Article 9: Risk management
Article 9 addresses risk management for high-risk AI systems. Legal counsel should confirm whether it applies and how the organization must implement it.
Supporting records
| Risk activity | VeriProof records that may support it |
|---|---|
| Define scope | Application, use, owner, environment, and risk context |
| Monitor controls | Policy, threshold, evaluation, and session records |
| Identify exceptions | Policy results, evidence gaps, alerts, and assigned work |
| Record treatment | Decision, rationale, owner, remediation, and follow-up evidence |
| Review change | Before-and-after records for the affected application and period |
Review a risk
- State the risk, affected people, and application scope.
- Identify the required controls and evidence fields.
- Review captured records and known gaps.
- Record the treatment decision and accountable owner.
- Reassess after material application, model, data, or policy changes.
Use the records to test your risk assessment against observed activity. They cannot identify every foreseeable risk or decide which treatment is acceptable.
Related guidance
Last updated on