Article 9 for Autonomous Systems: Risk Management System

Article 9 sets duties for the provider. It sets no risk list, metric value or threshold for vehicles, unmanned aircraft, machines or any other product.

• Art. 9(1)
  Establish, implement, document and maintain

  A risk management system must be established, implemented, documented and maintained for high-risk AI systems.

• Art. 9(2)
  A continuous process over the whole lifecycle

  The system is a continuous iterative process planned and run throughout the lifecycle, with regular systematic review and updating. It has four steps. First, identify and analyse the known and reasonably foreseeable risks to health, safety or fundamental rights when the system is used as intended. Second, estimate and evaluate the risks under intended use and under reasonably foreseeable misuse. Third, evaluate other risks from post-market monitoring data (Article 72). Fourth, adopt appropriate and targeted risk management measures.

• Art. 9(3)
  Only risks that design or information can address

  The risks covered are those that can be reasonably mitigated or eliminated through the development or design of the system, or through adequate technical information.

• Art. 9(5)
  Residual risk must be judged acceptable

  The relevant residual risk of each hazard, and the overall residual risk, must be judged acceptable. Risks are eliminated or reduced through design and development as far as technically feasible. Where appropriate, adequate mitigation and control measures address risks that cannot be eliminated. Deployers receive the information required by Article 13 and, where appropriate, training.

• Art. 9(6)–(8)
  Testing against metrics defined in advance

  High-risk systems must be tested to identify the most appropriate risk management measures. Testing must ensure that they perform consistently for their intended purpose and comply with the requirements of Section 2. It is performed as appropriate throughout development, and in any event before the system is placed on the market or put into service. Testing is carried out against prior defined metrics and probabilistic thresholds appropriate to the intended purpose. Testing procedures may include testing in real-world conditions (Article 60).

• Art. 9(9)
  Persons under 18 and other vulnerable groups

  Providers must give consideration to whether, in view of the intended purpose, the system is likely to have an adverse impact on persons under the age of 18 and, as appropriate, other vulnerable groups.

Article 9 applies to high-risk AI systems only. The rows below show which AI in vehicles, unmanned aircraft, robots and machines is reached, and where Article 9 does not apply.

• Autonomous systems are not a category in the Act

  The Act has no category for autonomous systems. Its definition of an AI system speaks of “varying levels of autonomy” (Article 3(1)), and Article 14(3) of a “level of autonomy”. The Act names no self-driving vehicle, drone or robot. This site uses “autonomous systems” for AI in vehicles, unmanned aircraft, robots and machines. Which rules apply depends on the Union product law that covers the product. The next rows give three ways an AI system can be high-risk: through Annex I Section B, through Annex I Section A and through Annex III point 2. Other provisions can apply as well, for example Article 4 (AI literacy), Article 5 (prohibited practices), Article 50 (transparency), Article 53 (general-purpose AI models) and the other points of Annex III.

• Section B products: vehicles, unmanned aircraft, rail, marine equipment, machinery

  Annex I Section B lists, for example, motor vehicles (Regulations (EU) 2018/858 and (EU) 2019/2144, items 18 and 19), two- and three-wheel vehicles and quadricycles (item 14), agricultural and forestry vehicles (item 15), the rail system (item 17), marine equipment (item 16), unmanned aircraft and their engines, propellers, parts and equipment to control them remotely under Regulation (EU) 2018/1139 (item 20) and machinery (Regulation (EU) 2023/1230, item 21). Regulation (EU) 2026/1744 moved machinery from Section A to Section B. For AI systems classified as high-risk under Article 6(1) and related to such products, only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems have been integrated in that Union harmonisation legislation (Article 2(2)). Articles 9 to 15, 17, 26 and 99 are not among the provisions that apply. Article 2(2) is limited to AI systems classified as high-risk under Article 6(1); it does not restrict, for example, Article 4 or Article 5. The overview page for autonomous systems lists what reaches these products instead.

• Section A products: Chapter III applies to high-risk systems

  Annex I Section A (items 2 to 12) covers toys, recreational craft, lifts, equipment for potentially explosive atmospheres, radio equipment, pressure equipment, cableway installations, personal protective equipment, appliances burning gaseous fuels, medical devices and in vitro diagnostic medical devices. An AI system is high-risk under Article 6(1) where it is intended to be used as a safety component of such a product, or is itself such a product, and the product must undergo a third-party conformity assessment under that legislation. A third-party conformity assessment required solely due to risks other than risks to health and safety, such as the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, does not meet that condition (Article 6(1c)). The requirements for these systems apply from 2 August 2028 (Article 113, point (c)(ii)). Article 2(13) allows the application of specific requirements in Articles 9 to 15 and 17 to 25 to be limited, where and to the extent that Section A legislation lays down requirements providing an equivalent or higher level of protection and the limitation does not reduce the overall level of protection. The Commission is to adopt delegated acts on this by 2 August 2027.

• Annex III point 2: road traffic, utility supply and digital infrastructure

  Annex III point 2 covers AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or in the supply of water, gas, heating or electricity. The text of Annex III names no vehicle, aircraft, drone or robot. Whether a given system is a safety component in one of these areas is a question for counsel. The requirements for these Annex III uses apply from 2 December 2027 (Article 113, point (c)(i)).

• Article 6(3) can take a system out of Annex III

  A system under point 2 is high-risk under Article 6(2). Under Article 6(3) it is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights. That includes not materially influencing the outcome of decision making. The Act applies this exception where any of the following conditions is fulfilled (Article 6(3), points (a) to (d)). The system is intended to perform a narrow procedural task. Or it is intended to improve the result of a previously completed human activity. Or it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review. Or it is intended to perform a preparatory task to an assessment relevant for the use cases listed in Annex III. How these conditions combine with the significant-risk test is a question for counsel. The system is always high-risk where it performs profiling of natural persons. Profiling is defined by Article 4(4) GDPR (Article 3(52)). A provider that relies on the exception documents its assessment before the system is placed on the market or put into service. It must also register the system (Article 6(4), Article 49(2)).

