What the Article requires
Article 9 requires providers of high-risk AI systems to establish, implement, document and maintain a risk-management system that runs throughout the AI lifecycle. The system identifies foreseeable risks to health, safety and fundamental rights, evaluates risks under intended use and reasonably-foreseeable misuse, and adopts targeted risk-management measures. Critically, it is not a one-time exercise — the system is updated continuously as the AI evolves.
In engineering terms
Maps to existing enterprise risk-management frameworks but specifically extends to AI lifecycle artefacts: training-data risks, model behaviour risks, deployment-context risks, and misuse risks. Engineering teams typically bolt this onto SR 11-7 (US BFSI), the FCA SYSC framework, or analogous existing-risk taxonomies.
Compliance checklist
- ✓Documented risk-management process specifically applied to AI systems
- ✓Identified, evaluated and treated risks to health, safety and fundamental rights
- ✓Risk-management decisions documented with rationale
- ✓Continuous-update cycle, not a one-time assessment
- ✓Integration with the existing enterprise risk function
Terms used here
All Articles in the reference · The EU AI Act compliance architecture
Get the Article 9 checklist as a fill-in template
The EU AI Act Readiness Kit puts this checklist, and the other 13 Articles', into one fill-in PDF with room for an owner, evidence location and target date on every item. Plus an AI system inventory, a classification record, an Annex IV outline and a FRIA template.
- 01How to use this kit. Four steps, and which checklists apply to each classification result.
- 02AI system inventory. One row per AI system: owner, what it does, built or bought, your role and its classification.
- 03Classification record. The five questions from our applicability checker, with space for answers, notes and the result.
- 04Evidence checklists. 72 evidence items across Articles 9 to 15, 25, 26, 27, 50, 53, 55 and 72, each with an owner, evidence location and target date.
Need audit-survivable evidence for Article 9?
MindMap runs a 90-day path from standing start to audit-survivable evidence. Talk to the engineering team.