Art. 49 EU AI Act: Registration in the EU Database for Providers

Updated: June 2026 — full revision to Validai quality standard

Introduction: Public Accountability Through Registration

Article 49 of the EU AI Act establishes the EU database for high-risk AI systems — a public-facing transparency instrument that allows regulators, researchers, and the public to see which high-risk AI systems are deployed in the EU market. Registration is primarily a provider obligation, but deployers have related verification and, in some cases, direct registration duties.

What Is the EU Database?

The EU AI database is a centrally managed, publicly accessible registry of high-risk AI systems. It is maintained by the EU AI Office and includes:

• Provider identification and contact information
• The AI system's name and version
• The Annex III classification category
• Intended purpose and deployment context
• Countries of deployment within the EU
• Link to the EU declaration of conformity
• Post-market monitoring plan summary

The database has a public section (accessible to all) and a restricted section (accessible to market surveillance authorities only, containing confidential technical information).

Provider Registration Obligations Under Art. 49

Art. 49.1 requires providers to register their high-risk AI systems before placing them on the EU market. Key requirements:

• Registration must occur prior to market placement — not after
• Each new version of a high-risk AI system requires a new or updated registration
• Providers outside the EU must designate an EU authorised representative to handle registration
• Registration generates a unique system identifier that must appear on the EU declaration of conformity

Deployer Verification and Due Diligence

For deployers, Art. 49 creates an important due diligence obligation: verify that your high-risk AI provider has fulfilled registration obligations. Steps:

1. Request the EU database registration number from your provider
2. Cross-check the number against the public EU database once operational
3. If the provider cannot provide a registration number, this is a red flag requiring further investigation before deployment
4. Document your verification process

Compliance Checklist

1. Have you requested EU database registration numbers from all high-risk AI providers?
2. Have you verified these numbers against the public database?
3. If you are a deployer with provider-equivalent obligations (provider outside EU): have you registered?
4. Are registration numbers retained in your AI system inventory?