欧盟人工智能法案符合性评估和第九条风险管理
符合性评估是您证明符合欧盟人工智能法案的方式。第九条风险管理是符合性评估所验证的关键流程。两者紧密相关——本页涵盖两者。
欧盟人工智能法案符合性评估和第九条风险管理
符合性评估是您证明符合欧盟人工智能法案的方式。第九条风险管理是符合性评估所验证的关键流程。两者紧密相关——本页涵盖两者。
上次更新: 2026年7月4日
第九条：风险管理体系
根据第 9 条，风险管理是一个持续的过程，贯穿于人工智能系统的整个生命周期。所需要素：
- 识别和分析已知以及合理可预见的风险
- 评估在预期使用和合理可预见的滥用情况下存在的风险
- 评估来自上市后监测的风险
- 采取适当且有针对性的风险管理措施
- 针对验收标准，测试剩余风险
第 9 条明确要求，风险管理措施应与现有技术水平相平衡——即，在今天合理可实现的情况下，而不是理论上的完美状态。
符合性评估途径
根据人工智能系统类型，有两种主要的途径：
- 内部控制（附件 VI）——使用统一标准进行供应商自我评估。适用于大多数独立的附件 III 高风险系统。
- 指定机构（附件 VII）——由欧盟指定的指定机构进行第三方评估。适用于生物识别识别系统以及作为受监管产品安全组件的人工智能。
CE 标志和欧盟数据库注册
在确定符合性后，在投放市场之前完成以下最后步骤：
- 在评估符合性后，起草欧盟符合性声明
- 将 CE 标志贴在人工智能系统上（如果不是实体产品，则贴在其包装/文档上）
- 在投放市场之前，在欧盟人工智能数据库中注册人工智能系统
- 在投放市场后，至少保留 10 年的技术文档
持续义务
符合性不是一次性事件：
重大变更会触发重新评估。根据第 72 条进行的上市后监测会反馈到第 9 条的风险管理中。必须根据第 73 条向相关部门报告严重事件。
How AIAgentree helps
Article 9 risk management and conformity assessment both stand or fall on evidence. AIAgentree captures that evidence as a by-product of how your agents actually operate.
- Tamper-evident decision records document each agent decision with timestamps and context, giving conformity assessors the Article 9 risk-evaluation and residual-risk trail they expect.
- Human-oversight and approval workflows capture intervention and sign-off, evidencing the risk-management measures Article 9 requires you to adopt and test.
- Audit-fit retention (6 months or longer) with export on demand and EU data residency in Germany keeps your conformity evidence available and jurisdiction-appropriate across the full assessment lifecycle.
Continue exploring the EU AI Act guide
EU AI Act Compliance Guide
The complete guide to EU AI Act compliance for AI agents — start here.
Article 12 — Record-Keeping & Logging
What every high-risk AI system must log, and how to capture it.
Article 14 — Human Oversight
Designing effective human-in-the-loop controls for AI decisions.
Annex III — High-Risk AI Systems
Which AI use cases the Act classifies as high-risk.
EU AI Act Compliance Checklist
A step-by-step checklist to reach and document compliance.
Compliance Cost Calculator
Estimate your EU AI Act compliance effort and cost.
Deadlines & Timeline
Key enforcement dates, including the August 2, 2026 deadline.
Fines & Penalties
Penalty tiers up to €35M or 7% of global annual turnover.
Transparency Obligations (Art. 13 & 50)
Disclosure duties for AI systems and their outputs.
GPAI Obligations
Rules for providers of general-purpose AI models.
EU AI Act for US Companies
Extraterritorial scope and what US providers must do.
Omnibus Update
The latest changes to the EU AI Act timeline and rules.
Penalty Calculator
Estimate your maximum fine under the Article 99 tiers.
Article 11 + Annex IV
What technical documentation the EU AI Act requires.
Article 26: Deployer Obligations
What deployers of high-risk AI must do, including log retention.
Article 17: Quality Management
The QMS providers of high-risk AI must document.
Article 10: Data Governance
Data quality, bias mitigation, and governance duties.
Article 4: AI Literacy
The staff AI-literacy duty in force since February 2025.
Deployer vs Provider
Who bears which obligation — and when a deployer becomes a provider.
FRIA (Article 27)
Who must run a Fundamental Rights Impact Assessment, and how.
Who Does It Apply To?
Scope, operators, and the extraterritorial reach of the EU AI Act.
Post-Market Monitoring
Articles 72–73: ongoing monitoring and incident reporting.
ISO 42001 vs EU AI Act
How the voluntary standard and the binding law fit together.
NIST AI RMF vs EU AI Act
A practical crosswalk between the framework and the law.
EU AI Act for Healthcare
High-risk medical AI, MDR/IVDR interplay, and clinician oversight.
EU AI Act for Financial Services
Credit scoring, insurance pricing, and existing financial regulation.
EU AI Act for HR & Employment
Hiring AI as high-risk, plus NYC LL144 and EEOC overlap.