In short
- Article 71(4) of Regulation (EU) 2024/1689 makes everything registered under Article 49 publicly available and machine-readable, except the restricted section for Annex III points 1, 6 and 7.
- A public Annex III entry under Section A of Annex VIII includes a description of the data, inputs and operating logic, a copy of the EU declaration of conformity and the electronic instructions for use.
- Regulation (EU) 2026/1744 deleted points 7 and 9 of Annex VIII Section B, so an Article 6(3) entry no longer carries a summary of the grounds or the list of Member States.
- Public authority deployers register their use under Article 49(3), and their public entry includes a summary of the fundamental rights impact assessment findings.
- For Annex III systems the provider and deployer duties that trigger registration apply from 2 December 2027, and non-compliance with Article 16 is fined up to EUR 15 000 000 or 3% of worldwide turnover.
Registration under the AI Act is not a filing that sits in a regulator’s drawer. It is a public, machine-readable listing under your company’s name, and it names the purpose of the system before the first customer does.
Article 49 of Regulation (EU) 2024/1689 decides who registers, Annex VIII decides which fields, and Article 71(4) decides that almost all of it is visible. Regulation (EU) 2026/1744 trimmed one of those field lists and left the rest intact.
01Who registers, and under which paragraph of Article 49?
Three different parties, with three different field sets.
The provider of a high-risk system listed in Annex III registers itself and the system under Article 49(1), which Article 16(i) turns into a provider obligation. A provider that has concluded under Article 6(3) that its Annex III system is not high risk registers under Article 49(2), a duty repeated in Article 6(4).
A deployer that is a public authority, a Union institution, body, office or agency, or a person acting on their behalf, registers its use of the system under Article 49(3), and Article 26(8) forbids it to use a system the provider never registered.
| Registrant | Provision | Annex VIII fields | Where it lands |
|---|---|---|---|
| Provider, Annex III high-risk system | Art. 49(1), 16(i) | Section A, 13 points | Public database |
| Provider, Article 6(3) not high risk | Art. 49(2), 6(4) | Section B, points 1 to 6 and 8 | Public database |
| Public authority deployer | Art. 49(3), 26(8) | Section C, 5 points | Public database |
| Any of the above, Annex III points 1, 6, 7 | Art. 49(4) | Reduced subset | Secure non-public section |
| Annex III point 2, critical infrastructure | Art. 49(5) | Not specified | National level |
Under Article 71(2) and (3), the provider enters Sections A and B and the public authority deployer enters Section C. A private company that deploys a high-risk system has no Article 49 entry of its own, unless it has modified the system enough to become its provider, which is a different set of duties under Article 25.
02What will competitors and the public see in the EU database?
More than most product teams expect.
Article 71(4) makes information registered under Article 49 accessible and publicly available, easily navigable and machine-readable. The only exceptions are the restricted section in Article 49(4) and real-world testing registrations under Article 60(4)(c). Machine-readable matters: a competitor does not need to browse, it can monitor.
| Field | Annex VIII point | Public entry | Points 1, 6, 7 section | Sensitivity |
|---|---|---|---|---|
| Provider identity and contact details | A1, B1 | Shown | Recorded | Low |
| Intended purpose | A5, B5 | Shown | Recorded | High |
| Data, inputs and operating logic | A6 | Shown | Omitted | High |
| Member States where available | A10 | Shown | Recorded | Medium |
| EU declaration of conformity | A11 | Shown | Omitted | Low |
| Electronic instructions for use | A12 | Shown | Not provided | High |
| Article 6(3) condition relied on | B6 | Shown | Omitted | Medium |
| Summary of FRIA findings | C4 | Shown | Omitted | High |
Point 6 of Section A is the field to draft with a lawyer and a product manager in the same room. It asks for a basic and concise description of the information used by the system and its operating logic, which is enough to describe the approach without disclosing the method. The technical documentation under Article 11 is not part of the entry.
For a public body, point 4 of Section C publishes a summary of the findings of the fundamental rights impact assessment under Article 27, outside the three restricted areas. Write that assessment knowing its conclusions will be read by the people it is about.
03An Article 6(3) entry no longer shows your reasoning, so what does it show?
The condition, not the argument.
Regulation (EU) 2026/1744 deleted points 7 and 9 of Annex VIII Section B. Point 7 was a short summary of the grounds on which the system is considered not high risk; point 9 listed the Member States where it is available. Recital 22 of Regulation (EU) 2026/1744 describes the change as making registration of these systems simpler and more proportionate.
