Building an EU AI Act Risk Management System

Drew & AI Comply HQ™ Team · July 6, 2026

If you make a high-risk AI system, the EU AI Act says you need a risk management system (Article 9). It is a repeating process to find, judge, and reduce the harm your AI could cause. It runs for the system's whole life. The duty applies from December 2, 2027 for the high-risk uses the Act lists, like hiring and credit scoring (Annex III). For AI built into products like medical devices (Annex I, Section A), it applies from August 2, 2028.

Why does the Act ask for this?

High-risk AI makes or shapes decisions that matter, like who gets hired or who gets a loan. A mistake can hurt people's health, safety, or rights. Article 9 makes you look for those harms early, and keep looking once the system is in use.

Who needs a risk management system?

The company that builds a high-risk AI system and offers it under its own name. The Act calls that company the provider.

High-risk covers two groups (Article 6). The first is AI for a listed use (Annex III), like hiring, credit scoring, or pricing life and health insurance. The second is AI inside regulated products that need an outside safety check (Annex I), like medical devices. Not sure where your system sits? Our guide Is your AI system high-risk? walks through the test.

Businesses that only use a high-risk system do not need their own Article 9 process. The Act calls them deployers, and their duties sit in Article 26. Some deployers must also assess the impact on people's rights before first use (Article 27).

What are the 4 steps?

Article 9(2) sets 4 steps. You repeat them and review them on a regular schedule.

Find the risks. List the known and reasonably foreseeable risks to health, safety, and fundamental rights. Start with the system used as intended.
Judge them. Estimate and weigh each risk. Include ways people could foreseeably misuse the system.
Learn from real use. Look for new risks in the data you collect after launch (Article 72).
Act on them. Adopt targeted measures to deal with the risks you found.

The Act only counts risks you can reasonably reduce or remove. You do that through design, or by giving users the right technical information (Article 9(3)).

How should you reduce the risks?

Article 9(5) sets an order. Work down it:

Remove or reduce the risk through design and development, as far as technically possible.
Add controls for the risks you cannot remove.
Give the businesses that use your system the information they need (Article 13). Add training where it helps.

The risk left over at the end (called residual risk) must be acceptable. That goes for each hazard and for the system as a whole.

Think about who will use the system and in what setting. Pay attention to people under 18 and other vulnerable groups (Article 9(9)).

What testing does Article 9 ask for?

Testing has two jobs. It helps you pick the right measures, and it shows the system works as intended (Article 9(6)).

When: during development, and always before launch (Article 9(8))
Against what: pass marks you set in advance, with metrics and probability thresholds that fit the system's purpose (Article 9(8))
Where: in the lab, or in real-world conditions under the rules in Article 60 (Article 9(7))

What should you write down?

Your technical documentation must describe your risk management system in detail (Annex IV, point 5). Keep that documentation for 10 years after launch (Article 18).

It is also part of your written processes for building and running the AI. The Act calls those processes a quality management system (Article 17(1)(g)).

We suggest one simple record per system, called a risk register. Give each risk a row. Note the hazard, your rating, the measure you chose, the test result, and who signed off.

How does it connect to monitoring and incident reports?

After launch, you collect and study data on how the system performs (called post-market monitoring, Article 72). Your plan for this is part of the technical documentation. What you learn feeds step 3.

If the system causes a serious incident, report it to the product safety authority in the country where it happened. The Act calls it the market surveillance authority (Article 73). If the EU AI Office supervises your system, report to the AI Office instead (Article 75(1a)). The AI Office supervises two kinds of system (Article 75(1)). The first is a system built on a general-purpose AI model from the same provider or group. That excludes AI in products covered by Annex I, critical infrastructure systems (Annex III, point 2), justice systems (Annex III, point 8), and some systems of law enforcement and border authorities and financial institutions (Article 75(1)(a)(iii)). The second is AI that is, or is part of, a very large online platform or search engine. The Act counts an incident as serious when it leads to any of these (Article 3(49)):

a death, or serious harm to someone's health
a serious and irreversible disruption of critical infrastructure
a breach of EU law that protects fundamental rights
serious harm to property or the environment

Report as soon as you link the incident to your AI. The outer limit is 15 days after you learn of it. For a death, the limit is 10 days. For a widespread breach or a critical infrastructure disruption, it is 2 days. You can send an incomplete first report and complete it later (Article 73(5)).

When does Article 9 apply?

December 2, 2027 for Annex III systems
August 2, 2028 for Annex I, Section A systems. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

Both dates come from the Digital Omnibus on AI (Regulation (EU) 2026/1744). It moved them in July 2026 (Article 113).

Systems already on the market before your date follow a different rule. They only have to comply if their design changes significantly after that date. AI used by public authorities must comply by August 2, 2030 either way (Article 111(2)).

Frequently asked questions

Can one risk management system cover several AI products?

You can share one method, one set of templates, and one review process. The risk analysis itself has to fit each system. Article 9 ties it to that system's intended purpose.

Is there an exemption for small companies?

No. Small and medium-sized companies (SMEs) still need the full Article 9 process (Article 63(2)). What gets lighter is the paperwork around it. SMEs can use a simplified technical documentation form (Article 11(1)). The Digital Omnibus opened that form to small mid-caps (SMCs) too.

Can we reuse a risk process we already run?

Yes, if another EU law already makes you run one, as in banking or medical devices. You can fold the Article 9 steps into that process (Article 9(10)).

Does this apply to AI built outside the EU?

Yes, if the system is offered in the EU, or its output is used in the EU (Article 2(1)). Providers based outside the EU also need someone in the EU who acts for them (called an authorised representative, Article 22).

What happens if we get it wrong?

Breaking the high-risk rules can cost up to 15 million EUR or 3% of worldwide annual turnover (Article 99(4)). The higher of the two is the cap. For SMEs, and since July 2026 for SMCs, the cap is whichever is lower (Article 99(6) and (6a)). Authorities can also require fixes, or take the system off the market (Article 79). Our guide to EU AI Act fines and penalties has the full picture.

Update: the Digital Omnibus is now law (October 7, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed for risk management:

High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
Small mid-caps get SME help (Articles 11 and 99). They can use the simplified technical documentation form. They also get the lower fine cap, except for the banned practices.
Some incident reports go to the EU AI Office (Article 75(1a)). If the AI Office supervises your system, report serious incidents to it. The deadlines stay the same.

What did not change: the 4 steps in Article 9 are the same as before.

To see which dates apply to you, run the free risk check.

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.