Acceptable risks in Europe's proposed AI Act: Reasonableness and other principles for deciding how much risk management is enough

"As far as possible" is an impractical standard: The EU Commission's proposed requirement that residual risks be reduced "as far as possible" is unworkable because it lacks clear limits and could require infinite resources. The paper argues this standard actually undermines both proportionate regulation and trustworthiness rather than promoting them.

Reasonableness and cost-benefit analysis are more workable: The European Parliament's draft amendments introduce a "reasonableness" standard that weighs costs against benefits, similar to approaches used in negligence law and medical device regulation. This provides clearer, more practical guidance for what constitutes acceptable risk management.

Risk acceptability decisions are inherently value-laden and contextual: The paper emphasizes that determining "acceptable risk" is not a purely technical question but involves value judgments that depend on context. Different stakeholders may reasonably disagree about what level of risk is acceptable, which the regulation should acknowledge transparently.

Affected communities must have meaningful input: The paper argues that risk acceptability judgments need legitimacy grounded in civic participation—including detailed regulatory guidance and meaningful involvement from people and communities affected by high-risk AI systems, not just technical experts.

Medical devices regulation offers a useful model: The paper draws on established principles from European medical device regulation to show how other sectors have successfully balanced innovation with safety through proportionate, context-aware risk management approaches.