design-based reduction — Eliminate or reduce risks through adequate design and development where technically feasible (Article 9(5)(a))
Residual risk — Ensure residual risk associated with each hazard and overall residual risk is judged acceptable (Article 9(5))
Testing — Test to identify appropriate risk management measures and ensure consistent performance and compliance; tested against prior defined metrics and probabilistic thresholds (Article 9(6)-(8))
Continuous monitoring — Ongoing performance monitoring throughout the system lifecycle

Obligation:

enacted

Effective:

Dec 2, 2027

Risk tier:

high-risk

Scope:

providers

Requirement	Details
Risk management system	Establish and maintain throughout AI lifecycle (Article 9(1))
Identify and analyze	Identify known and reasonably foreseeable risks to health, safety, and fundamental rights during intended use (Article 9(2)(a))
Estimate and evaluate	Estimate and evaluate risks that may emerge under intended use and reasonably foreseeable misuse conditions (Article 9(2)(b))
Post-market evaluation	Evaluate risks based on data from post-market monitoring (Article 9(2)(c))
Risk mitigation	Take appropriate and targeted mitigation measures addressing identified risks (Article 9(2)(d))
Design-based reduction	Eliminate or reduce risks through adequate design and development where technically feasible (Article 9(5)(a))
Residual risk	Ensure residual risk associated with each hazard and overall residual risk is judged acceptable (Article 9(5))
Testing	Test to identify appropriate risk management measures and ensure consistent performance and compliance; tested against prior defined metrics and probabilistic thresholds (Article 9(6)-(8))
Continuous monitoring	Ongoing performance monitoring throughout the system lifecycle

Violation	Fine
High-risk non-compliance	Up to EUR 15M or 3% global turnover