Who has to register a high-risk AI system in the EU database?

Providers of Annex III high-risk systems must register before the system is placed on the market or put into service (Article 49(1)); deployers that are public authorities, agencies, or bodies must register their specific use before putting the system into service (Article 49(3)).

Do you still register if you claim the system isn't high-risk?

Yes. If a provider relies on the narrow Article 6(3) exception to conclude an Annex III-type system is not high-risk, it must still register the system and record the specific grounds relied on, the registration documents the exception claim itself.

What information does the EU database registration require?

Under Annex VIII: provider (and any authorised representative) details, the system's trade name and a unique reference, a description of the intended purpose and operating logic, its current market status, and the conformity documentation, certificate details, the EU declaration of conformity, and instructions for use.

EU AI Act

Registering a high-risk AI system in the EU database (Article 49)

Updated 22 August 2026Sourced from Regulation (EU) 2024/1689 (the EU AI Act), Article 49 and Annex VIII

In short

Registering a high-risk system in the EU database is a precondition to placing it on the market, an unregistered high-risk system is non-compliant on that basis alone. Providers of Annex III systems register before market placement (Art. 49(1)); public-authority deployers register their specific use before putting it into service (Art. 49(3)). Annex VIII sets the required details, and even a provider claiming the Article 6(3) non-high-risk exception must still register and record the grounds. The entry must be kept current as market status changes.

Registration in the EU database is a precondition to lawfully placing a high-risk AI system on the market, an unregistered high-risk system is non-compliant on that basis alone, independent of how well-controlled or well-documented it otherwise is.

Who registers, and when

Article 49(1) requires providers of Annex III high-risk systems to register the system in the EU database before it is placed on the market or put into service. Article 49(3) adds a separate registration duty for deployers that are public authorities, agencies, or bodies, they must register their specific use of the system before putting it into service, and a public-sector deployer should not use a high-risk system that has not been registered.

What Annex VIII requires in the registration

Provider details and, where applicable, the authorised representative.
The system’s trade name and a unique reference allowing it to be identified.
A description of the intended purpose and the data inputs and operating logic, at a level useful for the register’s public-facing role.
The system’s current market status.
The relevant conformity documentation: certificate details, the EU declaration of conformity, and instructions for use.

Registration is required even when claiming an exception

If a provider concludes a system that would otherwise fall under an Annex III category is not actually high-risk under the narrow Article 6(3) exception (because it performs only a narrow procedural task, or does not materially influence the outcome of a decision) it must still register the system and record the specific grounds relied on for that conclusion. Registration in this case documents the exception claim itself, not the high-risk status.

Keeping the entry current

A change in the system’s market status (recalled, withdrawn, materially updated) has to be reflected in the registered entry. A registration that was accurate at launch but was never updated as the system or its market status changed does not satisfy the ongoing nature of this obligation.

The EU database is a public transparency mechanism as much as a compliance record, it is designed to let regulators, researchers, and affected individuals see which high-risk systems are on the market and who is responsible for them, which is why the registration information itself needs to be accurate and complete, not just formally present.

Frequently asked questions

Who has to register a high-risk AI system in the EU database?: Providers of Annex III high-risk systems must register before the system is placed on the market or put into service (Article 49(1)); deployers that are public authorities, agencies, or bodies must register their specific use before putting the system into service (Article 49(3)).
Do you still register if you claim the system isn't high-risk?: Yes. If a provider relies on the narrow Article 6(3) exception to conclude an Annex III-type system is not high-risk, it must still register the system and record the specific grounds relied on, the registration documents the exception claim itself.
What information does the EU database registration require?: Under Annex VIII: provider (and any authorised representative) details, the system's trade name and a unique reference, a description of the intended purpose and operating logic, its current market status, and the conformity documentation, certificate details, the EU declaration of conformity, and instructions for use.

Related guides

Not sure where your company stands?

Our free assessment gives you an indicative result in minutes (free and anonymous) no account needed.

Start the free check