An AI system register is a single record of every AI tool an organisation actually uses, what it’s used for, and who is accountable for it. Without one, most organisations genuinely don’t know how many AI tools are in use across the business – which makes governing any of them properly impossible.
Why does a register matter?
You cannot govern what you cannot see. An acceptable use policy sets the rules, but the register is what tells you whether those rules are actually being followed, and gives you something to check against when a regulator, client, or auditor asks what AI you use – the kind of accountability the ICO expects of organisations deploying AI. It’s also the practical starting point for any incident: if something goes wrong, the register tells you what the tool does and who owns it, without a scramble to find out.
What fields should the register include?
- Tool name and vendor
- Business purpose – what it’s used for
- Owner – the person accountable for its ongoing use
- Data processed – whether it touches personal, special category, or commercially sensitive data
- Risk assessment status – whether it’s been assessed, and when it’s due for review
- Approval status – approved, approved with conditions, or under review
How do you find out what’s actually in use?
Building the register usually surfaces more tools than expected, because staff have often adopted AI tools informally before any policy existed. A short survey across teams, combined with a look at expense claims and IT/procurement records for AI subscriptions, is usually enough to get a reasonably complete first pass. Network-level visibility (seeing which AI domains staff devices actually connect to) can fill in the gaps a survey misses.
How often should the register be reviewed?
At minimum, annually – but the more useful trigger is any change: a new tool request, a vendor changing its terms, or a tool’s use expanding beyond its original purpose. Treating the register as a living document, owned by someone specific, is what keeps it accurate; treating it as a one-off spreadsheet is what makes it stale within months.
If you’d like help building or auditing an AI system register, see our AI Governance advisory services.