EveryAILaw.com

Requirements at a glance

This regulation imposes 20 specific requirements for Risk Assessment across 2 provisions:

• Risk management system — Establish and maintain throughout AI lifecycle (Article 9(1))
• Identify and analyze — Identify known and reasonably foreseeable risks to health, safety, and fundamental rights during intended use (Article 9(2)(a))
• Estimate and evaluate — Estimate and evaluate risks that may emerge under intended use and reasonably foreseeable misuse conditions (Article 9(2)(b))
• Post-market evaluation — Evaluate risks based on data from post-market monitoring (Article 9(2)(c))
• Risk mitigation — Take appropriate and targeted mitigation measures addressing identified risks (Article 9(2)(d))
• Design-based reduction — Eliminate or reduce risks through adequate design and development where technically feasible (Article 9(5)(a))
• Residual risk — Ensure residual risk associated with each hazard and overall residual risk is judged acceptable (Article 9(5))
• Testing — Test to identify appropriate risk management measures and ensure consistent performance and compliance; tested against prior defined metrics and probabilistic thresholds (Article 9(6)-(8))
• Continuous monitoring — Ongoing performance monitoring throughout the system lifecycle
• Pre-deployment assessment — Assess the impact on fundamental rights before putting the high-risk system into use (Article 27(1))
• Process description — Describe the deployer processes in which the system will be used, in line with its intended purpose (Article 27(1)(a))
• Period and frequency — Describe the period and frequency of intended use (Article 27(1)(b))
• Affected persons — Identify the categories of natural persons and groups likely to be affected in the specific context (Article 27(1)(c))
• Specific harms — Identify specific risks of harm to those categories, using the provider information supplied under Article 13 (Article 27(1)(d))
• Human oversight — Describe implementation of human oversight measures per the instructions for use (Article 27(1)(e))
• Response measures — Set out measures if risks materialise, including internal governance arrangements and complaint mechanisms (Article 27(1)(f))
• First use and updates — Applies to first use; earlier assessments (including a provider's) may be relied on in similar cases, and the assessment must be updated when elements change (Article 27(2))
• Notify authority — Notify the market surveillance authority of the results, submitting the filled-out template (Article 27(3))
• DPIA cross-reference — Where an obligation is already met by a GDPR Article 35 or LED Article 27 data protection impact assessment, the deployer may cross-reference the relevant sections or incorporate parts of it (Article 27(4), as replaced by Regulation (EU) 2026/1744)
• AI Office template — The AI Office must develop a questionnaire template, including an automated tool, allowing DPIA cross-references (Article 27(5), as replaced)