Risks: Art. 9 risks, the heat-map and reviews

Risks (under Do the work) is the risk register — the identified risks across your AI portfolio, tracked from detection through treatment to residual sign-off. It is the working surface of the Art. 9 risk management system, which the EU AI Act requires providers of high-risk systems to establish, implement, document and maintain as a continuous, iterative process across the system's lifetime — not a one-off document.

Reading the register

Four counts run along the top — Total risks, With residual assessed, Critical severity and Treatment unresolved — above a heat-map (severity × likelihood, with a legend) that shows the portfolio's risk posture at a glance. The Assessments required strip lists one row per system × assessment type — Art. 9 risk management, Art. 27 FRIA and, for GPAI providers, Art. 55(1) model evaluation — each with a Start or Continue action so nothing owed is out of sight.

The table lists every risk with its system, the articles it touches, severity, inherent score, treatment and residual score. Filter by severity, treatment or system; click a row to open its drawer.

Log and score a risk

Press Log a new risk (or open a system's Risks tab). The guided wizard runs one step per screen:

1. Describe — the hazard and who it affects.
2. Severity — how bad the harm would be.
3. Likelihood — how probable it is. The inherent score is severity × likelihood.
4. Treatment — the type of control you will apply (mitigate, transfer, avoid or accept), with examples.
5. Treatment plan — the specific measures and owners.
6. Residual — the risk that remains after the control, which has to be judged acceptable and signed off.
7. Evidence — attach the proof that the control is real.

An expert form is there for people who would rather fill the whole record on one screen. Because Art. 9 is iterative, you revisit the register across the system's lifetime — especially after incidents or changes.

Article 27 — the FRIA

A fundamental-rights impact assessment is a duty on certain deployers of high-risk systems — public bodies, private entities providing public services, and deployers in the credit-scoring and life/health insurance cases — done before first use. When your Duties answers and classification trigger it, the FRIA appears as an obligation with its own editor and as a row on Assessments. See FRIA: the fundamental-rights impact assessment, step by step.

Review schedules

When a system is classified, Veritome generates a review schedule matched to its role and tier: a classification review and an AI-literacy programme review for every system, and for high-risk systems the risk-management review, post-market-monitoring review, log-retention check, oversight-training review, FRIA review and QMS review as they apply. Each carries an owner and a due date and reminds the owner as it falls due. The management-system internal audits and management reviews of the ISO/IEC 42001 programme are scheduled and completed under Frameworks → ISO/IEC 42001 → Reviews and listed on Assessments; a planned action recorded on Frameworks → Changes becomes a review the same way. The next review date of the organisation-level records shows on Policies.

Completing a review → the dossier entry

Completing a review — with the outcome in its notes and, if needed, an adjusted due date — does three things:

• records who completed it and when;
• creates the next occurrence, so an annual review re-schedules itself; and
• appends an annual-review entry (status Submitted) to the system's classification dossier — a dated, attributed footprint in the chain of custody, written to the audit trail.

That last step is what makes routine reviews build their own audit trail: you can later show not just that a review happened, but when, by whom, and in sequence with every other dossier event.