Residual Risk Disclosure

Residual risk refers to the risk remaining after all planned risk control measures have been implemented. In the context of the EU AI Act, it is the specific level of risk that persists after an exhaustive iterative risk management process has been applied to a high-risk AI system. This is not a failure of mitigation, but a formal acknowledgment that no system is perfectly safe. The disclosure must clearly distinguish between risks that have been eliminated and those that are accepted as part of the system's operational profile.

A formal residual risk disclosure is not optional; it is triggered by the completion of the conformity assessment for high-risk AI systems. Key triggers include:

• CE Marking Preparation: The disclosure must be finalized before affixing the CE mark.
• EU Database Registration: The documented residual risks form a critical part of the technical documentation file submitted to the EU Commission database.
• Substantial Modification: Any significant change to the system's logic or intended purpose requires a new risk assessment and an updated disclosure to reflect the new residual risk profile.

The disclosure must be communicated in a way that is appropriate for the intended end-user, who may not be a technical expert. The EU AI Act mandates that the information be:

• Transparent: Free of jargon and clearly explaining the nature of the risk.
• Accessible: Provided in a durable medium, such as a printed manual or a static digital document, not just a transient pop-up.
• Contextual: Explaining the specific operational scenarios or environmental conditions under which the residual risk is most likely to manifest, enabling users to make informed decisions.

The residual risk disclosure is the final output of the risk management system mandated by Article 9 of the EU AI Act. This system requires a continuous, iterative process throughout the AI system's lifecycle:

1. Identification: Known and foreseeable risks are cataloged.
2. Estimation: The probability and severity of each risk are evaluated.
3. Mitigation: Controls are designed and implemented to eliminate or reduce risks.
4. Evaluation: The remaining risk is assessed. Only the risks that survive this final step are documented in the residual risk disclosure, serving as a legal record of the system's safety boundary.

It is crucial to distinguish a residual risk disclosure from an incident report. The disclosure is a proactive, pre-deployment declaration of known and accepted potential failures. In contrast, an incident report is a reactive, post-market notification of a serious malfunction that was either unanticipated or whose severity exceeded the initial estimation. The disclosure sets the baseline expectation; a failure that falls outside the disclosed residual risks is a strong indicator of a non-compliant or defective system requiring immediate market surveillance intervention.

A properly filed residual risk disclosure serves as a liability shield for the provider. By transparently declaring the system's known limitations, the provider shifts a portion of the responsibility to the professional deployer, who must account for these risks in their operational context. Failure to disclose a known residual risk can lead to:

• Product Liability Claims: Under the revised Product Liability Directive, a missing or misleading disclosure can be evidence of a defect.
• Regulatory Penalties: Non-compliance with transparency obligations can result in fines of up to a percentage of global annual turnover.
• Criminal Liability: In cases of willful negligence leading to harm.