REGOLAMENTO SULL’INTELLIGENZA ARTIFICIALE, METODI DI GESTIONE DEL RISCHIO E TUTELA DEI DIRITTI UMANI

This article examines the risk-based regulatory framework established by Regulation (EU) 2024/1689 (AI Act), focusing on the relationship between risk-management obligations and the protection of fundamental rights. It analyses the structure and functions of the risk-management system under Article 9 as a continuous, preventive mechanism for identifying, assessing, mitigating and monitoring the risks generated by high-risk AI systems throughout their lifecycle, and situates it within the broader requirements of technical compliance, provider accountability, documentation and conformity assessment. It then considers the Fundamental Rights Impact Assessment under Article 27 as a complementary, context-based safeguard within a multilayered governance model that distributes responsibility between providers and deployers. Adopting a rights-based perspective, it investigates the tensions arising in the mitigation phase between competing fundamental rights – privacy, non-discrimination and freedom of expression – and assesses the adequacy of balancing techniques and model-alignment methodologies. Drawing on the UN Guiding Principles on Business and Human Rights, it argues that fundamental rights follow a non-compensatory logic that precludes any offsetting of adverse impacts against aggregate benefits, and reads the AI Act – together with the positivisation of human-rights due diligence in EU law – as embodying a duty of qualified conduct rather than a mere threshold of acceptable risk. It concludes by asking whether the prevailing risk-based and procedural turn, also in light ofrecent simplification measures, may reintroduce a business-case rationale and legitimise an implicit, ex ante acceptance of residual impact on fundamental rights.