From Legal Text to AI-specific Risk Sources: A Systematic Analysis of the EU AI Act's High-Risk Requirements

The EU AI Act's high-risk requirements focus primarily on organizational and documentation obligations rather than AI-specific risks: the paper finds that only a minority of the Act's requirements directly address technical AI risk sources, meaning compliance alone may not fully mitigate the actual technical risks AI systems pose.

A significant gap exists between legal requirements and AI risk management practice: the paper identifies that no clear mapping previously existed between the Act's obligations and established AI risk taxonomies, leaving practitioners without structured guidance on how to align regulatory compliance with systematic risk management.

The paper creates an "EU AI Act Risk Source List" that consolidates distinct AI-specific risks implicitly addressed by the Act's requirements, providing the first structured reference for comparing legal obligations with existing risk management frameworks—a practical tool for organizations implementing the regulation.

Process and documentation requirements dominate the Act's high-risk provisions, suggesting the regulation emphasizes accountability and transparency mechanisms (like record-keeping and impact assessments) as primary tools for ensuring trustworthy AI, rather than prescribing specific technical safeguards.

The research highlights a critical implementation challenge: organizations cannot simply follow the EU AI Act's requirements and assume they have comprehensively managed AI-specific risks, as the legal framework and technical risk management practices address different aspects of AI safety and trustworthiness.