Annex VIII sets the information to be submitted on registration of high-risk AI systems listed in Annex III. Section A concerns the provider, Section B concerns the system, and Section C concerns the deployer where the deployer is a public authority or Union body. Providers or authorised representatives enter Sections A and B, and specified deployers enter Section C. The restricted section under Article 49(4) includes only specified points from those sections together with specified Annex IX points. The exact item list in the consolidated Annex VIII, as amended by Regulation (EU) 2026/1744, is the checklist to work from at the time of registration.
How is Annex VIII organised?
Annex VIII is organised into three sections that follow the operator and system structure of the Act. Section A lists information about the provider, including identification and contact details and the information needed to identify the person responsible for registration. Section B lists information about the high-risk AI system itself, including its identification, intended purpose and the information that allows the system to be distinguished from other systems and versions. Section C lists information about the deployer and its use, for the public-authority and Union-body deployers covered by Article 49(3). That three-part structure is why a registration entry should never be prepared by one team alone: provider identity, system description and deployment use are owned by different people, and each section needs its owner to confirm accuracy before submission. The consolidated Annex VIII should be worked through section by section, with each item ticked against its source document.
What does Section A cover?
Section A covers the provider side of the entry: the name and contact details of the provider or authorised representative, the information identifying the natural persons responsible for registration who have legal authority to represent the provider, and the related identification details the Annex specifies. Accuracy here matters for supervision, because an authority that needs to contact a provider about a system, a serious incident or a corrective action will start from the Section A details. A provider should therefore enter the legal name, the correct contact route and the named registrants with authority, and should update the entry when the provider, the representative or the registrant changes. Using a generic mailbox with no named owner, or a trading name that does not identify the legal provider, weakens the entry and can delay a supervisory contact that the system owner would want to receive promptly.
For the broader regulatory framework, see EU database, registration and post-market monitoring.
What does Section B cover?
Section B covers the system side of the entry: the information that identifies the system, describes its intended purpose, and records the classification and conformity information the Annex requires for the category concerned. The intended purpose as stated in the entry must match the intended purpose in the instructions for use and in the technical documentation, because a deployer or authority reading the entry will rely on it to understand what the system is for. The entry should identify the system version, so that a later version is not confused with the registered one, and should record the information the Annex requires about the system's status and market placement. Where Regulation (EU) 2026/1744 removed items from Section B for the Article 6(3) category, the entry for that category should follow the amended list, while the internal assessment documentation should remain complete. The Annex, not a template from before the amendment, is the source to check.
What does Section C cover?
Section C covers the deployer side of the entry for deployers covered by Article 49(3): the deployer's identification and contact details and the information about its use of the selected system. Section C is entered by the deployer, not by the provider, and it links the use to the provider's system entry. A deployer preparing Section C should confirm the system identification, the deployment context and the contact route for the deployer's own organisation, and should record who in the deployer organisation owns the entry. Because Section C information for sensitive systems is limited by Article 49(4) to specified points only, a deployer in a restricted category must enter only those points. A Section C entry should never contain operational detail beyond what the Annex requires, and it should be reviewed when the deployment, the responsible team or the use changes.
How should an entry be prepared in practice?
Preparation should start from the consolidated Annex VIII, not from a previous entry or a vendor template. The team should copy the applicable section items into a working checklist, assign each item an owner and a source document, and confirm that the source describes the same system version and intended purpose as the entry will. Draft wording should be neutral and factual, avoiding marketing claims, performance promises and material beyond the Annex. The draft should then be reviewed by the classification owner, the technical documentation owner and the registrant, and the review should be recorded with names and dates. Only after that review should the entry be submitted, and the submission record should note the specification version used and the date. That discipline takes longer than copying a previous entry, but it produces an entry that can be defended if an authority asks how each item was verified.
Continue with registration duties for providers under Article 49.
What does this guide not decide?
This guide does not reproduce the full item-by-item text of Annex VIII, does not state which items apply to a particular system, and does not decide whether an entry belongs in Section B or in the restricted subset of items. The applicable items depend on the system's category, the operator role and the amended Annex text, and they must be checked in the consolidated Regulation at the time of registration. The guide also does not cover Annex IX testing information in full, which is addressed in the guide on testing in real world conditions. Where the item list for a category is unclear, confirm it with a competent authority or legal adviser before submitting, and keep the Annex version checked with the submission record.
Frequently asked questions
Who enters Section C of Annex VIII?
The deployer who is, or who acts on behalf of, a public authority, agency or body enters Section C, in accordance with Article 49(3) and Article 71(3). Providers enter Sections A and B.
Should an entry include more than Annex VIII requires?
No. Entries should follow the Annex items for the applicable category, using precise and neutral wording. Most Article 49 information is public, so additional detail cannot be treated as confidential once entered.
Did Regulation (EU) 2026/1744 change Annex VIII?
Yes, in defined respects, including removing specified items from the registration information for systems relying on Article 6(3). The consolidated Annex VIII should be checked at the time of registration, and templates should be updated to the amended list.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk: Article 49 registration ↗AI Act Service Desk implementation timeline ↗