Article 49: Registration

Register yourself and the system in the EU database before placing an Annex III high-risk system on the market or putting it into service, except for point 2. A system assessed as not high-risk under Article 6(3) remains subject to registration under Article 49(2). For that route, Regulation (EU) 2026/1744 deleted only two information fields from Annex VIII, not the registration itself.

The duty in Article 49(3) does not apply to every private deployer. It applies to public authorities, Union institutions, bodies, offices and agencies, and persons acting on their behalf. Before using an Annex III system, except point 2, they register themselves, select the system and register its use.

An SME may have to register as a provider, including when it applies the Article 6(3) filter. A private SME deployer does not have to register its use under Article 49(3) merely because it is a deployer. Check whether changes, own branding or a new intended purpose make the SME a provider.

Before first use, verify that the provider registration exists and register your use where Article 49(3) applies. Systems under Annex III point 2 are registered nationally. Registrations for certain biometric, law enforcement and migration systems go into a secure, non-public section of the EU database.

Providers or authorised representatives register themselves and an Annex III high-risk system in the EU database before placing it on the market or putting it into service. Annex III point 2 follows a national registration route.

Not every deployer. Article 49(3) applies to public authorities, Union institutions, bodies, offices and agencies, and persons acting on their behalf. A private deployer is not subject to paragraph 3 merely because it is a deployer.

Article 49 of the AI Act does not provide a general exemption for SMEs. However, the AI Act includes supportive measures and potentially lighter obligations for small and medium-sized enterprises, depending on their role in the AI value chain.

Article 49 of the AI Act complements the GDPR. While the GDPR protects personal data, the AI Act focuses on the safety and trustworthiness of AI systems. Organisations must comply with both regulations when their AI system processes personal data.

Article 49 has applied as a provision since 2 August 2026, but actual registration assumes an applicable classification route. For Article 6(2) and Annex III, that core route applies from 2 December 2027.

Yes, Article 49 of the AI Act may also be relevant when you purchase AI systems. As a deployer, you have your own obligations under the AI Act, regardless of whether you developed the system yourself or purchased it from a provider.

Under Article 49 of the AI Act, the provider is the entity that develops or places the AI system on the market, while the deployer is the entity that uses the system under its own authority. Both roles carry different obligations.

Registration contains the applicable information from Annex VIII. For an Article 6(3) assessment, registration under paragraph 2 remains required; Regulation (EU) 2026/1744 deleted only points 7 and 9 from Annex VIII, Section B.