What it asks for. Article 9 requires providers of high risk AI systems to establish, document and maintain a risk management system as a continuous, iterative process across the whole life cycle of the system. It covers identifying and analysing known and foreseeable risks to health, safety and fundamental rights, evaluating risks including from reasonably foreseeable misuse, and adopting risk management measures.
In practice. The provider documents risks for each high risk system, considers misuse and the intended context of use, applies design and mitigation measures, and tests the system against defined metrics before release. Post market monitoring feeds back into the process, and impacts on vulnerable groups including minors are considered. Evidence includes the risk management file, test results and update records.
Common gaps. Risk management is often a one time pre launch exercise rather than continuous. Fundamental rights risks receive less attention than technical performance.