What remains public is the provider, the trade name, the intended purpose, the status and point 6: which of the conditions in Article 6(3) the provider relies on. The full assessment stays on file and goes to national competent authorities on request under Article 6(4). The exemption is still asserted in public, just more briefly, as the analysis of the Article 6(3) exemption explains in detail.
Shorter does not mean unwatched. Article 80(8) lets market surveillance authorities run checks using information stored in the EU database, and Article 80(7) exposes a provider that misclassified a system to circumvent Chapter III, Section 2 to fines under Article 99.
04When does the duty to register actually bite?
Article 49 sits in Chapter III, Section 5. After Regulation (EU) 2026/1744, point (c) of the third paragraph of Article 113 defers Chapter III, Sections 1, 2 and 3 to 2 December 2027 for Annex III systems, and Section 5 is not named there, so it formally follows the general date of 2 August 2026.
The Guardrail reads the practical date as 2 December 2027. Classification under Article 6, the Article 6(4) documentation duty, the provider obligation in Article 16(i) and the deployer obligation in Article 26(8) all sit in Sections 1 and 3. Article 49 registers systems classified by those rules, and it covers Annex III only, so the Annex I date of 2 August 2028 never triggers it.
Two further dates apply. Under Article 111(2) as amended, systems placed on the market before the Chapter III date fall under the Regulation only after significant design changes, but high-risk systems intended for public authorities must comply by 2 August 2030. Under Article 99(4), breaching Article 16 or Article 26 carries fines of up to EUR 15 000 000 or 3% of total worldwide annual turnover, whichever is higher, and Article 99(6) caps SMEs at the lower of the two.
Read together, the deferral of the high-risk dates moved the deadline for registration, not the content of the entry, and the fields in Annex VIII can be drafted now.
05Frequently asked questions
Is the EU AI database public?
Mostly yes. Article 71(4) of Regulation (EU) 2024/1689 makes information registered under Article 49 accessible, publicly available, easily navigable and machine-readable, with the exception of the secure non-public section used for law enforcement, migration, asylum and border control systems under Article 49(4).
Do competitors see how my high-risk system works?
They see a basic and concise description of the data, inputs and operating logic, required by point 6 of Annex VIII Section A. They also see the intended purpose, the declaration of conformity and the electronic instructions for use, but not the technical documentation under Article 11.
Do I have to register a system I classified as not high risk under Article 6(3)?
Yes. Article 6(4) makes the provider subject to the registration obligation in Article 49(2), and registration has to happen before the system is placed on the market or put into service.
Does an Article 6(3) registration still include the reasons for the exemption?
No longer. Regulation (EU) 2026/1744 deleted point 7 of Annex VIII Section B, the short summary of the grounds, so the entry now shows the Article 6(3) condition relied on while the full assessment stays on file for authorities under Article 6(4).
Does a private company that deploys a high-risk system have to register?
Not under Article 49(3). That paragraph covers deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf. A private deployer relies on the provider's Section A entry.
What happens to systems in the law enforcement and migration areas?
They are registered in a secure non-public section. Article 49(4) limits the data to a reduced set of Annex VIII points and gives access only to the Commission and the national authorities referred to in Article 74(8).
06References and method
- Regulation (EU) 2024/1689, Article 6(4), Article 16(i), Article 26(8), Article 49, Article 71, Article 80, Article 99(4) and (6), Article 111(2), Article 113 and Annex VIII. The EUR-Lex page returned a bot check on 25 September 2026, so the operative text was read in the consolidated presentation listed below.
- Regulation (EU) 2026/1744, amending point 42 (deletion of points 7 and 9 of Annex VIII Section B), recital 22 on simplified registration of Article 6(3) systems, and the amendments to Articles 111(2) and 113. Read on 25 September 2026 in the consolidated presentation of the amending act, as the EUR-Lex page returned a bot check.
- Article 49, Article 71 and Annex VIII of Regulation (EU) 2024/1689 in the consolidated presentation, checked in raw HTML on 25 September 2026. Articles 49 and 71 carry no amendment by Regulation (EU) 2026/1744; Annex VIII shows the two deletions in Section B.
- Consolidated presentation of Regulation (EU) 2026/1744, checked on 25 September 2026 for the wording of amending point 42 and of the replaced point (c) of the third paragraph of Article 113.
- Open point: Article 49(4)(b) still refers to point 9 of Annex VIII Section B, which Regulation (EU) 2026/1744 deleted. The Guardrail reads the reference as spent, not as reviving the field.