Under Article 49(1), before placing on the market or putting into service a high-risk AI system listed in Annex III, other than a system referred to in Annex III point 2, the provider or, where applicable, the authorised representative must register themselves and the system in the EU database referred to in Article 71. Article 49(2) imposes the same registration duty where a provider has concluded under Article 6(3) that an Annex III system is not high-risk. Registration is therefore a pre-market step tied to classification, and it must be completed before the system is placed on the market or put into service, not as an afterthought once deployment has begun.
When must a provider register?
The timing in Article 49 is explicit: registration happens before placing on the market or putting into service. That means the classification work, the Annex VIII information and the named registrant must be ready before the release decision, and the release record should show that registration was completed or, where national registration applies, that the national step was taken. A provider that treats registration as a post-launch administrative task risks placing a system on the market without the required entry, and a market surveillance authority can treat a missing registration as a finding of non-compliance in its own right. The practical discipline is to add registration to the release checklist, with the system version, the Annex III category considered and the registrant's authority to represent the provider all confirmed before the release is approved. Where a system is updated, the timing question must be asked again for the new version.
Which systems does the provider duty cover?
The provider duty covers high-risk AI systems listed in Annex III, with the exception of systems referred to in Annex III point 2, which are registered at national level under Article 49(5). Annex III point 2 concerns the management and operation of critical infrastructure, and the national route reflects the sensitivity and national supervision of those systems. The duty also covers, under Article 49(2), AI systems for which the provider has concluded under Article 6(3) that the system is not high-risk: the provider or authorised representative must still register themselves and that system in the EU database. That second limb is important because it prevents an Article 6(3) conclusion from removing a system from visibility altogether. A provider should therefore record the Annex III category, the Article 6 reasoning and the registration route together, so the choice of route can be explained from the same record.
For the broader regulatory framework, see EU database, registration and post-market monitoring.
What does an authorised representative register?
Where a provider is established outside the Union, or where the Act otherwise provides for an authorised representative, the representative can be the person who registers, and Article 49 refers to the provider or, where applicable, the authorised representative in both the high-risk and the Article 6(3) limbs. The representative's role is not a formality: the database contains the names and contact details of natural persons responsible for registering the system who have legal authority to represent the provider or deployer, and the representative must be able to act on the provider's behalf in dealings with authorities. A provider appointing a representative should therefore confirm the mandate in writing, name the natural persons with registration authority, and agree how corrections, updates and authority requests will be handled. A representative without a clear mandate or without access to the underlying classification record cannot maintain an accurate entry.
How does registration link to classification?
Registration cannot be completed honestly without a classification record. The provider must know the system's intended purpose, the Annex III use case considered, the Article 6 conditions applied and, where relevant, the Article 6(3) reasoning and documentation, before deciding which registration limb applies and which Annex VIII information to enter. If classification changes, for example because the intended purpose changes or a new use case is added, the registration position must be revisited and the entry corrected or supplemented. The classification record, the technical documentation and the database entry should describe the same system version and the same intended purpose; divergence between them is a supervision risk even where each document looks complete on its own. A reviewer should be able to move from the entry to the classification reasoning and back without finding a different system described in each place.
What should a provider check before submitting?
Before submitting, a provider should check the system version, the trade name or other identification used in the entry, the intended purpose as stated in the instructions for use, the provider and representative details, and every Annex VIII item for the applicable section. The entry should use neutral, precise wording and should not include material beyond what the Annex requires, since most Article 49 information is publicly accessible. The provider should also confirm the access category: whether the system falls within the secure non-public section under Article 49(4), or whether national registration applies under Article 49(5). Finally, the provider should record who submitted the entry, when, under which specification version and with what authority, and should set a review trigger for the next system change. That submission record is the evidence that registration was done before market placement, and it should be kept with the release record.
Continue with registration after an Article 6(3) conclusion.
What does this guide not decide?
This guide does not decide whether a particular system is high-risk, whether it falls within Annex III point 2, or whether an Article 6(3) conclusion is available on given facts. Those are classification questions that require the consolidated text of Article 6 and Annex III, the system's intended purpose and the evidence for the conclusion to be examined together. The guide also does not advise on the appointment or mandate of an authorised representative for a specific provider, which depends on establishment, the applicable provisions and the commercial arrangement. Where registration timing, route or representative authority is in doubt, confirm the position with a competent authority or legal adviser before the system is placed on the market.
Frequently asked questions
Must registration happen before a system is sold?
Yes. Article 49 requires the provider or authorised representative to register themselves and the system in the EU database before placing it on the market or putting it into service, apart from Annex III point 2 systems, which are registered nationally.
Must a system concluded not to be high-risk still be registered?
Yes, where the conclusion is reached under Article 6(3) for an Annex III system. Article 49(2) requires the provider or authorised representative to register themselves and that system in the EU database.
Who registers when a provider is outside the EU?
Article 49 refers to the provider or, where applicable, the authorised representative. The representative must have legal authority to represent the provider, and the database entry includes the responsible natural persons and their contact details.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk: Article 49 registration ↗AI Act Service Desk implementation timeline ↗