! High compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
A continuous, lifecycle-long obligation
Article 9 mandates a formal risk management system for all high-risk AI systems. It defines what that system must include, how risks must be identified and mitigated, and crucially — that this process must be continuous, not a single compliance exercise carried out at launch.
WHAT IT SAYS
Identify, evaluate, mitigate, test — then repeat
- Providers must establish a risk management system that is a continuous iterative process running throughout the entire lifecycle of the high-risk AI system
- The system must identify and analyse known and reasonably foreseeable risks associated with the AI system
- It must estimate and evaluate risks that may emerge during intended use and reasonably foreseeable misuse
- Providers must adopt suitable risk management measures — with priority given to eliminating or reducing risks by design, then applying mitigation and control measures, and finally providing information to deployers
- Testing must be carried out to ensure risk management measures are effective — testing must be done prior to market placement and must reflect the intended purpose and reasonably foreseeable misuse
- Particular attention must be paid to risks to vulnerable groups, including children
WHO IS AFFECTED
All high-risk AI providers and their technical teams
- All providers of high-risk AI systems — this is one of the core obligations triggered by high-risk classification
- Technical teams responsible for AI system design and testing
- Quality assurance and compliance functions within organisations developing AI
- Third-party conformity assessment bodies reviewing high-risk systems
WHAT IT MEANS FOR SMES
Start documenting from day one — retrofitting is painful
- This is one of the most resource-intensive requirements in the Act for smaller providers — it requires ongoing documentation and testing, not a one-time exercise
- The key word is continuous — you cannot complete a risk assessment at launch and consider it done; the system must be updated as the AI evolves and new risks emerge
- For SMEs building high-risk AI, start your risk management documentation from day one of development — retrofitting it later is significantly harder
- Focus particularly on reasonably foreseeable misuse — regulators will look at whether you considered how your system could be used in ways you did not intend
- If you are a deployer rather than a provider, Article 9 is primarily the provider’s responsibility — but you must cooperate with the provider and report issues
Related Articles
- Article 8 — Compliance framework (Article 9 is the first specific requirement)
- Article 10 — Data governance (closely linked to risk identification)
- Article 26 — Deployer obligations (how deployers interact with the risk management process)
