YTYK You think you know

Card 7 of 15 What high risk actually obliges ●●○ Working knowledge

A risk management system that runs for the lifetime

High-risk providers must establish a continuous, iterative risk management system across the whole lifecycle — identify foreseeable risks, evaluate risks from reasonably foreseeable misuse, adopt mitigations, and test against pre-defined metrics.

Why it is like this

Risk in these systems appears in use, not in development. A one-off pre-launch assessment would be obsolete the first time the data distribution shifted.

Not to be confused with

A document. It is a running process with post-market monitoring attached: the provider must collect field experience and feed it back, and report serious incidents to the market surveillance authority.

In practice

"Reasonably foreseeable misuse" is the clause with teeth — a system only assessed for its intended use has not met Article 9.

Source: Regulation (EU) 2024/1689 (AI Act) — Article 9 and Article 72. Read on .

Predict Check yourself

A provider assesses risks thoroughly before launch and files the report. Two years later the model has not been reassessed. Compliant?

  1. No — Article 9 requires a continuous, iterative process across the lifecycle, with post-market monitoring feeding it.
  2. Yes — the assessment was complete at the time of placing on the market.
  3. Yes, provided no serious incident has occurred.
  4. Only if the system is in an Annex I rather than Annex III category.
Show the answer

No — Article 9 requires a continuous, iterative process across the lifecycle, with post-market monitoring feeding it.

"Continuous iterative process, planned and run throughout the entire lifecycle" is the wording. A filed report is evidence of a step, not of the system.