EveryAILaw.com

Requirements at a glance

This regulation imposes 23 specific requirements for Risk Assessment across 2 provisions:

• Risk management system — Establish, implement, document, and maintain a risk management system (Article 9(1))
• Identify and analyze — Identify known and reasonably foreseeable risks to health, safety, and fundamental rights during intended use (Article 9(2)(a))
• Estimate and evaluate — Estimate and evaluate risks that may emerge under intended use and reasonably foreseeable misuse conditions (Article 9(2)(b))
• Post-market evaluation — Evaluate risks based on data from post-market monitoring (Article 9(2)(c))
• Risk mitigation — Adopt appropriate and targeted measures addressing the risks identified under Article 9(2)(a) (Article 9(2)(d))
• Risk boundary — Article 9 concerns only risks reasonably mitigated or eliminated through system development or design, or provision of adequate technical information (Article 9(3))
• Design-based reduction — Eliminate or reduce risks through adequate design and development where technically feasible (Article 9(5)(a))
• Residual risk — Ensure residual risk associated with each hazard and overall residual risk is judged acceptable (Article 9(5))
• Testing — Test to identify appropriate risk management measures and ensure consistent performance and compliance; tested against prior defined metrics and probabilistic thresholds (Article 9(6)-(8))
• Iterative review — Plan and run the risk management system as a continuous iterative process throughout the entire lifecycle, with regular systematic review and updating (Article 9(2))
• Children and vulnerable groups — When implementing the risk management system, providers must consider whether the system is likely to adversely affect persons under 18 and, as appropriate, other vulnerable groups (Article 9(9))
• Other Union-law risk processes — Providers subject to internal risk-management requirements under other Union law may include or combine Article 9(1)-(9) aspects in those procedures (Article 9(10))
• Pre-deployment assessment — Assess the impact on fundamental rights before putting the high-risk system into use (Article 27(1))
• Process description — Describe the deployer processes in which the system will be used, in line with its intended purpose (Article 27(1)(a))
• Period and frequency — Describe the period and frequency of intended use (Article 27(1)(b))
• Affected persons — Identify the categories of natural persons and groups likely to be affected in the specific context (Article 27(1)(c))
• Specific harms — Identify specific risks of harm to those categories, using the provider information supplied under Article 13 (Article 27(1)(d))
• Human oversight — Describe implementation of human oversight measures per the instructions for use (Article 27(1)(e))
• Response measures — Set out measures if risks materialise, including internal governance arrangements and complaint mechanisms (Article 27(1)(f))
• First use and updates — Applies to first use; earlier assessments (including a provider's) may be relied on in similar cases, and the assessment must be updated when elements change (Article 27(2))
• Notify authority — Notify the market surveillance authority of the results with the filled-out template; deployers may be exempt from notification in Article 46(1) cases (Article 27(3))
• DPIA cross-reference — Where an obligation is already met by a GDPR Article 35 or LED Article 27 data protection impact assessment, the deployer may cross-reference the relevant sections or incorporate parts of it (Article 27(4), as replaced by Regulation (EU) 2026/1744)
• AI Office template — The AI Office must develop a questionnaire template, including an automated tool, allowing DPIA cross-references (Article 27(5), as replaced)