Who must register an AI system in the EU database under Article 49 of the EU AI Act?

Three groups register in the EU database under Article 49: providers of high-risk systems listed in Annex III, except point 2; providers who concluded under Article 6(3) that an Annex III system is not high-risk; and deployers of those high-risk systems that are public authorities, Union institutions, bodies, offices or agencies or persons acting on their behalf. Where applicable, a provider's authorised representative registers in its place. Article 49 keeps 2 August 2026 (Article 113, second paragraph), while the classification rules that decide its reach apply to Annex III systems from 2 December 2027 (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Article 49 was not amended; points 7 and 9 of Section B of Annex VIII were deleted.

Who has to register, and before what?

Providers of Annex III high-risk systems. Before placing on the market or putting into service a high-risk AI system listed in Annex III, "with the exception of high-risk AI systems referred to in point 2 of Annex III, the provider or, where applicable, the authorised representative shall register themselves and their system in the EU database referred to in Article 71" (Article 49(1)). A system that is high-risk only through Annex I is not covered: paragraphs 1 and 3 name systems listed in Annex III.

Providers who concluded not high-risk. Article 49(2) covers "an AI system for which the provider has concluded that it is not high-risk according to Article 6(3)": before placing it on the market or putting it into service, "that provider or, where applicable, the authorised representative shall register themselves and that system in the EU database referred to in Article 71". Article 6(4) adds that the provider documents its assessment before the system is placed on the market or put into service, and provides that documentation upon request of national competent authorities. Paragraph 2 carries no exception for point 2 of Annex III. When Article 6(3) applies, and why a system that profiles natural persons never qualifies, is its own question.

Deployers in or for the public sector. Before putting into service or using a high-risk system listed in Annex III, with point 2 again excepted, "deployers that are public authorities, Union institutions, bodies, offices or agencies or persons acting on their behalf shall register themselves, select the system and register its use in the EU database referred to in Article 71" (Article 49(3)). Under Article 26(8), a public authority or Union institution, body, office or agency that finds the system it envisages using has not been registered does not use it and informs the provider or the distributor. Other deployers have no registration duty under Article 49; their Article 26 duties stand regardless.

The two exceptions. High-risk systems under point 2 of Annex III, safety components in the management and operation of critical digital infrastructure, road traffic or the supply of water, gas, heating or electricity, are "registered at national level" (Article 49(5)); Article 49 does not say how. Systems "referred to in points 1, 6 and 7 of Annex III, in the areas of law enforcement, migration, asylum and border control management" register in "a secure non-public section of the EU database referred to in Article 71" (Article 49(4)).

What does each registration contain?

Annex VIII sets the content, and each of its three sections says the information "shall be provided and thereafter kept up to date": a registration is a record you maintain.

Section A, for Article 49(1), has 13 points, from the provider's contact details and the system's trade name to its intended purpose, data and operating logic, status, notified body certificate where applicable, Member States, EU declaration of conformity, electronic instructions for use (not provided for law enforcement or migration, asylum and border control management systems under Annex III, points 1, 6 and 7) and an optional URL.

Section B, for Article 49(2), now has seven: identification points 1 to 4 as in Section A, the intended purpose, the "condition or conditions under Article 6(3)" relied on and the status. Regulation (EU) 2026/1744, Article 1, point (42), deleted point 7, a "short summary of the grounds on which the AI system is considered to be not-high-risk in application of the procedure under Article 6(3)", and point 9, the Member States. The assessment itself still has to be documented under Article 6(4), which was not amended.

Section C, for Article 49(3), has five: the name, address and contact details of the deployer and of the person submitting on its behalf; the URL of the provider's entry, which therefore has to exist first; a summary of the findings of the fundamental rights impact assessment under Article 27; and, where applicable, a summary of the data protection impact assessment.

What is public, and what is not?

Article 71(4) makes what is registered under Article 49 "accessible and publicly available in a user-friendly manner", "with the exception of the section referred to in Article 49(4) and Article 60(4), point (c)". The non-public section takes the narrower set of points listed in Article 49(4), which leaves out point 6 of Section B, the Article 6(3) condition. Only the Commission and the national authorities referred to in Article 74(8) have access to the respective restricted sections. Regulation (EU) 2026/1744 did not amend Article 49, so its paragraph 4, point (b) still lists point 9 of Section B, which the same act deleted.

When does Article 49 apply?

