EU Database Registration Under the AI Act (Article 49)

Most high-risk AI systems must be entered in a public EU database before they are placed on the market or put into service. The duty to register is Article 49 of the EU AI Act, Regulation (EU) 2024/1689; the database itself is established by Article 71. Registration is how the system becomes visible to authorities and, in part, to the public.

Two articles, one mechanism

Keep the pair straight: Article 71 sets up the EU database for high-risk systems; Article 49 is the duty to register into it. You register under Article 49 into the database established by Article 71. The data recorded follows Annex VIII.

Who registers

Primarily the provider of the high-risk system registers it (and, for non-EU providers, the authorised representative) before placing it on the market. Deployers that are public authorities, or bodies acting on their behalf, also have a registration duty for the high-risk systems they use. Most private deployers do not register the system themselves — that is the provider's job — but they should confirm the system they procure is registered.

There is also a registration touchpoint for providers claiming the Article 6(3) exemption (that an Annex III system is not high-risk): they must still register the system and the basis for the exemption.

Public and non-public sections

The database has a public section — searchable, so anyone can see registered high-risk systems and key information about them — and a non-public section for sensitive areas. High-risk systems used in law enforcement, migration, asylum and border control (Annex III points 1, 6 and 7) are recorded in a restricted, non-public part accessible to the relevant authorities, not the general public. The recorded data is set by Annex VIII.

What gets recorded (Annex VIII)

Broadly: the provider's details; the system's trade name and identifying information; its intended purpose and the Annex III category; the conformity status and Declaration of Conformity; the member states where it is or will be available; and contact information. The provider keeps the entry accurate and up to date.

Worked example: a high-risk HR-tech provider

Talentforge builds a high-risk recruitment-screening system (Annex III point 4). Before selling it in the EU, Talentforge registers it in the public section of the EU database under Article 49 with the Annex VIII data — provider details, intended purpose, Annex III category, conformity status. Its customers (deployers) do not register the system, but a public-authority customer using it would have its own deployer registration duty. A defence or migration-context system, by contrast, would sit in the non-public section.

How Confir helps

Confir holds the Annex VIII data — provider details, intended purpose, Annex III category, conformity and Declaration status — in the system's record, so the Article 49 registration assembles from information you already maintain, and flags whether the system belongs in the public or the non-public section. The engine is deterministic and rule-based.

Frequently asked questions

What is the EU database registration requirement?

Under Article 49, most high-risk AI systems must be registered in the EU database (established by Article 71) before being placed on the market or put into service. The provider primarily registers, recording the Annex VIII data, so the system is visible to authorities and, in the public section, to the public.

Who has to register — the provider or the deployer?

Primarily the provider (or its authorised representative). Deployers that are public authorities, or act on their behalf, also have a registration duty for the high-risk systems they use. Most private deployers do not register the system themselves but should confirm the system they procure is registered.

Is the database public?

Partly. It has a public, searchable section for most high-risk systems, and a non-public section for sensitive uses. Systems used in law enforcement, migration, asylum and border control are recorded in the restricted, non-public part accessible to authorities rather than the general public.

What information is recorded?

The Annex VIII data: provider details, the system's identifying information, intended purpose and Annex III category, conformity status and Declaration of Conformity, the member states where it is available, and contact information — kept accurate and up to date.

When does registration apply?

Registration is tied to the high-risk application date. The Digital Omnibus deferral to 2 December 2027 is now adopted (European Parliament, 16 June 2026; Council, 29 June 2026), pending only Official Journal publication expected before 2 August 2026. Plan against 2 December 2027.

Related guides

• Conformity assessment checklist
• EU Declaration of Conformity
• CE marking under the AI Act
• Annex III high-risk use cases
• The AI use case register