AI Act Article 49: Registration

What this article means in practice

Written by Engage Compliance. The text above is the article itself, reproduced from its official source and unchanged. Everything in this section is ours, and last read against the current text on 2026-09-07.

Article 49 is the EU database registration, and it is where the authorised representative appears as an alternative to the provider. Two things surprise readers: a provider that concludes its Annex III system is NOT high-risk still has to register under Article 49(2), and law enforcement, migration and border systems register in a secure non-public section rather than the open one.

Who it binds

• Providers, or where applicable their authorised representative, of a high-risk system listed in Annex III, before placing it on the market or putting it into service (Article 49(1)). Annex III point 2 is excluded from this route and registers nationally instead (Article 49(5)).
• Providers, or their authorised representative, who have concluded under Article 6(3) that an Annex III system is NOT high-risk (Article 49(2)). Deciding you are out of the high-risk regime therefore puts you into the registration one.
• Deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf, who register themselves and their use of the system (Article 49(3)).
• It does not bind private deployers. Article 49(3) is written for public bodies only.

What it makes somebody do

• You or your authorised representative. Register yourselves and the system in the EU database referred to in Article 71, BEFORE placing on the market or putting into service (Article 49(1)).
• You or your authorised representative. Register yourselves and the system where you have concluded under Article 6(3) that it is not high-risk (Article 49(2)).
• You, for the sensitive areas. Register in the secure non-public section for Annex III points 1, 6 and 7, covering law enforcement, migration, asylum and border control, and only the reduced information set listed in Article 49(4)(a) to (d) (Article 49(4)). Only the Commission and the Article 74(8) national authorities can see it.
• The authorised representative. Comply with the Article 49(1) registration obligations, or where the provider registers itself, ensure the Annex VIII Section A point 3 information is correct. That is Article 22(3)(e), which points here.

What it does not say

• It is not an approval. Registration is a filing in the Article 71 database, and nothing in Article 49 makes placing on the market conditional on a decision by anybody.
• Concluding your system is not high-risk does not take you out of Article 49. Article 49(2) is the registration route for exactly that conclusion, and Article 6(4) adds the documentation duty alongside it.
• It is not always public. Article 49(4) puts the law enforcement, migration and border categories in a restricted section with a reduced information set.
• It does not cover every Annex III system through the EU database. Point 2 systems register at national level under Article 49(5).
• The representative is an ALTERNATIVE, not an addition. Article 49(1) and (2) both say the provider or, where applicable, the authorised representative, so one registration is made rather than two.

How it sits beside the other mandates

• Article 22(3)(e) is the provision that puts part of this on the authorised representative, so a third-country provider's registration duty and its appointment duty are connected rather than parallel.
• Article 6(3) and 6(4) are upstream. The derogation decides which of the two registration routes you take, and both of them are registration.
• Article 71 is the database itself. Article 49 says what goes in it and who can see which part; Article 71 is what it is.