Binds: Provider (conformity)
All obligations
EU AI Act Art.49: Registration
Article 49 of the EU AI Act binds the provider (conformity). It requires Before placing on the market or putting into service an Annex III high-risk AI system other than one listed under. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.49 |
| Binds | Provider (conformity) |
| Group | Notified Bodies, Standards and Conformity Assessment |
| Evidence items | 5 |
| Linked NIST AI RMF controls | 1 |
| Linked ISO/IEC 42001 controls | 2 |
| Last updated |
Who does Art.49 bind?
The article binds the provider (conformity). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.49 require?
Before placing on the market or putting into service an Annex III high-risk AI system other than one listed under Annex III point 2, the provider or, where applicable, the authorised representative must register itself and the system in the EU database. The same duty applies before placing on the market or putting into service an AI system that the provider has concluded is not high-risk under Art.6(3). Deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf, must register themselves, select the system and register its use before putting the system into service or using it. For Annex III points 1, 6 and 7 systems in law enforcement, migration, asylum and border control management, registration goes into the secure non-public section of the database and is limited to the listed Annex VIII and Annex IX items. Annex III point 2 systems are registered at national level.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.49 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.49?
| Category | Evidence to keep |
|---|---|
| Registration | Registration confirmations for the operator and for each system, dated before placing on the market or putting into service |
| Registration | Registration of the not-high-risk conclusion where the Art.6(3) derogation was relied on |
| Registration | Public authority deployer registrations recording the selection of the system and the registration of its use |
| Registration | Evidence that law enforcement, migration, asylum and border control registrations were made in the secure non-public section with only the permitted fields |
| Registration | National level registration evidence for Annex III point 2 systems |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.49?
1 control in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-GV-1.6 | Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities Registering each system in the EU database before market placement is a maintained AI system inventory. | high |
Which ISO/IEC 42001 controls line up with Art.49?
2 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.6.2.5 | AI system deployment Registration in the EU database is required before putting the system into service. | medium |
A.8.5 | Information for interested parties Registration publishes system information in the EU database. | medium |
What does the conformance kit add for Art.49?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.