Annex VIII AI Act
Information to be submitted upon registration of high-risk AI systems
Official text
Information to be submitted upon the registration of high-risk AI systems in accordance with Article 49 Section A — Information to be submitted by providers of high-risk AI systems in accordance with Article 49(1) The following information shall be provided and thereafter kept up to date with regard to high-risk AI systems to be registered in accordance with Article 49(1):
1. The name, address and contact details of the provider;
2. Where submission of information is carried out by another person on behalf of the provider, the name, address and contact details of that person;
3. The name, address and contact details of the authorised representative, where applicable;
4. The AI system trade name and any additional unambiguous reference allowing the identification and traceability of the AI system;
5. A description of the intended purpose of the AI system and of the components and functions supported through this AI system;
6. A basic and concise description of the information used by the system (data, inputs) and its operating logic;
7. The status of the AI system (on the market, or in service; no longer placed on the market/in service, recalled);
8. The type, number and expiry date of the certificate issued by the notified body and the name or identification number of that notified body, where applicable;
9. A scanned copy of the certificate referred to in point 8, where applicable;
10. Any Member States in which the AI system has been placed on the market, put into service or made available in the Union;
11. A copy of the EU declaration of conformity referred to in Article 47;
12. Electronic instructions for use; this information shall not be provided for high-risk AI systems in the areas of law enforcement or migration, asylum and border control management referred to in Annex III, points 1, 6 and 7;
13. A URL for additional information (optional).
Section B — Information to be submitted by providers of high-risk AI systems in accordance with Article 49(2) The following information shall be provided and thereafter kept up to date with regard to AI systems to be registered in accordance with Article 49(2):
1. The name, address and contact details of the provider;
2. Where submission of information is carried out by another person on behalf of the provider, the name, address and contact details of that person;
3. The name, address and contact details of the authorised representative, where applicable;
4. The AI system trade name and any additional unambiguous reference allowing the identification and traceability of the AI system;
5. A description of the intended purpose of the AI system;
6. The condition or conditions under Article 6(3)based on which the AI system is considered to be not-high-risk;
7. A short summary of the grounds on which the AI system is considered to be not-high-risk in application of the procedure under Article 6(3);
8. The status of the AI system (on the market, or in service; no longer placed on the market/in service, recalled);
9. Any Member States in which the AI system has been placed on the market, put into service or made available in the Union.
Section C — Information to be submitted by deployers of high-risk AI systems in accordance with Article 49(3) The following information shall be provided and thereafter kept up to date with regard to high-risk AI systems to be registered in accordance with Article 49(3):
1. The name, address and contact details of the deployer;
2. The name, address and contact details of the person submitting information on behalf of the deployer;
3. The URL of the entry of the AI system in the EU database by its provider;
4. A summary of the findings of the fundamental rights impact assessment conducted in accordance with Article 27;
5. A summary of the data protection impact assessment carried out in accordance with Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680 as specified in Article 26(8) of this Regulation, where applicable.
Source: EUR-Lex, Regulation (EU) 2024/1689 — text reproduced verbatim.
📬 AI Act Weekly
Get the most important AI Act developments in your inbox every week.
SubscribeFrequently asked questions
What must be registered according to Annex VIII?
Annex VIII contains three sections with registration information: Section A for providers of high-risk AI (Article 49(1)), Section B for providers claiming their AI is not high-risk (Article 49(2)), and Section C for deployers (Article 49(3)).
What data must a provider register in the EU database?
Section A requires 13 data points, including: provider name and address, AI system trade name, description of intended purpose, operating logic, status (on market/withdrawn), certificate details, EU declaration of conformity, and instructions for use.
What must a deployer register?
Section C requires 5 data points: (1) deployer name and address, (2) contact person, (3) URL of the provider's registration, (4) summary of fundamental rights impact assessment (Article 27), and (5) summary of DPIA where applicable.
Do I need to make instructions for use public at registration?
Yes, point 12 of Section A requires electronic instructions for use. Exception: for high-risk AI in law enforcement, migration and border control (Annex III, points 1, 6 and 7) these do not need to be provided.
What if I claim my AI system is not high-risk?
Then you register under Section B with 9 data points, including the condition(s) under Article 6(3) and a short summary of why the system is considered not high-risk.
Is registration a one-time event or must it be maintained?
The information must be kept up to date. Annex VIII explicitly states that information 'shall be provided and thereafter kept up to date' — you are obliged to update changes.
In which database is the information registered?
In the EU database for high-risk AI systems, as described in Article 71. This database is managed by the European Commission and is partly publicly accessible.
Do I also need to register a fundamental rights impact assessment?
Deployers must register a summary of their fundamental rights impact assessment (FRIA, Article 27) in the EU database, as required by Section C, point 4.