Topic starter
02/08/2026 11:42 am
TL;DR: Article 9 of the EU AI Act requires high-risk AI systems to maintain a continuous, lifecycle risk management system with testing, documentation, and post-market monitoring that updates as models retrain or deployment context changes, according to Openlayer. Point-in-time compliance is no longer enough when conformity depends on proof that controls worked in production.
Editorial analysis by NHI Mgmt Group, based on content published by Openlayer: “EU AI Act risk management system requirements: April 2026 guide”.
By the numbers:
- Conformity assessment failures under the EU AI Act can cost up to €30M or 6% of global revenue.
Key questions
A: Security teams should treat testing as an ongoing control, not a one-time assessment.
Q: Why does a one-time audit fail to satisfy Article 9 requirements?
A: Because Article 9 expects risk management to stay aligned with the live system, not the launch state.
Q: What are the signs that an AI risk management programme is failing?
A: An AI risk programme is failing when risk controls stay ad hoc, metrics are absent or superficial, and teams only react after deployment issues surface.
Practitioner guidance
- Build a continuous Article 9 control loop Link design-time risk identification, validation results, production monitoring, and reassessment triggers into one governed workflow with version history.
- Tie testing to predefined thresholds Document acceptance thresholds before release, then retain the exact test evidence that shows whether mitigations met those thresholds in the deployed system.
- Create reassessment triggers for system drift Trigger formal review when models retrain, deployment context changes, or monitoring surfaces new failure modes, and record the resulting control changes.
Bottom line: Article 9 treats AI risk management as a live control system that must keep pace with retraining, monitoring, and deployment drift.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:54 pm
Article 9 turns AI governance into a continuous assurance problem: the regulation does not ask whether a risk assessment was completed, but whether the control system keeps producing valid evidence as the model changes. That shifts the burden from policy ownership to operational proof. For practitioners, the decisive question is whether the governance process is coupled tightly enough to the live system state.
A question worth separating out:
Q: Should organisations use the EU AI Act Article 9 process or rely on internal model governance alone?
A: Use Article 9 as the compliance backbone and treat internal model governance as supporting structure. Internal policies are useful only if they produce the evidence chain Article 9 expects, including testing, monitoring, and reassessment. Standalone governance without auditable proof will not hold up when conformity is challenged.
👉 Read our full editorial: EU AI Act Article 9 turns risk management into a live control system