EU AI Act Art. 49 — Registration
Article 49 requires providers to register high-risk AI systems in the EU database before placing them on the market — with a secure, non-public section for law-enforcement, migration, and border-control systems.
At a glance
What this article requires
- Providers (or their authorised representatives) register the system in the EU database before placing it on the market or putting it into service.
- Public authorities deploying high-risk AI also register — including law enforcement, migration, and border control, in a secure, non-public section.
- Registration data follows Annex VIII (provider identity, system details, intended purpose, conformity information).
- Registration is a precondition of market placement, alongside conformity assessment and CE marking.
Scope
Who this applies to
Providers of high-risk AI, and public authorities that deploy high-risk AI in the listed sensitive areas.
Obligations
What you must actually do
Register before launch
Complete the EU database entry before the system reaches the market, and keep it updated after substantial changes.
Use the right section
Sensitive systems (law enforcement, migration, border control) go in the restricted section accessible only to the Commission and market surveillance authorities.
Keep Annex VIII data accurate
The database entry must match your technical documentation — discrepancies surface in checks.
Action plan
Practical first steps
- 1
Confirm the EU database is accepting registrations in your sector before your go-live date.
- 2
Draft the Annex VIII data fields early and review them in the conformity assessment.
- 3
Set a reminder to update the record whenever the system's intended purpose or provider identity changes.
Penalty exposure
Registration failures sit in the general tier: up to €15 million or 3% of global annual turnover.
FAQ
Questions about Art. 49
Do deployers ever have to register?
Yes — public authorities deploying high-risk AI in areas such as law enforcement, migration, asylum, and border control must register in the secure section. Private deployers generally do not register; their providers do.
Is the EU database public?
Partly. The EU database (Art. 71) gives public access to most registered data; law-enforcement, migration, and border-control registrations sit in a restricted section.
Sources
Citations & further reading
Related
More article explainers
Wondering which articles apply to your AI?
Describe your system in the free Risk Scanner and get a preliminary risk read with the obligations that likely apply — in seconds.
Check my use casePreliminary EU AI Act clarity summary. Not legal advice.