EU AI Act Art.9: Risk management system
EU AI Act Article 9 (Risk management system) binds the providers. This page states what the article requires, who it binds, the evidence to keep and the NIST AI RMF and ISO/IEC 42001 controls behind it, cited to the article. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.9 |
| Binds | Providers |
| Group | High-Risk Classification and Requirements |
| Evidence items | 3 |
| Linked NIST AI RMF controls | 6 |
| Linked ISO/IEC 42001 controls | 3 |
| Last updated |
Who does Art.9 bind?
The article binds the providers. The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.9 require?
Providers shall establish, implement, document and maintain a risk management system as a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system, including identification and analysis of known and reasonably foreseeable risks, estimation/evaluation of risks arising from use and from misuse, and adoption of appropriate targeted risk-management measures.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.9 (the consolidated Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.9?
| Category | Evidence to keep |
|---|---|
| Risk management | Risk management system documentation |
| Risk management | Lifecycle risk analysis records |
| Risk management | Post-deployment risk monitoring |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.9?
6 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-1.4 | The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities A documented, maintained, continuously iterative risk management system is this process and its outcomes. | high |
AIRMF-MN-1.1 | A determination is made as to whether the AI system achieves its intended purpose and stated objectives and whether its development or deployment should proceed | unstated |
AIRMF-MN-1.2 | Treatment of documented AI risks is prioritized based on impact, likelihood, or available resources or methods Risk measures are adopted per hazard but no prioritisation basis across risks is required. | medium |
AIRMF-MN-1.3 | Responses to the AI risks deemed high priority as identified by the MAP function are developed, planned, and documented, and risk response options can include mitigating, transferring, avoiding, or accepting Adopting appropriate targeted risk management measures for identified risks is the planned documented response. | high |
AIRMF-MN-2.1 | Resources required to manage AI risks are taken into account, along with viable non-AI alternative systems, approaches, or methods, to reduce the magnitude or likelihood of potential impacts | unstated |
AIRMF-MP-1.5 | Organizational risk tolerances are determined and documented Judging residual risk per hazard and overall as acceptable is a documented tolerance determination. | high |
Which ISO/IEC 42001 controls line up with Art.9?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.5.2 | AI system impact assessment process Risk management identifies foreseeable risks to health, safety and fundamental rights. | medium |
A.5.4 | Assessing AI system impact on individuals or groups of individuals Continuous iterative risk process runs across the entire lifecycle covering use and misuse. | high |
A.5.5 | Assessing societal impacts of AI systems Risk management covers fundamental rights harm without addressing wider societal effect. | medium |
What does the conformance kit add for Art.9?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.