Registering in the EU Database: Your Article 49 & 71 Step-by-Step Guide
Before many high-risk AI systems can go to market, they must be registered in the public EU database. This step-by-step guide covers who must register under Article 49, what information becomes public under Article 71, timing, and the special duties for public authority deployers.
The Public Register Most Providers Have Overlooked
Among the many obligations arriving on August 2, 2026, one is easy to miss because it doesn't involve your product at all — it involves a database. Under Article 49 of the EU AI Act, providers and certain deployers of high-risk AI systems must register in the EU database established under Article 71 — a largely public registry maintained by the European Commission. Registration must happen before the system is placed on the market or put into service, and much of the submitted information is publicly accessible.
Who Must Register
Providers of Annex III high-risk systems must register themselves and the system before market entry. Providers claiming a "not high-risk" derogation under Article 6(3) must still register the system and record the justification. Authorised representatives register on behalf of non-EU providers. Deployers that are public authorities or EU bodies must register their use of high-risk systems under Article 49(3). Note the exception: for certain law enforcement, migration, asylum, and border control systems, registration is made in a secure, non-public section of the database.
What Information Goes Into the Database
The data fields are set out in Annex VIII, Section A, and include the provider's name and contact details, the trade name and identification of the AI system, a description of its intended purpose and Annex III category, the system's status, the type of conformity assessment and any notified body involved, the Member States where it is available, and electronic instructions for use. Public authority deployers register a narrower set of information under Section C, including a summary of the fundamental rights impact assessment where one was required under Article 27.
Timing: When Registration Must Happen
The rule is unambiguous: registration must be completed before the high-risk system is placed on the market or put into service, and for public authority deployers before first deployment. There is no grace period once obligations apply on August 2, 2026 — a system that should be registered but isn't is, by definition, non-compliant. Status changes such as withdrawal or recall must be kept updated.
A Practical Registration Checklist
Confirm each system's Annex III classification and whether it is registrable in the public or secure section; assemble the Annex VIII data fields including intended purpose and conformity assessment details; prepare electronic instructions for use in an accessible format; assign a responsible owner for the entry and its ongoing accuracy; for public authority deployers, attach the FRIA summary; and register before market entry or deployment, keeping the entry current thereafter.
Why Accuracy Matters
Because much of this database is public, it is a natural starting point for journalists, civil society, competitors, and market surveillance authorities deciding where to focus. An inaccurate, incomplete, or missing entry is a visible red flag. Treat your registry entry as a public compliance statement, because that is exactly what it is.
Need help preparing your EU database registration? Browse our directory of AI Act compliance experts who can assemble your Annex VIII submission.