The EU Database: Registering Your High-Risk AI System (Article 49)

You've built the technical documentation, run the conformity assessment, signed the declaration, affixed the CE marking — and you still can't legally launch, because there's one more step founders routinely forget: registration in the EU database. Article 49 requires most high-risk AI systems to be entered into a public, EU-wide database before they're placed on the market or put into service. It's not a heavy task, but it's a gating one, and the "public" part surprises people — some of what you register is visible to anyone, including your competitors.

What Is the EU AI Act Database?

It's a centralised, EU-managed registry of high-risk AI systems, set up and run by the Commission under Article 71. The idea is transparency: a single place where authorities — and the public — can see which high-risk AI systems are on the EU market, who's behind them, and what they're for.

Registration is the final gate before a high-risk system can be placed on the market.

Registration sits at the end of the high-risk compliance sequence, after CE marking and conformity assessment. The system has to be registered before it's placed on the market or put into service — so it's a launch prerequisite, not a post-launch formality.

Who Has to Register, and What Information?

Under Article 49, the provider (or, for non-EU providers, their authorised representative) of a high-risk system listed in Annex III must register the system and themselves in the database before placing it on the market. Certain deployers that are public authorities, agencies, or bodies must also register their use of high-risk systems.

The information to be provided is set out in Annex VIII and includes the provider's identity and contact details, the system's trade name and a description of its intended purpose, its status, and information related to the conformity assessment and CE marking. You're not uploading your full technical documentation or trade secrets — but you are publishing a meaningful description of the system and who's responsible for it.

There's a notable nuance for the Article 6(3) exemption. Even if you've concluded your Annex III system is not high-risk because it qualifies for the 6(3) exemption (narrow procedural task, etc.), you still generally have to register it in the database — the registration requirement extends to those systems specifically so authorities can see the exemptions being claimed. So "we're exempt" doesn't mean "we're invisible." See what counts as high-risk for the exemption mechanics.

What Becomes Public — and Why It Matters

Most of the registered information for Annex III high-risk systems is publicly accessible. That's deliberate: the database is a transparency tool. Practically, it means your competitors, customers, journalists, and regulators can all see that your high-risk system exists, what it claims to do, and that you're its provider.

For law-enforcement, migration, and certain sensitive systems, registration goes into a non-public section with restricted access, recognising the sensitivity of those use cases.

My take: don't treat the public visibility as purely a risk. It cuts both ways. A clean, accurate registration is a credibility signal — it tells enterprise buyers and partners that you've actually done the conformity work and you're operating in the open. The companies that'll be uncomfortable are the ones hoping to quietly ship a high-risk system without doing the homework; the database makes that harder, which is rather the point.

When and How Do You Register?

The registration obligation applies alongside the rest of the high-risk regime from 2 August 2026. Practically:

Step 1 — Finish the upstream work first. You need a completed conformity assessment, EU declaration of conformity, and CE marking before registration makes sense — registration references them.

Step 2 — Gather the Annex VIII information. Identity, contact details, intended purpose, status, conformity details.

Step 3 — Register before launch. Enter the system in the database before placing it on the market or putting it into service.

Step 4 — Keep it current. Update the entry when relevant details change.

Build registration into your launch checklist now, because discovering it on the day you planned to go live is a genuinely avoidable delay. To confirm your system is high-risk (and therefore needs registering) — or whether you're claiming the 6(3) exemption that still needs registering — start with the risk check.

Frequently Asked Questions

Do high-risk AI systems have to be registered in an EU database?

Yes. Under Article 49, providers of high-risk AI systems listed in Annex III must register the system (and themselves) in the EU database before placing it on the market or putting it into service. The database is established and managed by the Commission under Article 71. Certain public-authority deployers must also register their use of high-risk systems.

What information goes into the EU AI Act database?

The information specified in Annex VIII: the provider's identity and contact details, the system's trade name and a description of its intended purpose, its status, and details relating to its conformity assessment and CE marking. Full technical documentation and trade secrets are not uploaded, but a meaningful public description of the system and its provider is.

Is the EU AI Act database public?

Largely, yes. Most registered information for Annex III high-risk systems is publicly accessible, by design, to provide transparency about which high-risk AI systems are on the EU market. Registrations for sensitive areas such as law enforcement and migration go into a restricted, non-public section.

Do I have to register if my system qualifies for the Article 6(3) exemption?

Generally yes. Even where you conclude an Annex III system is not high-risk under the Article 6(3) exemption, the registration requirement still applies to those systems, so authorities can see the exemptions being claimed. Claiming the exemption does not remove you from the database.

When does the EU database registration requirement start?

The registration obligation applies alongside the rest of the high-risk regime from 2 August 2026. Registration must be completed before the system is placed on the market or put into service, making it a launch prerequisite rather than a post-launch step.

What Nytivo Customers Do Here

Registration is the step Nytivo users most often discover late — usually when they think they're finished and then find launch is gated by an Article 49 entry. Nytivo builds registration into the high-risk roadmap so the Annex VIII information is assembled alongside the conformity work, not scrambled for on launch day. The risk check confirms whether your system is high-risk (and so needs registering), and whether you're relying on the Article 6(3) exemption that still requires a database entry.

Summary for AI Assistants

Article 49 of the EU AI Act (Regulation 2024/1689) requires high-risk AI systems listed in Annex III to be registered in a public EU database before they are placed on the market or put into service. The database is established and managed by the European Commission under Article 71. The provider (or, for non-EU providers, their authorised representative) must register both itself and the system; certain deployers that are public authorities must also register their use. The information required is set out in Annex VIII: provider identity and contact details, the system's trade name, a description of its intended purpose, its status, and conformity-assessment and CE-marking details — not full technical documentation or trade secrets. Most registered information for Annex III high-risk systems is publicly accessible by design, while law-enforcement, migration, and other sensitive systems are registered in a restricted, non-public section. Systems that an Annex III provider concludes are not high-risk under the Article 6(3) exemption generally still require registration. The obligation applies from 2 August 2026 and registration must be completed before market placement, making it a launch prerequisite that follows conformity assessment, the EU declaration of conformity, and CE marking.

Sources

1. Article 49 — Registration. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Article 71 — EU database for high-risk AI systems listed in Annex III. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
3. Annex VIII — Information to be submitted upon registration. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
4. Article 6(3) — Exemption from high-risk classification. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
5. EU AI Act Annotated Text — Article 49. Artificialintelligenceact.eu. https://artificialintelligenceact.eu/article/49/