Assessment focus
Establishes whether a documented, continuous risk management system exists throughout the lifecycle of the High-Risk AI System.
Typical evidence
- Risk Management Policy
- Risk Register
- Hazard Analysis
- Validation & verification records
- Monitoring procedures
- CAPA records
Common findings
- Risks identified but not systematically evaluated
- Residual risks not documented
- Mitigation effectiveness cannot be evidenced
- Monitoring disconnected from risk management



