EU database registration under Article 49 after the Omnibus: who registers what
Art. 49 of Regulation (EU) 2024/1689 sets three registration duties in the EU database under Art. 71: the provider of an Annex III high-risk system, the provider that concludes under Art. 6(3) that an Annex III system is not high-risk, and the deployer that is a public authority. Regulation (EU) 2026/1744 kept all three and shortened the Annex VIII Section B data set from the date in the regulation data Working reading. The provider prepares the Art. 6(4) assessment record and the data set before placing the system on the market.
What the source says
Art. 49(1) requires the provider, or where applicable the authorised representative, to register itself and the system in the EU database before placing an Annex III high-risk system on the market or putting it into service. Annex III point 2, critical infrastructure, is excepted: Art. 49(5) sends those systems to registration at national level. The data set is Annex VIII Section A: provider identity, the submitter and the authorised representative where applicable, trade name and identification reference, intended purpose, a basic and concise description of the information used by the system and its operating logic, status, the certificate and the notified body where one exists, the Member States concerned, the EU declaration of conformity and the electronic instructions for use. Art. 49(4) places systems in Annex III points 1, 6 and 7 in law enforcement, migration, asylum and border control in a secure non-public section that only the Commission and the authorities under Art. 74(8) can read.
Art. 49(2) requires a provider that concludes under Art. 6(3) that an Annex III system is not high-risk to register itself and the system before placing on the market or putting into service. Art. 6(4), unchanged by the Omnibus, ties the two duties together: the provider documents the assessment before that point and is subject to the registration obligation in Art. 49(2). Regulation (EU) 2026/1744 deleted Annex VIII Section B point 7, the summary of the grounds for the not-high-risk conclusion, and point 9, the Member States where the system is placed on the market. Points 1 to 6 and 8 remain, and point 6 still asks for "the condition or conditions under Article 6(3) based on which the AI system is considered to be not-high-risk". The provider still names the condition in public; the reasoning behind it stays in the Art. 6(4) record.
Art. 49(3) requires a deployer that is a public authority, agency or body, or acts on its behalf, to register itself, select the system and register its use before putting an Annex III system into service. Annex VIII Section C asks for the deployer identity, the URL of the provider's entry, a summary of the findings of the fundamental rights impact assessment under Art. 27 and a summary of the data protection impact assessment where one was carried out. Art. 26(8) adds a stop rule: where such a deployer finds that the system is not in the database, it does not use the system and informs the provider or the distributor. Art. 71(2) and 71(3) assign the data entry to the provider for Sections A and B and to the deployer for Section C. Art. 71(4) makes the registered information publicly accessible, with the exception of the Art. 49(4) section and the real-world testing information under Art. 60(4), point (c).
| Who registers | Article | Data set | Trigger |
|---|---|---|---|
| Provider of an Annex III high-risk system, except point 2 | Art. 49(1), Art. 71(2) | Annex VIII Section A, points 1 to 13 | Before placing on the market or putting into service |
| Provider that concludes not high-risk under Art. 6(3) | Art. 49(2), Art. 6(4) | Annex VIII Section B, points 1 to 6 and 8; points 7 and 9 deleted Working reading | Before placing on the market or putting into service |
| Deployer that is a public authority, or acts on its behalf | Art. 49(3), Art. 26(8), Art. 71(3) | Annex VIII Section C, points 1 to 5 | Before putting into service |
| Provider or deployer of Annex III point 1, 6 or 7 systems in law enforcement, migration, asylum or border control | Art. 49(4) | Sections A, B or C with the points Art. 49(4) excepts, in the secure non-public section | Same triggers as above |
| Provider of an Annex III point 2 system | Art. 49(5) | National register set by the Member State | National rule |
The application date of the Art. 49(2) duty is unsettled. The Annex III high-risk obligations, which include the Art. 6(2) classification and the Art. 6(3) derogation, apply from Deferred, while Art. 49 sits in Chapter III Section 5 and follows the general application date.
What changes for a provider or deployer
For a provider, the evidence behind an Art. 49(2) entry is the Art. 6(4) assessment record. Section B point 6 asks only for the condition; a market surveillance authority acting under Art. 74(12) and Art. 79 can ask for the reasoning that the deleted point 7 used to summarise. The Commission's draft guidelines on high-risk classification Commission guidelines on high-risk classificationDraft describe the Art. 6(4) duties as serving the traceability of exempted systems and encourage deployers to verify the exception in the database. The classification guidelines guide walks through the four Art. 6(3) conditions and the profiling rule that removes the derogation.
AIAssuranceLabs tests against Art. 6(3), Art. 6(4) and Art. 49(2) within the limits at what we cannot do; the classification decision and the registration are the provider's acts. PR-CLS v1.0 tests each Annex III match against the four Art. 6(3) conditions, checks the profiling rule, checks that the assessment was documented before placing on the market, and compares the draft database entry with Annex VIII Section B points 1 to 6 and 8, one row per point. The output is the Article 6(3) assessment record, delivered as the classification memo in the classification and readiness assessment and specified as the assessment memo. The obligation register from the same protocol carries the registration duty under both readings of its application date, and the not-high-risk decision scenario gives the sequence from Annex III match to database entry.
For a high-risk system, Section A point 11 asks for the EU declaration of conformity, which rests on the Chapter III Section 2 requirements from Art. 9 onwards; the Art. 9 obligation page carries the same unsettled caveat for the Art. 6(3) route. For a deployer that is a public authority, Art. 26(8) makes the registration check a precondition of first use; the Art. 26 obligation page lists the check as a process element and the registration record as a documentation element.
What to do now
- Determine the role and the Annex III match for each system under Art. 6(2), then test each match against the four Art. 6(3) conditions and the profiling rule in Art. 6(3) third subparagraph.
- Where a not-high-risk conclusion is claimed, write the Art. 6(4) assessment record before placing on the market and keep the reasoning that the deleted Annex VIII Section B point 7 used to summarise, for an Art. 74(12) request.
- Draft the Annex VIII Section B entry with points 1 to 6 and 8, and name the Art. 6(3) condition relied on in point 6.
- For a high-risk system, assemble the Section A set before Art. 49(1) registration: certificate and notified body where one exists, EU declaration of conformity, electronic instructions for use, and the description of data and operating logic in point 6.
- For a deployer that is a public authority, check the provider's entry under Art. 26(8) before first use and assemble the Section C set, including the Art. 27 summary.
- Record the Art. 49(2) duty in the obligation register under both readings of the application date, with the regulation entry id rather than a typed date.
Related pages
The obligation pages, the protocol, the guide and the service below carry the detail for each step above.
- Protocols
- ICP hubs
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.