Checks / Obligations / Manage the risks
Obligation · 28 controls · 13 laws
Manage the risks
Identify, assess and reduce the risks a system poses, and keep a record of what is left.
What to put in place
Keep a risk register for each system: the risks, what reduces them and what is left.
Policy wording you can use
[your organisation] identifies and assesses the risks posed by each AI system, records the measures taken to reduce them, and documents the remaining risk and who accepted it.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 27 controls here that take a yes or a document (the rest need their own number or date and are listed after).
Every control that asks for this
NIST AI RMF
- NIST AI RMF GOVERN-4.1 - risk culture / policy
- NIST AI RMF GOVERN-6.1 - third-party risk policy
- NIST AI RMF MANAGE-1.1 - risks prioritised
- NIST AI RMF MANAGE-2.2 - mitigation plan
- NIST AI RMF MANAGE-3.1 - third-party risks managed
EU AI Act
- EU AI Act Art.9 - risk management system recorded
- EU AI Act Art.9 - residual risk documented
- EU AI Act Art.6 - risk classification recorded
- EU AI Act Art.6(4) - non-high-risk Annex III assessment documented
DORA
- DORA Art.5 - ICT risk management framework
- DORA Art.28 - third-party ICT risk register
- DORA Art.28 - concentration risk assessed
- DORA Art.45 - threat intelligence sharing
Agent output: compliance gates
- EU AI Act Art.9 - risk management recorded
- EU AI Act Art.6 - risk classification recorded
- NIST AI RMF MANAGE-1 - risks prioritised
- NIST AI RMF MANAGE-2 - mitigation plan
EN 18286:2026 (AI Act QMS)
- EN 18286 Cl.6 - risks to the QMS itself addressed
- EN 18286 Cl.8.2 / Art.17(1)(g) - life-cycle risk management system