Skip to main content
Praxikon
Back to the explorer
ObligationUpcomingv1.0.0

Article 9: risk management system

A continuous, documented risk management system across the entire lifecycle of a high-risk AI system.

The official source remains authoritative. This is general information about obligations and not legal advice. See this object on the map

Address and citation

This object has an address of its own that is never renamed or reused. Store the identifier in your own file, not the title or the link.

Identifier
praxikon:eu:ai-act:obligation:article-9-risk-management
Payload hash (sha256)
dba4fb36d8780aa218d15aae4742d2183cfcf1fd6f85a6d4db5901b93c9e6c53

Citation line

Praxikon, "Article 9: risk management system", praxikon:eu:ai-act:obligation:article-9-risk-management@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0), effective_at 2026-08-08T00:00:00.000Z, known_at 2026-08-14T00:00:00.000Z, sha256 dba4fb36d8780aa218d15aae4742d2183cfcf1fd6f85a6d4db5901b93c9e6c53
Version
1.0.0
Legal time (effective_at)
27 July 2026
Knowledge time (known_at)
8 August 2026
Closed on
Not closed
Application date
2 December 2027
Topics
high-risk-requirements

Review status: Placed against the official source (8 August 2026). Next check due by 4 February 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

Who must act and who is affected

On an obligation the addressee is recorded separately from the party that is merely affected. That difference decides who a supervisory authority addresses and who has work to do without the duty resting on them.

Duty holder

Affected actor

Not recorded on this object.

Oversight

Not recorded on this object.

Evidence owner

What this object links to

Every relation appears below as a path: from the source with its locator, through the conditions and exceptions of the object carrying the relation, to the consequence. A locator belongs to a statement in the data and not to a relation, so the source is the source anchor of the carrying object.

Who carries the duty

1 of 1 shown

The duty rests on this role. A supervisory authority addresses this role when it is not met.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Who owns the evidence

1 of 1 shown

This duty holder creates, maintains and can produce the evidence.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be done

1 of 1 shown

This is what concretely has to be done under the obligation.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be recorded

1 of 1 shown

This is what has to be in the file to show that the action was carried out.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What keeps it in place

1 of 1 shown

This is what keeps compliance in place over time, periodic or event-driven.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Public tools

1 of 1 shown

This is the public route a reader can actually use.

  1. Source

    Official fact on this object, with its locator.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allThe system is high-risk under Article 6 and the provider places it on the market or puts it into service.
    • ExceptionRisks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What points at this object

Objects hanging off this obligation

7 of 7 shown

The object belongs to this obligation. The source line it hangs off sits there.

  1. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Set up an iterative risk management process

    Consequence

  2. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Reassessment on every material change

    Consequence

  3. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Risk management file

    Consequence

  4. Source

    Official fact on this object, with its locator.

    • Draft guidelines on the classification of high-risk AI systems

      Locator: Draft guidelines Annex I, points (61) and (62)

      praxikon:eu:ai-act:source:commission-draft-high-risk-classification-guidelines

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Integrating AI Act requirements into existing risk and quality systems

    Consequence

  5. Source

    Official fact on this object, with its locator.

    • CEN-CENELEC JTC 21: European standards under standardisation request M/613

      Locator: EN ISO/IEC 23894:2024, European adoption via CEN-CENELEC

      praxikon:eu:ai-act:source:cen-cenelec-jtc21

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: ISO/IEC 23894: guidance on risk management for AI

    Consequence

  6. Source

    Official fact on this object, with its locator.

    • CEN-CENELEC JTC 21: European standards under standardisation request M/613

      Locator: prEN 18228 (draft standard), CEN/CLC/JTC 21 under M/613

      praxikon:eu:ai-act:source:cen-cenelec-jtc21

      Open official source

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9; Article 40

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    Via

    • Condition | allRelevant to providers preparing for the high-risk obligations applying from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).

    Relation recorded on: prEN 18228: AI risk management for high-risk systems

    Consequence

  7. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • EU Artificial Intelligence Act 2024/1689

      Locator: Article 9(1)-(10)

      praxikon:eu:ai-act:source:reg-eu-2024-1689

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Amended Article 113 application dates

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Full text of Article 9

    Consequence

What this object states

Official fact

Attributable to a named primary source, with a locator. Where they differ, the official source prevails.

  • Article 9 requires a risk management system as a continuous, iterative process across the entire lifecycle, with identification, analysis, evaluation and mitigation of risks to health, safety and fundamental rights, and testing to determine the most appropriate measures.

  • For the Annex III route this requirement applies from 2 December 2027; for high-risk AI in regulated products (Annex I) from 2 August 2028.

    • Locator: Amended Article 113 application datespraxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

Our interpretation

Our own reading. It can change without the law changing, and it is not the position of a supervisory authority.

  • This is not a one-off risk analysis but a living process: most organisations have an assessment, but no cycle that reruns on every change. The cycle is what a supervisor will request.

Recommended step

A practical step we consider appropriate. Not an obligation following from the Regulation.

  • Start the risk management file now for systems that will become high-risk towards 2 December 2027: today’s design and procurement choices determine tomorrow’s residual risks.

When this applies

  1. 1The system is high-risk under Article 6 and the provider places it on the market or puts it into service.

When this does not apply

  • Risks arising only from misuse beyond any reasonably foreseeable use fall outside the mandatory scope.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 9: risk management system",
praxikon:eu:ai-act:obligation:article-9-risk-management@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0 (schema 1.4.0),
effective_at 2026-07-27T00:00:00.000Z, known_at 2026-08-08T00:00:00.000Z,
sha256 dba4fb36d8780aa218d15aae4742d2183cfcf1fd6f85a6d4db5901b93c9e6c53,
https://www.praxikon.com/en/verkenner/obligation/article-9-risk-management
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-9-risk-management&effective_at=2026-07-27&known_at=2026-08-08&lang=en, accessed 2026-08-25)

Short form

praxikon:eu:ai-act:obligation:article-9-risk-management@1.0.0 (sha256 dba4fb36)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-9-risk-management-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 9: risk management system},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-9-risk-management},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.1.0, schema 1.4.0},
  note         = {effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 dba4fb36d8780aa218d15aae4742d2183cfcf1fd6f85a6d4db5901b93c9e6c53},
  url          = {https://www.praxikon.com/en/verkenner/obligation/article-9-risk-management},
  urldate      = {2026-08-25},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-9-risk-management@1.0.0",
    "type": "dataset",
    "title": "Article 9: risk management system",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-9-risk-management",
    "URL": "https://www.praxikon.com/en/verkenner/obligation/article-9-risk-management",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          8
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          8,
          25
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.1.0; schema 1.4.0; effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-08T00:00:00.000Z; sha256 dba4fb36d8780aa218d15aae4742d2183cfcf1fd6f85a6d4db5901b93c9e6c53; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-9-risk-management&effective_at=2026-07-27&known_at=2026-08-08&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

For agents and integrations

This page and the machine output come from the same object and the same two time axes.

Open as JSONOpen as JSON-LDHuman explanationRead the methodology