• Only safety components are covered

  A safety component is a component of a product or of an AI system which fulfils a safety function for that product or AI system, or the failure or malfunctioning of which endangers the health and safety of persons or property. A component fulfils a safety function where its intended purpose is to prevent or mitigate risks to health and safety of persons or property (Article 3(14)). AI systems that are solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control do not qualify as safety components (Article 6(1a)). AI systems the failure or malfunctioning of which would endanger health and safety do qualify (Article 6(1b)). Whether a given control, navigation or convenience function is a safety component is a question for counsel.

• Provider and deployer

  The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). Putting into service includes supply for the provider’s own use (Article 3(11)). For a safety component of a Section A product, the product manufacturer is the provider where the system is placed on the market together with the product under the manufacturer’s name or trademark, or is put into service under that name or trademark after the product has been placed on the market (Article 25(3)). A fleet operator, plant operator or road authority that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes the provider in three cases. It puts its name or trademark on a high-risk system already on the market, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. It makes a substantial modification to such a system that leaves it high-risk. Or it changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). The provider that initially placed the system on the market or put it into service is then no longer considered the provider of that specific system, and must closely cooperate with the new provider (Article 25(2)). This does not apply where the initial provider clearly specified that its system is not to be changed into a high-risk AI system.

• Reuse of risk processes required by product law

  Where a product contains an AI system to which the Act and Section A legislation apply, providers may integrate the necessary testing and reporting processes, information and documentation into the documentation and procedures that already exist under that legislation (Article 8(2)). Providers subject to requirements regarding internal risk management processes under other relevant provisions of Union law may make the aspects in Article 9(1) to (9) part of, or combine them with, the procedures under that law (Article 9(10)). The Act names no such law. Whether a given law qualifies is a question for counsel. The Commission is to publish guidelines on Article 8(2), Article 9(10) and Article 17(3) by 1 August 2027 (Article 96(1), point (g)).

• Dates

  Section A: the requirements of Chapter III, Sections 1 to 3, apply to AI systems classified as high-risk under Article 6(1) from 2 August 2028 (Article 113, point (c)(ii)). Annex III point 2: from 2 December 2027 (point (c)(i)). Section B: Articles 9 to 15 have no date because they do not apply (Article 2(2)); Articles 102 to 110 apply from 27 July 2026 (point (d)). A system placed on the market or put into service before the date of application is covered only if its design changes significantly afterwards. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

• Fines

  Providers must ensure that their high-risk systems meet the requirements of Section 2 of Chapter III, which includes Articles 9 to 15 (Article 16, point (a)). A breach of the provider obligations in Article 16 or of the deployer obligations in Article 26 can be fined. The fine is up to EUR 15 million or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4), points (a) and (e)). For SMEs, including start-ups, each fine is up to whichever of the two is lower (Article 99(6)). The same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)). For Section B products, Article 99 is not among the provisions that Article 2(2) lists as applying.

• Reach and limits of the Act

  The Act applies to providers and deployers established or located in a third country where the output produced by the AI system is used in the Union (Article 2(1), point (c)). It does not apply to areas outside the scope of Union law, and it does not affect the competences of the Member States concerning national security (Article 2(3)). It does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development activity before a system is placed on the market or put into service. Testing in real-world conditions is not covered by that exclusion (Article 2(8)). AI systems released under free and open-source licences are outside the Act. That exclusion does not apply if they are placed on the market or put into service as high-risk AI systems, or if they fall under Article 5 or 50 (Article 2(12)). The Act does not apply to the obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Article 2(10)).

• No risk list, operating-domain rule or test values

  Article 9 names no risks, metrics or threshold values for vehicles, unmanned aircraft, robots or machines, and the Act uses no term such as operational design domain. The provider identifies the risks of its own system, including under conditions of reasonably foreseeable misuse, and sets the metrics and thresholds that fit its intended purpose (Article 9(2) and (8)). The Act itself names no harmonised standard. High-risk systems that conform to harmonised standards published in the Official Journal are presumed to conform to the requirements of Section 2, to the extent those standards cover them (Article 40(1)). The Commission is to develop guidelines on the practical application of the requirements and obligations in Articles 8 to 15, 25 and 26 (Article 96(1), point (a)) and on the relationship of the Act with the Annex I legislation (point (e)).

• Example: a sensor fault in a lift controller

  Example, not an Act requirement: a provider of an AI safety function for a lift could list the risk that a sensor fault is read as a closed door. It could test for that fault against a metric fixed before testing and record the result.

• Example: recording the residual-risk judgement

  Example, not an Act requirement: a provider could record, for each hazard it identifies, the measure it adopted and why it judged the residual risk acceptable (Article 9(5)).

• Article 9: Risk Management System for High-Risk AI

  Article 9 for all sectors: the requirements, dates and fines.

• EU AI Act Compliance for Autonomous Systems

  The autonomous systems overview: the three ways a system can be high-risk for vehicles, unmanned aircraft, robots and machines, and the other provisions that can apply.

• Article 10 for Autonomous Systems: Data and Data Governance

  Autonomous systems and Article 10: data sets, bias examination and special categories of personal data.

• Article 72: Post-Market Monitoring for AI Systems

  Post-market monitoring, whose data feed the risk analysis in Article 9(2), point (c).