What obligations does the authorised representative, the provider of an AI system and the body governed by public law have under Article 49 of the AI Act?

Question

Article 49 of the AI Act covers registration in the EU database before the system reaches the market. The provider of a high-risk AI system listed in Annex III, or where applicable its authorised representative, registers itself and that system in the EU database before it is placed on the market or put into service. The same duty applies to the provider that concludes under Article 6(3) that its Annex III system is precisely not high-risk: that provider too registers itself and that system. The deployer that is a public authority or a Union body, or that acts on behalf of such an authority, registers itself, selects the system and registers its use. For the areas of law enforcement, migration, asylum and border control management the registration goes into a secure non-public section with fewer fields, to which only the Commission and the national authorities referred to in Article 74(8) have access. For the systems in point 2 of Annex III registration does not run through the EU database but at national level. The duty sits with the authorised representative, the provider of an AI system and the body governed by public law. This obligation has applied since 2 August 2026.

Accepted Answer

Your question is about Article 49: registration in the EU database before the system reaches the market. That obligation applies today. The provision itself applies then, but it only acquires an object once a high-risk AI system exists; through Annex III that is from 2 December 2027. Whether your system actually falls under it depends on conditions you assess yourself. Article 49 of the AI Act covers registration in the EU database before the system reaches the market. The provider of a high-risk AI system listed in Annex III, or where applicable its authorised representative, registers itself and that system in the EU database before it is placed on the market or put into service. The same duty applies to the provider that concludes under Article 6(3) that its Annex III system is precisely not high-risk: that provider too registers itself and that system. The deployer that is a public authority or a Union body, or that acts on behalf of such an authority, registers itself, selects the system and registers its use. For the areas of law enforcement, migration, asylum and border control management the registration goes into a secure non-public section with fewer fields, to which only the Commission and the national authorities referred to in Article 74(8) have access. For the systems in point 2 of Annex III registration does not run through the EU database but at national level. The duty sits with the authorised representative, the provider of an AI system and the body governed by public law. This obligation has applied since 2 August 2026. Still to determine: Paragraph 4 does not except the registration but relocates it: for the systems referred to in points 1, 6 and 7 of Annex III in the areas of law enforcement, migration, asylum and border control management, the registration referred to in paragraphs 1, 2 and 3 goes into a secure non-public section of the EU database, with a limited list of fields from Annex VIII and Annex IX, and only the Commission and the national authorities referred to in Article 74(8) have access to it. Applies where a provider or, where applicable, an authorised representative places on the market or puts into service a high-risk AI system listed in Annex III, and where that same party places on the market or puts into service an AI system for which it has concluded that it is not high-risk according to Article 6(3). Applies where a deployer that is a public authority, Union institution, body, office or agency, or a person acting on their behalf, puts into service or uses a high-risk AI system listed in Annex III. Registration is a precondition and not a notification afterwards: paragraphs 1 and 2 attach to the moment before the system is placed on the market or put into service, paragraph 3 to the moment before it is put into service or used. This is an exception to the route and not to the duty. Paragraphs 1 and 3 except the high-risk AI systems referred to in point 2 of Annex III from registration in the EU database, and paragraph 5 provides that those systems are registered at national level. For critical infrastructure the registration therefore does not fall away: it runs through the national register rather than through the Article 71 EU database. First step: Register yourself and the system before it reaches the market or is put into service. Relevant provisions: Article 49: registration in the EU database before the system reaches the market. First actions: Register yourself and the system before it reaches the market or is put into service. Determine per system which of the four Article 49 routes applies, the ordinary Annex III route, the Article 6(3) route, the secure section for law enforcement, migration, asylum and border control management, or the national route for point 2 of Annex III, and complete the registration before the system is placed on the market, put into service or used. To record: Article 49 registration dossier.

What obligations does the authorised representative, the provider of an AI system and the body governed by public law have under Article 49 of the AI Act?

This applies now

Your first actions

Record this

Source and locator

Record role and classification for each AI system

Zahed Ashkara