API Submission Protocol

The protocol is built on REST (Representational State Transfer) principles, using standard HTTP methods for resource manipulation. POST requests submit new registrations, PUT updates existing entries, and GET retrieves submission status. All endpoints return standard HTTP status codes (201 Created, 422 Unprocessable Entity) for predictable error handling. The API uses JSON as its primary data interchange format, with endpoints structured around logical resources like /registrations, /technical-documentation, and /conformity-assessments.

Access is secured through OAuth 2.1 with mutual TLS (mTLS) for transport-layer security. Providers must register an application and obtain scoped access tokens. Key authorization flows include:

• Client Credentials Grant: For automated server-to-server submissions
• Scoped Permissions: Granular roles like registration:write, documentation:upload, and status:read
• Digital Certificates: eIDAS-compliant Qualified Website Authentication Certificates (QWACs) bind the API client to a verified legal entity All requests are non-repudiable through cryptographic signing, creating an immutable audit trail of submission activity.

Submission payloads conform to a JSON Schema defined by the European Commission, ensuring structural consistency. The schema enforces:

• Required Fields: Unique Registration ID, Intended Purpose Declaration, and Risk Classification
• Conditional Logic: Fields that become mandatory based on prior answers (e.g., Notified Body ID required only if conformity assessment type is 'third-party')
• Format Constraints: Regex patterns for identifiers, ISO 8601 date formats, and controlled vocabularies for enumerations like risk_level Real-time validation returns detailed error objects with JSON Pointer references (RFC 6901) to the exact invalid field, enabling automated correction loops.

Registration submissions are processed asynchronously to handle large technical documentation files and complex validation workflows. The protocol implements:

• 202 Accepted Responses: Immediate acknowledgment with a Location header pointing to a status endpoint
• Webhook Callbacks: Registered URLs receive POST notifications on status changes (submission.validated, submission.rejected)
• Polling with Exponential Backoff: Clients can query /submissions/{id}/status with recommended retry intervals This decouples submission from processing, preventing timeouts when uploading multi-gigabyte Technical Documentation Files.

For providers managing large portfolios of AI systems, the protocol supports bulk registration through a dedicated /batch endpoint. Capabilities include:

• Multipart Uploads: Submitting arrays of registration objects in a single request
• CSV Ingestion: Accepting structured spreadsheets for legacy system migration during the grace period
• Transaction Boundaries: Atomic processing where all registrations in a batch succeed or fail together, preventing partial compliance states
• Rate Limiting: Tiered quotas communicated via X-RateLimit-Remaining headers, with 429 responses triggering backoff Batch operations are critical for enterprises registering hundreds of embedded AI components simultaneously.

The protocol enforces idempotency to prevent duplicate registrations from network retries. Each submission request includes an Idempotency-Key header—a client-generated UUID. The server stores the key with the response for a defined window (typically 24 hours). Subsequent requests with the same key return the original response without re-processing. For legitimate updates, the protocol uses optimistic concurrency control via ETags: clients must send an If-Match header with the current version hash to update a registration, preventing lost updates when multiple systems modify the same record.

The centralized European Commission repository serving as the single destination for all API submissions. It stores the Unique Registration ID, technical documentation, and conformity status for every high-risk system placed on the Union market. The database exposes programmatic endpoints for automated machine-to-machine registration, query, and update operations.

The comprehensive dossier that constitutes the primary payload of an API submission. It must contain:

• System architecture and design specifications
• Risk management protocols and residual risk disclosure
• Training data provenance records
• Model card evaluation results
• Intended purpose declaration

The API protocol defines the structured schema for transmitting this file as machine-readable JSON or XML.

An alphanumeric identifier assigned synchronously by the EU database upon successful API submission. This ID becomes the primary key for all subsequent compliance operations, including Post-Market Monitoring data uploads, Incident Reporting Linkage, and Market Withdrawal Notification. The API response object must parse and persist this identifier within the provider's internal Quality Management System.

The mandatory verification process that must be completed before an API submission can be accepted. The protocol requires the digital signature of the Declaration of Conformity and, where applicable, the Notified Body certificate reference. The API validates the cryptographic integrity of these attestations against the issuing authority's public key infrastructure.

For non-EU providers, the API submission must include a verified Authorized Representative identifier. This natural or legal person established within the Union serves as the legal point of contact. The protocol enforces a validation step that cross-references the representative's registration number with the member state's National Competent Authority directory before accepting the submission.

A change to the AI system's intended purpose or performance characteristics that invalidates the existing registration. The API protocol supports a re-submission workflow that links the new Unique Registration ID to the legacy identifier, maintaining an auditable lineage. The submission schema includes a mandatory boolean flag indicating whether the filing is an initial registration or a modification-triggered re-assessment.