The register the Omnibus did not touch
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and pushed the core high-risk obligations in Chapter III, Sections 1 to 3 of the EU AI Act, apart from Article 6(5), to 2 December 2027 for Annex III systems and 2 August 2028 for AI in regulated products. Registration was left alone. Article 49 sits in Section 5, and the Omnibus amended neither it nor Article 71, the database behind it.
A more expensive misunderstanding sits underneath. Companies read Article 6(3), conclude that their Annex III system is not high-risk, and file the conclusion internally. Article 6(4) and Article 49(2) say otherwise. A provider who reaches that conclusion must document the assessment and enter the system in a public EU database. The derogation changes what you have to build. It does not take you off the register.
What is the EU database?
Article 71 of Regulation (EU) 2024/1689 requires the Commission, with the Member States, to run a single database covering Annex III high-risk systems, real world testing under Article 60, and systems their providers have concluded are not high-risk. The Commission is its controller. Article 71(4) makes the Article 49 entries publicly available, and says they should be navigable and machine-readable, with one narrow exception: law enforcement, migration, asylum and border control entries under Annex III, points 1, 6 and 7 go into a secure non-public section holding fewer fields.
Who registers what?
Providers of high-risk systems
Before an Annex III high-risk system is placed on the market, the provider or its authorised representative registers itself and the system under Article 49(1). Annex VIII, Section A lists thirteen fields, among them the intended purpose, a description of the data and operating logic, the market status, any notified body certificate, a copy of the EU declaration of conformity under Article 47 and electronic instructions for use. Article 16(i) makes this a listed provider obligation, not an administrative courtesy.
Providers relying on Article 6(3)
Article 49(2) catches the company that has run the derogation analysis and decided its system is not high-risk. Annex VIII, Section B is shorter: identity and contact details, the trade name and reference of the system, the intended purpose, the condition in Article 6(3) relied on, and the market status. This is the entry the Digital Omnibus trimmed.
Public sector deployers, and critical infrastructure
Article 49(3) reaches deployers that are public authorities or Union bodies, or those acting for them. They register themselves, select the provider’s entry and register their use, adding a summary of the Article 27 fundamental rights impact assessment and, where relevant, of the data protection impact assessment. Annex III, point 2 goes the other way. Under Article 49(5), high-risk AI in critical infrastructure is registered nationally, and SOU 2025:101, an inquiry report rather than law, proposed that Post- och telestyrelsen take that register.
What the Omnibus deleted, and what it did not
Regulation (EU) 2026/1744 deletes points 7 and 9 of Annex VIII, Section B. Point 7 was the short summary of the grounds on which the provider considered the system not to be high-risk. Point 9 was the list of Member States where it had been placed on the market. Recital 22 gives the reasoning: registration remains crucial for market surveillance and public accountability, but its content should be more proportionate.
Our reading is that this changes publicity, not substance. The same recital confirms that a provider applying Article 6(3) remains obliged to document its assessment before the system reaches the market, and that national authorities can call for it. What has gone is the duty to publish your reasoning. What remains is a file a regulator can demand without notice and judge in hindsight. Reading the deletion as licence to reason less carefully gets it backwards.
When does this actually bite?
The honest answer is that it is contested. On the face of the text, Article 113 sets a general application date of 2 August 2026 and the Omnibus deferred only Sections 1 to 3, so Article 49 is in application today. Against that, everything Article 49 is triggered by, the Annex III classification in Article 6(2) and the derogation in Article 6(3), sits in Section 1 and waits until 2 December 2027, and the Commission’s AI Act Service Desk has taken the view that registration starts then. Our reading is that the Commission has the better of it, because a duty with no operative trigger cannot be discharged.
The infrastructure points the same way. The database is not open, and Euractiv reported in late July 2026 that its launch had slipped to the middle or later part of 2027, without confirmation from the Commission. Plan for 2 December 2027 and build the content now rather than waiting for a portal.
Practical example
A Gothenburg software company sells a recruitment platform. One feature ranks candidates against a role profile, which falls within Annex III, point 4. Another reformats incoming CVs into a common layout. The company has to ask first whether that second feature is inside Annex III at all, because Article 6(3) is a derogation from the classification and nothing more. If it is caught but performs a narrow procedural task under Article 6(3), point (a), then the conclusion is defensible, and it creates work rather than removing it. The assessment must be written before the feature reaches the market, kept available for a competent authority, and the feature registered under Article 49(2). The ranking feature takes the full high-risk route and its own Article 49(1) entry. One product, two entries.
Common mistakes
The most frequent is treating the Article 6(3) decision as an internal matter, when it is a public filing that names the condition you relied on. Close behind is reading the deletion of Section B, point 7 as a relaxation of the analysis rather than of the publication. Some assume registration is a national formality when, outside critical infrastructure, it is a single EU entry, and others forget that entries must be kept current, so a recall or a withdrawal has to be reflected. Few buyers, meanwhile, ask a supplier whether an Annex III system has been registered at all.
Recommended actions
Work out first which of your systems fall within Annex III, because the duty attaches to that list and nothing else, and decide for each whether you are provider or deployer, remembering that rebranding or substantially modifying someone else’s system can make you the provider under Article 25. Where you intend to rely on Article 6(3), write the assessment now, name the condition, record who approved it and when, and confirm the system performs no profiling, which closes the derogation whatever else is true. Build the Annex VIII fields into your technical documentation instead of treating them as a separate exercise, and give one named person the job of keeping the future entry current.
Frequently asked questions
We are not established in the EU. Do we still register?
Yes. A provider outside the Union placing an Annex III high-risk system on the EU market appoints an authorised representative under Article 22, and that representative registers the provider and the system under Article 49(1). The duty follows the market, not the letterhead.
What is the penalty for not registering?
Failure to register a high-risk system breaches Article 16(i) and falls in the Article 99(4) tier, up to EUR 15 000 000 or, for an undertaking, 3 per cent of total worldwide annual turnover, whichever is higher. A missing Article 49(2) entry is caught by national penalty rules instead.
Do general-purpose AI models go in the database?
No. Article 71 covers Annex III high-risk systems, real world testing under Article 60 and Article 6(3) entries, and there is no provider-filed entry for a model. Article 52(6) does require the Commission to publish a list of general-purpose models with systemic risk, which is a different instrument.
Conclusion
Registration is what makes the rest of the AI Act visible, and it is the duty most often skipped, because it lands at the moment a company has just persuaded itself that the hard obligations do not apply. The Digital Omnibus removed two fields and left the rest standing, including the requirement to document why you reached the conclusion you did. At Lawgent, we help companies decide whether Annex III applies to them, write Article 6(3) assessments that survive a request from a regulator, and prepare the Annex VIII content before the database opens. Get in touch if you are about to place an AI system on the EU market and are not certain which entry, if any, it belongs in.
