EU AI Act Registration Playbook for B2B SaaS: What Applies Now and What Moved to 2027
Who registers AI systems under Article 49? Providers register covered Annex III systems, with critical-infrastructure systems registered nationally. Public-authority deployers and persons acting on their behalf register covered use. Article 6(3) assessments still require documentation and registration. Annex III high-risk obligations apply from December 2, 2027. See AI governance consulting.
What Applies Now
EU prohibited practices applied from February 2, 2025. General-purpose AI obligations applied from August 2, 2025. Article 50 transparency applies from August 2, 2026.
The high-risk delay is not a reason to postpone applicable transparency duties. Keep the current obligations separate from the later high-risk dates.
What Applies from December 2, 2026
Systems on the market before August 2, 2026 must meet Article 50(2) marking requirements by December 2, 2026.
Two new Article 5 bans also apply from December 2, 2026: non-consensual intimate imagery and CSAM generation.
The Revised High-Risk Timeline
Annex III high-risk obligations apply from December 2, 2027. Annex I high-risk obligations apply from August 2, 2028.
For teams with machinery exposure, the EU Machinery Regulation 2023/1230 applies from January 20, 2027. That date is distinct from the Annex I high-risk date.
Who Registers in the EU Database
Article 49(1): providers register Annex III high-risk AI systems in the EU database before placing them on the market or putting them into service. Annex III point 2 systems, covering critical infrastructure, are registered at national level under Article 49(5).
Article 49(2): a provider that concludes under Article 6(3) that an Annex III system is not high-risk must still register that system. Regulation (EU) 2026/1744 simplified the information required for this registration, as explained in Recital 22. The provider must document the Article 6(3) assessment before placing the system on the market and show it to national authorities on request.
Article 49(3): deployers that are public authorities, EU institutions, bodies, offices or agencies, or persons acting on their behalf, register their use of an Annex III high-risk system. Other deployers do not register. The national-level route for Annex III point 2 remains separate.
Article 49(4): Annex III points 1, 6 and 7, covering biometrics, law enforcement, migration, asylum and border control, are registered in a secure non-public section of the database.
Annex III high-risk obligations apply from December 2, 2027.
Determine the system's Annex III category, the provider's Article 6(3) assessment and the deployer's status before assigning registration work. A person acting on behalf of an eligible public-sector body is covered by Article 49(3). Other deployers do not register.
The Dates to Keep Separate
- February 2, 2025: EU prohibited practices.
- August 2, 2025: EU general-purpose AI obligations.
- August 2, 2026: Article 50 transparency.
- December 2, 2026: Article 50(2) marking for older systems and the two new Article 5 bans.
- January 20, 2027: EU Machinery Regulation 2023/1230.
- December 2, 2027: Annex III high-risk obligations.
- August 2, 2028: Annex I high-risk obligations.
Primary Legal Text
Regulation (EU) 2026/1744, official amended text is the source for the revised dates. Last reviewed: October 13, 2026.
Article 49 of Regulation (EU) 2024/1689 sets registration scope. Recital 22 of Regulation (EU) 2026/1744 explains the simplified information for Article 6(3) registrations, not removal of registration or the documented assessment.
License the EU AI Act Registration Playbook (email gated).
Related reading
This article is part of the Sophizo AI governance series.
Want All 12 Frameworks?
Get the complete 2026 Revenue Leader's Playbook with consulting-grade issue trees, first principles thinking, and agentic AI deployment templates.
Ready to Transform Your Business with AI?
Schedule a free discovery call to discuss your AI strategy
Schedule Free Call