The register of AI systems is a record of all artificial intelligence tools that a company uses, develops or supplies. It is the foundation of any AI governance, because without it neither risks can be assessed nor compliance demonstrated. For each entry, the record captures the purpose of use, the responsible person, the supplier, the type of data processed, whether it makes decisions about people, what oversight is set up for it, and when it was last assessed. When compiling the register, so-called shadow use almost always comes to light – tools that teams have introduced on their own and that management is unaware of, including ones into which employees enter sensitive data. You can uncover these through a combination of a survey among teams, a review of company payments and subscriptions, and a list of applications connected to company accounts. Keep the register alive through regular review.
See also: Internal AI usage policy, AI management system, AI risk classification.
