"... the deployer shall develop a risk management policy after deploying the system...."

This is a complete sham. Anything really geared towards protecting people would have protections in place before deployment.