AI risk assessment (AIRA): the Article 9 risk management system
Providers of high-risk AI systems must run a risk management system (Article 9). AIRA is Scanara’s guided assessment for it.
Providers of high-risk AI systems must run a risk management system for the whole lifecycle of the system (Article 9). AIRA is Scanara’s name for its guided assessment of that duty; the Act itself has no “AI risk assessment”.
The duty applies from 2 December 2027 to Annex III systems. Provider fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: confirm that your system is high-risk under Article 6, then start the assessment.
Article 9 describes a continuous process with four steps
The risk management system is a continuous iterative process, planned and run throughout the lifecycle, with regular systematic review and updating (Article 9(2)).
- 1
Identify and analyse risks
List the known and reasonably foreseeable risks to health, safety or fundamental rights when the system is used as intended (Article 9(2)(a)).
- 2
Estimate and evaluate risks
Include the risks that may emerge under reasonably foreseeable misuse (Article 9(2)(b)).
- 3
Evaluate risks seen after release
Add the risks that appear in the data from post-market monitoring (Article 9(2)(c), Article 72).
- 4
Adopt targeted risk measures
Adopt appropriate and targeted measures against the risks identified in step 1. The remaining risk must be judged acceptable (Article 9(2)(d) and (5)).
Measures follow a set order, and testing and vulnerable groups count
Reduce risks in a set order
First eliminate or reduce risks through design and development. Then add mitigation and control measures. Then give deployers information and, where appropriate, training. The remaining risk must be acceptable (Article 9(5)).
Test against defined metrics
Test during development and before placing the system on the market, against metrics and probabilistic thresholds defined in advance (Article 9(6) and (8)). Testing in real-world conditions is possible under Article 60 (Article 9(7)).
Consider children and vulnerable groups
Consider whether the system is likely to harm people under 18 and, where appropriate, other vulnerable groups (Article 9(9)).
What Scanara’s AIRA assessment does
AIRA is a guided assessment: you answer questions about your system and Scanara stores the answers as evidence. The judgement on risks, and on which remaining risk is acceptable, stays with you.
Guided questions
A question bank walks you through the risk management duties and cites the article behind most questions.
Answers pre-filled from scans
If you scanned a repository, Scanara pre-fills answers from the scan results. You check and correct them.
Input for Annex IV documentation
Annex IV, point 5 asks for a description of the risk management system. Scanara drafts the technical documentation from your answers; you complete and verify it.
Read the detail behind this assessment
Article 9: Risk Management System for High-Risk AI
Explains the duties, application dates and fines of Article 9 in full.
Article 11: Technical Documentation and Annex IV
Covers the documentation that must describe your risk management system (Annex IV, point 5).
Conformity assessment under Article 43: Annex VI or Annex VII
Shows how a conformity assessment checks the requirements, risk management included.
Common questions about the AIRA assessment
Is “AIRA” a term in the EU AI Act?
No. Article 9 requires a risk management system. AIRA is the name Scanara uses for its guided assessment of that system.
Who is responsible for the risk management system?
The provider. Providers must ensure their high-risk AI systems meet the requirements of Section 2, Article 9 included (Article 16(a)). Deployers do not run it, but they must monitor the operation of the system and inform providers where relevant (Article 26(5)).
Does Article 9 apply to all AI systems?
No. Article 9 applies to high-risk AI systems, which Article 6 defines through Annex III and Annex I. It applies from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems (Article 113(c)). For high-risk systems related to products under Annex I Section B laws, only Articles 6(1), 60a and 102 to 112 apply, and Articles 57 to 59 apply only in so far as the requirements for high-risk AI systems have been integrated in that legislation (Article 2(2)).
Does Article 9 apply to systems already on the market?
Only after significant design changes. A high-risk system placed on the market or put into service before the date of application of Chapter III is covered only if, from that date, it is subject to significant changes in its design (Article 111(2)). In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030.
Does the Act require a particular method or standard for risk management?
No. Article 9 sets steps, not a method. Harmonised standards published in the Official Journal give a presumption of conformity with the requirements they cover (Article 40).
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.