High-Risk AI Risk Management Process

Operate a documented lifecycle risk-management process for high-risk AI systems.

For a provider's high-risk AI system, establish a risk process that stays connected to development and actual use.

1. Identify foreseeable risks to health, safety and fundamental rights from intended use and reasonably foreseeable misuse, including impacts on children or other vulnerable groups where relevant.
2. Evaluate the risks and choose treatments. Prioritize feasible design changes, then other safeguards and information for deployers.
3. Assign treatment owners, link each action to supporting tests and record the assessment of individual and overall remaining risk.
4. Review the assessment at relevant lifecycle decisions and when testing, incidents or post-market information reveal new issues. Article 9 focuses on risks that can reasonably be reduced through system development, design or adequate technical information. This control supports that process; it is not a guarantee that every risk has been removed.

Continuously through the system lifecycle; regular systematic review; at relevant design, release and change decisions.

System-linked risk assessment with intended use and affected groups Risk register showing treatments, owners and remaining risk Testing or validation evidence linked to significant treatments Review decisions, approvals and unresolved actions Records showing how monitoring or changes updated the assessment

Select one system and trace a significant risk to its treatment, supporting test and review decision. Check that the assessment reflects current use and that a recent change or monitoring finding was considered. Investigate actions marked complete without supporting evidence.