← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 9: risk management for AI agents

Article 9 requires providers of high-risk AI systems to establish, implement, document and maintain a risk management system. The text is explicit that this is not a one-off assessment: it is a continuous, iterative process that runs across the entire lifecycle of the system and is regularly reviewed.

For an LLM agent, the lifecycle never really stops: the model version changes, prompts change, tools are added, and the agent meets inputs nobody tested. That is exactly the situation Article 9 was written for.

What Article 9 asks for

Identify and analyse the known and reasonably foreseeable risks to health, safety and fundamental rights when the system is used as intended.
Estimate and evaluate risks that may emerge under intended use and under reasonably foreseeable misuse.
Evaluate other risks based on data gathered by post-market monitoring (see Article 72).
Adopt risk management measures so that the residual risk is judged acceptable.
Test the system against prior defined metrics and probabilistic thresholds, before placing it on the market and throughout development where appropriate.

Where agents make this hard

A classic classifier has a fixed input and output space. An agent chooses tools, chains calls and acts on the world. The risks that matter are behavioural: a tool called with the wrong arguments, a loop that burns budget, an instruction injected through a retrieved document, an action taken without the approval it needed.

You cannot evaluate those risks from design documents alone. You need to see what the agent actually did, run after run.

Evidence that the process is real

An auditor reading your risk file will ask one question: is this process running, or was it written once? The records that answer it:

Policy decisions as events. Every rule that allowed, warned or blocked an action, logged at the moment it fired, with the rule id.
Test runs you can replay. Evaluation runs recorded in the same format as production, so a regression can be diffed against the baseline.
A link from incident to measure. When monitoring finds a new failure mode, the rule or test that now covers it, and the runs where it fired.
Integrity. A risk log that could have been edited afterwards proves little (see tamper-evident logs).

A practical loop

Write the risks you know as inline policies (cost ceilings, tool allow-lists, approval requirements, PII patterns).
Record every model call, tool call and policy decision in a signed, hash-chained ledger.
Review blocked and warned actions weekly; each new pattern becomes a rule or a test.
Replay the recorded runs after every model or prompt change and diff the behaviour.

That loop is the "continuous iterative process" of Article 9, and every turn of it leaves a record.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 49 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.