The EU AI Database: What to Register, When, and to Whom

Most AI Act obligations are internal. You document, you assess, you monitor, and the evidence sits in your files until someone asks for it. Registration is different, because it is public. High-risk systems go into the EU database under Article 71, and the entry can be seen.

That visibility changes the risk profile. A missing or out-of-date registration is one of the easiest things for a market surveillance authority to notice, because it does not require an investigation, only a look at the register. Compliance here is exposed in a way most of the Act is not.

The first question is who registers. The duty falls on providers of high-risk systems, and in defined cases on deployers, particularly public authorities. Knowing which role you occupy for each system is the precondition for everything that follows, and organisations often hold both roles across different systems.

The second is what triggers the obligation. Placing a high-risk system on the market or putting it into service is the core trigger, with specific arrangements for certain categories. Getting the trigger point right matters, because the deadline runs from it.

Then there is the content. Annex VIII sets out the data you must supply, and it is more than a name and a contact. It reaches into the system's purpose, its status, and the information that lets an authority and the public understand what the system is and who stands behind it.

Registration is not a one-time act, either. The entry has to be kept accurate over the system's life, so material changes mean updates. A register that reflects last year's system is a compliance gap hiding in plain sight.

Sanctions sit behind all of this, and enforcement runs through national bodies across all twenty-seven Member States, coordinated at EU level. The practical steps are straightforward to list and harder to sustain: confirm your role, identify the trigger, assemble the Annex VIII data, register on time, and maintain the entry.

Our whitepaper, EU AI Database Registration, takes each of these in turn, including the full Annex VIII requirements and the deadlines. Because this obligation is public, it is worth getting right the first time.