EU AI Act Conformity Assessment & Article 9 Risk Management

Article 9: Risk Management System

Risk management under Article 9 is a continuous process across the AI system's full lifecycle. Required elements:

• Identification and analysis of known and reasonably foreseeable risks
• Estimation and evaluation of risks under intended-use and reasonably-foreseeable-misuse scenarios
• Evaluation of risks emerging from post-market monitoring
• Adoption of appropriate and targeted risk-management measures
• Testing for residual risks against acceptance criteria

Article 9 explicitly requires that risk-management measures be balanced against the state of the art — what's reasonably achievable today, not theoretical perfection.

Conformity Assessment Routes

Two main routes depending on the AI system type:

• Internal control (Annex VI) — provider self-assessment using harmonized standards. Available for most stand-alone Annex III high-risk systems.
• Notified body (Annex VII) — third-party assessment by an EU-designated notified body. Required for biometric identification systems and AI used as safety components of regulated products.

CE Marking & EU Database Registration

Once conformity is established, complete these final steps before market placement:

• Once conformity is assessed, draw up an EU declaration of conformity
• Affix the CE marking to the AI system (or its packaging/documentation if not physical)
• Register the AI system in the EU AI database before placing on the market
• Maintain technical documentation for at least 10 years after market placement

Ongoing Obligations

Conformity is not a one-off event:

Substantial modifications trigger re-assessment. Post-market monitoring under Article 72 feeds back into Article 9 risk management. Serious incidents must be reported to authorities under Article 73.