EU AI Act Database

Upon successful registration, the database assigns a Unique Registration ID to each high-risk AI system. This alphanumeric identifier serves as the single source of truth for traceability across the entire supply chain. The ID must be referenced in all Declaration of Conformity documents, CE Marking labels, and incident reports. It creates an immutable link between the physical or digital system and its regulatory file, enabling market surveillance authorities to instantly retrieve the full Technical Documentation File during an audit.

The database operates on the principle of Cross-Border Registration, meaning a single registration filed with one National Competent Authority (NCA) grants market access across all 27 EU member states. Once the Conformity Assessment is verified and the system is entered into the database, there is no need for duplicate filings in other jurisdictions. This mechanism prevents regulatory fragmentation while maintaining a unified, searchable repository for all active and withdrawn AI systems on the Union market.

The database is structurally linked to the mandatory Incident Reporting portal. When a Serious Incident or malfunction occurs, the provider must file a report that directly references the system's Unique Registration ID. This linkage allows regulators to immediately identify the affected model variant, its Intended Purpose, and its deployment context. The connection enables rapid pattern analysis across multiple reports to detect systemic defects that may require Market Withdrawal Notification or Registration Suspension.

The European Commission provides a standardized API Submission Protocol for machine-to-machine registration. This technical interface allows providers to programmatically submit Technical Documentation Files, update Post-Market Monitoring data, and modify registration status without manual portal interaction. The protocol supports bulk operations for large-scale AI providers managing hundreds of system variants, ensuring that the database remains synchronized with live production environments while maintaining cryptographic verification of submission integrity.

Any Substantial Modification to a registered AI system—defined as a change to its Intended Purpose or performance characteristics that alters residual risk—triggers a mandatory re-registration event. The database tracks version lineage, linking the new registration to the original entry while flagging the prior version as superseded. This mechanism prevents providers from silently evolving a system beyond its approved safety envelope without undergoing a fresh Conformity Assessment and updating the public record.

A subset of the database is publicly accessible, providing citizens and civil society organizations with visibility into registered high-risk AI systems operating in the Union. The public interface exposes the system's Intended Purpose, the provider's identity, and the CE Marking status, while keeping proprietary Technical Documentation confidential. This transparency layer fulfills the Act's mandate for algorithmic accountability, allowing external researchers to cross-reference registered systems against real-world deployments.

An AI system classified under the EU AI Act as posing significant risk to health, safety, or fundamental rights. This designation triggers mandatory registration in the EU database before market placement. Classification depends on the system's intended purpose and its role as a safety component in regulated products. Examples include AI in medical devices, critical infrastructure management, and biometric identification systems.

The mandatory verification process demonstrating that a high-risk AI system meets the essential requirements of the EU AI Act. This assessment, conducted internally or by a Notified Body, must be completed before a system can receive a CE Marking and be registered in the EU database. The process evaluates data governance, technical documentation, transparency, and human oversight mechanisms.

A comprehensive dossier that must be submitted as part of the AI registration process. This file contains the system architecture, design specifications, risk management details, and training data provenance records. It serves as the primary evidence of compliance and must be kept for ten years after the system is placed on the market. The file must demonstrate how the system satisfies each applicable requirement.

An alphanumeric identifier assigned by the EU database to a specific high-risk AI system upon successful registration. This ID is used for traceability across the entire supply chain and must appear in all compliance documentation, including the Declaration of Conformity and incident reports. It links the physical product to its digital registration entry and enables market surveillance authorities to track the system throughout its lifecycle.

The continuous, systematic process by which providers collect and analyze data on the real-world performance of a registered AI system. This mandatory obligation ensures ongoing compliance after registration and feeds into the incident reporting linkage mechanism. Providers must document their monitoring plan in the technical documentation and report any serious incidents or malfunctioning to the relevant National Competent Authority.

The legal requirement for a non-EU provider to designate a natural or legal person established within the Union to act as the point of contact for registration and compliance. This representative holds the Declaration of Conformity and technical documentation, liaises with National Competent Authorities, and ensures the foreign manufacturer's obligations are fulfilled. Failure to appoint an authorized representative blocks database registration.