Article 49 is in Chapter III, Section 5, headed "Standards, conformity assessment, certificates, registration". Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744, defers only Sections 1, 2 and 3 of Chapter III, with the exception of Article 6(5): to 2 December 2027 for systems high-risk under Article 6(2) and Annex III, and to 2 August 2028 for those under Article 6(1) and Annex I. Section 5 is in no point of that paragraph, so Article 49 takes the general date in Article 113, second paragraph: 2 August 2026. Neither text says when the Commission will open the database.

The provisions around Article 49 did move: Article 6(2), which makes an Annex III system high-risk, and Article 6(3) and (4), which carry the not-high-risk conclusion, are in Section 1; the provider's duty under Article 16, point (i) to comply with Article 49(1) and the deployer duty in Article 26(8) are in Section 3. For Annex III systems all of them apply from 2 December 2027 (Article 113, third paragraph, point (c)). Regulation (EU) 2026/1744 does not say how Section 5 is meant to operate while the classification rules are not yet in application. Treat it as open, and do not assume either date covers both.

For a high-risk system placed on the market or put into service before "the date of application of Chapter III referred to in Article 113", Article 111(2), as replaced, applies the Regulation, Article 5 aside, only if its design changes significantly as from that date; Article 113 now gives Chapter III more than one date, and the text does not say which one that phrase means. The Annex X large-scale IT system components that Article 111(1) covers are outside that rule, and providers and deployers of high-risk systems intended to be used by public authorities take the necessary steps to comply by 2 August 2030 in any case (Article 111(2)).

What does Complipath do here, and what does it not?

The AI inventory records each system with its classification and the article behind it. Each duty that follows carries an owner, a status and a date, and evidence is linked with the passage and its page. EU database registration (Article 49) is listed as a duty with its date. The registration itself is yours. A change to a provision your records cite is emailed per affected system. What is supported and what is not is in what Complipath is.

What this means for you

If you're a provider: sort each Annex III system by the paragraph of Article 49 it falls under. Draft the Annex VIII entry from what you already hold and give it an owner, because Annex VIII has it kept up to date. For a not-high-risk conclusion, write the Article 6(4) assessment first, then name the Article 6(3) condition in an entry that, outside the non-public section, Article 71(4) makes public. With the date open, have the entries ready so that, whichever reading prevails, registration is not what holds a launch.

If you're a deployer: unless you are a public authority or a Union institution, body, office or agency, or act on behalf of one, Article 49 asks nothing of you as a deployer, but the provider's public entry is worth reading before you sign. If Article 49(3) binds you, register before putting the system into service or using it, with the Section C summaries of your fundamental rights impact assessment and, where applicable, your data protection impact assessment. If you find the system has not been registered, Article 26(8) has you not use it and inform the provider or the distributor.

FAQ

When does the Article 49 registration duty apply? Article 49 sits in Chapter III, Section 5, which Regulation (EU) 2026/1744 did not defer, so it keeps the general date of 2 August 2026 (Article 113, second paragraph). The classification rules apply to Annex III systems from 2 December 2027 (Article 113, third paragraph, point (c), as replaced). Neither text says how the two fit.

Does a private company using a high-risk system have to register it? Not under Article 49(3), unless it acts on behalf of a public authority or a Union institution, body, office or agency. Recital 131 says other deployers should be entitled to register voluntarily, but recitals are not operative provisions and no Article sets out that route.

If our Annex III system is not high-risk, do we still register it? Yes, if you are its provider and concluded so under Article 6(3). Article 6(4) has you document the assessment before placing the system on the market or putting it into service, subjects you to the Article 49(2) registration and has you provide the documentation upon request of national competent authorities.

Is what we register in the EU database public? Mostly. Article 71(4) makes information registered under Article 49 publicly available, except the section referred to in Article 49(4) and Article 60(4), point (c). Systems under points 1, 6 and 7 of Annex III, in the areas of law enforcement, migration, asylum and border control management, register in that secure non-public section.

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 5, Article 6, Article 16, point (i), Article 26(8), Article 27, Article 49, Article 60(4), point (c), Article 71, Article 74(8), Article 111 and Article 113, recital 131, Annex III, Annex VIII and Annex X; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 111(2) and Article 113, third paragraph, point (c), inserted paragraphs 1a to 1c into Article 6 and deleted points 7 and 9 of Section B of Annex VIII (Article 1, points (8), (39), (40) and (42)). Article 49, Article 71, Article 6(2) to (4), Article 16 and Article 26 were not amended.

Where this question meets the product: EU AI Act compliance for AI providers. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire.