Under Article 49, providers must register themselves and high-risk AI systems in the EU database before the system is placed on the market or put into service, with the information Annex VIII requires, and deployers in certain cases must register their use. Registration follows the conformity assessment and declaration, records the system and the provider in a public database, and must be kept up to date where the registered information changes. The database entry does not replace the declaration or the CE marking, and it must match them.
What must be registered?
Registration covers the provider and the high-risk AI system, with the information set out in Annex VIII, including, in outline, the provider's identity and contact details, the system's name, type, intended purpose, and status, and information on the conformity assessment and declaration. The exact fields should be checked against Annex VIII in the consolidated text and against the database interface in use at the time of registration. The entry should describe the system version that was assessed, with the same identifiers used in the declaration and technical documentation, so that the three records can be matched. A registration entry that uses a different name, version, or purpose from the declaration creates a mismatch that undermines the traceability the database is meant to provide.
When must registration happen?
Provider registration must happen before the high-risk system is placed on the market or put into service, after the conformity assessment and declaration. That timing means registration is part of the market-access sequence, not an administrative step that can be completed after launch. The provider should plan the registration as a release gate, with a named owner, a check that the declaration and marking are ready, and a record of the registration date and reference. Where a system is modified and a new assessment is carried out, the registration should be updated to reflect the new version and the new conformity outcome. A system launched without registration, where registration is required, has missed a precondition for market access, even if the underlying system meets the substantive requirements.
For the broader regulatory framework, see Conformity assessment and CE marking overview.
Who registers, and what do deployers register?
Providers register themselves and their high-risk systems under Article 49, while deployers who are public authorities or certain other deployers must register their use of high-risk systems in the database, with the information Annex VIII requires for deployer registration. The deployer entry records the use, the deployer, and the system, and is distinct from the provider entry for the system itself. Both entries should use consistent identifiers for the system, so that the provider entry and the deployer entries for the same system can be linked. Teams should agree, in the supply and deployment arrangements, who will make each entry, when, and how the other party will be told that the entry has been made, so that neither entry is assumed to have been made by the other side.
How does the database entry relate to the declaration?
The database entry, the declaration of conformity, and the CE marking form a linked set of market-access records. The declaration states conformity, the marking indicates it on the system, and the database entry records the system and provider publicly, with the information that allows a reader to identify the system and its conformity status. The three records must agree on the system identity, version, intended purpose, provider, and conformity outcome. A discrepancy between them, for example a database entry that describes a different version from the declaration, should be treated as a finding to be corrected promptly, with the correction recorded. The provider should check the three records together before release, and again after any change, as a final release gate.
How are registration entries kept current?
Registration entries must be kept up to date where the registered information changes, including a change in provider details, system version, intended purpose, or conformity status. The provider should assign an owner for the entry, set review triggers tied to change management, and record each update with its date and reason. Where a system is withdrawn or its conformity status changes, the entry should be updated or removed as the database rules provide, with the history retained in the provider's own file. An entry that is left unchanged after a material change misleads readers of the public database and breaks the link to the current declaration. The update log should be kept with the conformity file, so that the public record and the internal record can be reconciled.
Continue with EU database and registration overview.
What does this guide not decide?
This guide does not decide whether a particular system must be registered, what fields its entry must contain, whether an entry is accurate, or whether a deployer registration is required for a specific use. It does not assess a database entry or a declaration. Those questions depend on the system, the Annex VIII fields, the database rules in force, and the consolidated legal text, including the treatment of systems that are not high-risk under Article 6(3) and of critical infrastructure systems registered at national level. A provider or deployer should check the current database requirements, confirm its registration position with a competent authority or legal adviser, and keep the entry matched to the declaration and marking.
Frequently asked questions
Is registration the same as conformity assessment?
No. Conformity assessment tests whether the system meets the requirements, the declaration states the outcome, CE marking indicates it, and registration records the system and provider in the EU database. Registration follows assessment and declaration and must match them, but it does not replace either step.
Must deployers register their use?
Certain deployers, including public authorities and deployers in the cases Article 49 sets out, must register their use of high-risk systems, with the Annex VIII information for deployer registration. The position for a specific deployment should be checked against the consolidated Article 49 text.
What if registered information changes?
Update the entry promptly, record the date and reason, and check that the declaration and marking still match the updated entry. The update should be treated as part of change management, with an owner and a review trigger, rather than left until the next release.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗Commission AI Act Service Desk timeline ↗European Commission AI Act overview ↗