What Is the EU Database for High-Risk AI Systems?

What is the EU database for?

The EU database is a single Union-level record that makes the presence of specified high-risk AI systems visible to the Commission, to Member States and, in most cases, to the public. It is set up and maintained by the Commission in collaboration with the Member States, and it contains the information entered under Article 49 for registered systems together with information about testing in real world conditions under Article 60. Its purpose is practical: it supports supervision by market surveillance authorities, helps the Commission and Member States monitor uptake, and gives researchers, deployers and members of the public a way to check what has been registered. It is not a product catalogue, a certification list or a quality mark. A system appearing in the database has been registered; whether it meets the substantive requirements of the Act is a separate question answered by conformity, documentation and supervision, not by the existence of a database entry alone.

Which systems are registered in the EU database?

Registration in the EU database concerns high-risk AI systems referred to in Article 6(2) and listed in Annex III, together with AI systems that a provider has concluded are not high-risk under Article 6(3) and that are registered following that conclusion. Providers or, where applicable, their authorised representatives register themselves and the system before placing it on the market or putting it into service, with the exception of systems listed in Annex III point 2, which are registered at national level. Deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf, register themselves, select the system and register its use before putting it into service or using it. Systems that follow the Annex I product route are not registered in the EU database in the same way, and a classification decision should therefore be recorded before anyone assumes a database duty exists or does not exist.

For the broader regulatory framework, see EU database, registration and post-market monitoring.

Who enters what into the database?

The division of entry work follows the operator role. The provider or authorised representative enters the data listed in Sections A and B of Annex VIII, which concern the provider and the system. The deployer who is or acts on behalf of a public authority, agency or body enters the data listed in Section C of Annex VIII, which concerns the deployer's use. For testing in real world conditions under Article 60, the information listed in Annex IX is entered instead, and that information is subject to its own access rules. The database contains personal data only so far as necessary for collecting and processing information under the Regulation, including the names and contact details of natural persons responsible for registering the system who have legal authority to represent the provider or deployer. Each entry should therefore be owned by a named person who can correct it, and the underlying classification and version should be kept with the entry.

What is public and what is restricted?

With the exception of the secure section for defined sensitive systems and the Article 60 testing information, information contained in the EU database and registered under Article 49 is accessible and publicly available in a user-friendly manner, and should be easily navigable and machine-readable. The secure non-public section covers registration for high-risk systems in Annex III points 1, 6 and 7 in the areas of law enforcement, migration, asylum and border control management, and only the Commission and the national authorities referred to in Article 74(8) have access to those restricted sections. Information registered under Article 60 is accessible only to market surveillance authorities and the Commission, unless the prospective provider or provider has given consent for it also to be made accessible to the public. A team should therefore check the access rule for its own category before assuming an entry will be public, and should never enter more detail than the Annex requires.

How does registration connect to monitoring and reporting?

Registration is the starting record for a longer supervision story. Once a high-risk system is on the market or in service, the provider's post-market monitoring system under Article 72 collects and analyses performance data throughout the system's lifetime, and serious incidents must be reported under Article 73. A registration entry that is never updated, or a monitoring system that never feeds back into risk management, documentation and registration, leaves the supervision record frozen at the point of market entry. The practical connection is therefore one of maintenance: changes to the system, its intended purpose or its deployer use should trigger a check of whether the database entry, the technical documentation and the monitoring plan still describe the same system. Keeping those three records aligned is what allows an authority, a deployer or a reviewer to trace a system from registration through operation to any corrective action.

Continue with what the EU database contains and who can access it.

What does this guide not decide?

This overview does not decide whether a particular system must be registered, whether it is high-risk, or whether its entry belongs in the public or the restricted section. Those conclusions depend on the system's intended purpose, its Annex III category, any Article 6(3) conclusion, the operator role and the deployment context, and they require the text of Articles 49 and 71 and Annexes VIII and IX to be checked for the specific case. The guide also does not describe the database user interface or submission mechanics, which are matters for the Commission's operational material at the time of registration. Where registration, access or supervision is in issue, confirm the position with a competent authority or legal adviser, and keep the classification reasoning and the entry details with the system's compliance record.

Frequently asked questions

Continue through this AI Act cluster

• EU database, registration and post-market monitoring
• what the EU database contains and who can access it
• registration duties for providers under Article 49
• post-market monitoring under Article 72
• serious incident reporting under Article 73
• high-risk AI systems