What is an AI register for?
The register records which AI systems the organisation uses, what each one is for and who looks after it. The National AI Centre describes it as a table or database listing each AI system's key characteristics, use cases, accountable people and appropriate governance level. It helps staff check whether a tool is already in use before buying another, gives managers one view of AI across teams and reduces shadow AI by making approved use visible. The Centre is clear that the register is about transparency and documentation and does not replace impact assessments or risk management.
What should go on the register?
Include every AI system, whether you built it, bought it or switched it on inside existing software. The foundations guidance specifically mentions AI embedded in other systems, such as human resources and customer engagement tools. Include approved standalone tools such as chat assistants, recording the approved uses and leaving out individual prompts. Where staff use one tool for purposes with different risks, give each purpose its own entry, because the guidance points out that the same tool can carry different risks depending on how it is used.
- Tools built in-house or by a contractor.
- Bought AI products and subscriptions.
- AI features inside accounting, customer management, HR, helpdesk and document systems.
- Approved standalone assistants, with each approved use listed.
- Agents or automations that take actions in other systems.
Which fields should each entry have?
Start with the fields in the table below for every entry, then add detail for higher-risk uses. The implementation guidance lists what a full entry can hold: accountable people, purpose and business goals, capabilities and limitations, origin and updates, technical components, datasets and their provenance, acceptance criteria and test results, impact and risk assessments, the risk treatment plan, audit requirements and review dates. A meeting note-taker rarely needs all of that, but a tool that screens job applicants or approves credit needs most of it.
Who fills it in and who owns it?
Give the register one owner, usually the person accountable for AI governance or someone reporting to them. Each entry then needs its own accountable person: the manager of the process the tool supports, who knows how it is used and can answer for its results. The foundations guidance asks organisations to make a specific person accountable for every AI system as their use matures. IT staff or your managed service provider can supply technical fields such as where data is stored, but they should not be the accountable person for a business process they do not run.
How do you keep the register current?
Registers go stale when updating them depends on someone remembering. Tie updates to events that already happen in the business, as listed below, and put a review date on each entry. The National AI Centre also suggests encouraging staff to check the register before deploying, buying or using any AI system, which works best when the register is easy to find and the approval route is quick. When a tool is switched off, mark the entry retired and keep its history.
- A request for a new tool, or a new use of an existing tool.
- A software renewal or new contract, checked for AI features.
- A vendor release that adds or changes AI features.
- An incident, complaint or near miss involving an AI output.
- A change of accountable person when staff move or leave.
How does the register connect to other obligations?
A good register makes several other jobs quicker. From 10 December 2026, organisations covered by the Privacy Act must describe in their privacy policy certain decisions that computer programs make, or substantially and directly inform, using personal information. A register field recording the decision each system makes or informs turns those systems into a filtered list. The same entries support risk screening, supplier reviews at contract renewal and reporting to a board, which can ask how many systems are in use, which are higher risk and which are overdue for review.