Inside the High-Risk Rulebook: Arts 8–15 Article by Article

The seven substantive requirements every high-risk system must meet — risk management, data governance, documentation, logging, transparency, human oversight, and robustness — with the evidence each demands and the ISO 42001 / NIST RMF crosswalk.

Content current as of 2026-09.

Lessons

1. Arts 8–9: the compliance frame and the risk management system
2. Art 10: data and data governance
3. Arts 11–13: documentation, logging, and telling deployers the truth
4. Art 14: human oversight by design
5. Art 15: accuracy, robustness, and cybersecurity
6. The crosswalk: Arts 9–15 meet ISO 42001 and NIST — and the evidence pack