Compliance Gap Analysis

The risk management system must be a continuous iterative process planned and run throughout the entire lifecycle of the high-risk AI system, requiring regular systematic review and updating.

Identify and analyse the known and reasonably foreseeable risks that the high-risk AI system can pose to health, safety, or fundamental rights when used in accordance with its intended purpose.

Estimate and evaluate the risks that may emerge when the system is used in accordance with its intended purpose and under conditions of reasonably foreseeable misuse.

Evaluate risks that may emerge based on the analysis of data gathered from the post-market monitoring system referred to in Article 72.

Adopt appropriate and targeted risk management measures designed to address identified risks. Measures must give due consideration to the effects and possible interaction with other requirements, and to the generally acknowledged state of the art.

Testing procedures must be suitable to fulfil the intended purpose of the AI system and do not need to go beyond what is necessary. Testing must be performed against prior defined metrics and probabilistic thresholds.

When implementing risk management measures, consideration must be given to the combined effects that may result from the AI system being used together with other AI or non-AI systems or processes.

Any residual risk after risk management measures are adopted must be judged acceptable. Residual risks must be communicated to the deployer. Residual risks associated with each hazard and the overall residual risk must be within an acceptable level.

Data governance and management practices must concern the design choices, data collection processes, data preparation operations (annotation, labelling, cleaning, updating, enrichment, aggregation), formulation of relevant assumptions, prior assessment of data availability and suitability, and examination for possible biases.

Document all data collection processes, the origin of data, and the data preparation processing operations used for the training, validation, and testing datasets.