> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alethiaai.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Why Risk Management?
> What the EU AI Act requires, and how Alethia's Risk Management module helps you comply.
If you build, deploy, or use AI in the European Union — or if your AI affects people in the EU — the **EU AI Act** likely applies to you. The Risk Management module in Alethia is built to help you meet its requirements without drowning in paperwork.
You don't have to use this module. If you're testing a low-risk AI like a spam filter, you can ignore it entirely. But for **high-risk AI systems**, it's the difference between "we did some testing" and "here is our complete, audit-ready compliance file."
## What the EU AI Act requires
The Act came into force in 2024 and applies in stages, with most high-risk obligations active by 2026. The two articles most relevant to Alethia users are:
Providers of high-risk AI systems must establish, implement, document, and maintain a **continuous, iterative risk management process** throughout the system's lifecycle.
High-risk AI systems must be designed so that they can be **effectively overseen by humans** during their use.
In plain language, Article 9 says: identify your risks, assess them, mitigate them, and prove you did all of that — over and over, for as long as the system is in use.
That's a lot of process. The Risk Management module turns it into a workflow.
## The four EU AI Act risk tiers
The Act sorts AI systems into four tiers. Every project in Alethia has to be classified:
| Tier | Examples | What Alethia does for you |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| **Prohibited** | Social scoring, untargeted real-time biometric ID in public, manipulation of vulnerable groups | Project is flagged. The system shouldn't exist — but classifying it documents that you considered and rejected this use case. |
| **High-Risk** | Biometric ID, critical infrastructure, education access, employment screening, essential services, law enforcement, migration, democracy infrastructure | Full workflow: classification, risk register, assessments, mitigations, HITL, compliance reports. |
| **Limited-Risk** | Chatbots, deepfakes, emotion recognition (anything with a transparency obligation under Article 50) | Lighter workflow. Risk register optional, with transparency-focused tests prioritized. |
| **Minimal-Risk** | Spam filters, AI-enhanced video games, content tagging | No regulatory obligation. The platform supports voluntary risk management for these too. |
Read more in [Risk Classification](/risk-management/classification).
## The end-to-end risk management workflow
```
┌─────────────────────────────────────────────────────┐
│ │
│ 1. Classify your project (which tier?) │
│ │ │
│ ▼ │
│ 2. Build a Risk Register │
│ (Add risks manually or auto-suggested from │
│ failed test results) │
│ │ │
│ ▼ │
│ 3. Conduct Assessments │
│ (Link test runs, document findings) │
│ │ │
│ ▼ │
│ 4. Track Mitigations │
│ (What you did to reduce each risk; verify) │
│ │ │
│ ▼ │
│ 5. Generate Compliance Reports │
│ (Audit-ready, structured, exportable) │
│ │ │
│ ▼ │
│ 6. Repeat — continuous, iterative process │
│ │
└─────────────────────────────────────────────────────┘
```
## How Alethia maps to Article 9 specifically
| Article 9 requirement | What you do in Alethia |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
| Identify and analyze known and foreseeable risks (§2a) | Build the [Risk Register](/risk-management/register) — manually and from test data |
| Estimate and evaluate risks (§2b) | Score each risk on the [Likelihood × Impact matrix](/risk-management/register#risk-scoring) |
| Evaluate other risks from post-market data (§2c) | Run [recurring scheduled tests](/testing/schedules) and link them to assessments |
| Continuous, iterative process (§1) | Multiple [assessments](/risk-management/assessments) over time per risk entry |
| Eliminate, reduce, or inform on risks (§5a–c) | Track each [mitigation](/risk-management/mitigations) by type, status, and verified effectiveness |
| Document everything (Art. 11, 18) | Generate a structured [compliance report](/risk-management/compliance-reports) any time |
## Important honesty disclaimer
Alethia AI is a **testing and documentation platform**. The platform doesn't certify your AI system as compliant — only your **own internal compliance team** (and ultimately, regulators or notified bodies) can do that.
What Alethia does:
* ✅ Gives you the tooling to follow the Article 9 process
* ✅ Captures all the evidence you need
* ✅ Produces audit-ready documentation
* ✅ Maintains an immutable audit trail of every action
What Alethia does not do:
* ❌ Tell you whether your AI is "compliant"
* ❌ Replace a notified body assessment
* ❌ Replace legal counsel
Use the platform alongside your compliance and legal teams.
## Where to next?
Pick the right EU AI Act tier and unlock the workflow.
Identify and score risks, manually or from test data.
Link tests to risks and document findings.
Record what you did and verify it worked.