Register a high-risk AI system, or an Article 6(3) derogation claim, in the EU database under AI Act Articles 49 and 71

Documented steps

1. Identify which registration duty applies: Article 49(1) for providers or authorised representatives of Annex III high-risk systems; Article 49(2) for providers claiming the Article 6(3) derogation; Article 49(3) for deployers that are public authorities, Union institutions, bodies, offices or agencies, or parties acting on their behalf. Text: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-49
2. For Article 49(1), register before placing on the market or putting into service, entering the Annex VIII Section A fields: provider and authorised representative identity, system identification, intended purpose, description of the information used by the system, market status, notified body certificate details with a scanned copy where applicable, Member States of deployment, a copy of the EU declaration of conformity, and electronic instructions for use. Annex VIII: https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-8
3. For Article 49(2), register the derogated system before market placement under Annex VIII Section B: provider identity, system identification and intended purpose, the specific Article 6(3) condition relied on, a summary of the justification, status, and Member States of deployment.
4. For Article 49(3), complete the Article 27 fundamental rights impact assessment FIRST, because Annex VIII Section C requires a summary of its findings, then register deployer contact details, a reference to the provider's database entry, and a data protection impact assessment summary where applicable.
5. Submit through the EU database that the Commission establishes and maintains in collaboration with Member States under Article 71. Confirm the current submission channel from https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-71 rather than from any third-party link.
6. Understand the visibility split: under Article 71(4) most Annex VIII information is publicly accessible, but the Article 49(4) subset covering Annex III points 1, 6 and 7 (biometrics, law enforcement, and migration, asylum and border control) sits in a secure non-public section accessible only to the Commission and the relevant national authorities.
7. Limit personal data entered to what Article 71(5) permits — essentially contact details necessary for identification. The Commission is the controller of the database under Article 71(6).
8. Keep the entry current: status is a mandatory field, so update on withdrawal, recall, or substantial modification under Article 43(4).
9. Check whether the AI Omnibus's streamlining of registration content applies to you, in particular the simplifications for derogated systems and for SMEs and small mid-cap companies. Amending text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202601744
10. Diary the applicable date. The AI Omnibus amending regulation entered into force 27 July 2026 (OJ reference OJ:L_202601744, full text https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ%3AL_202601744). Per the Commission's official FAQ (https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act), it postponed the high-risk rules of Chapter III to 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products (Annex I). Confirm the section-level scope of the postponement against the amended Article 113 text in the OJ before setting any internal deadline.