Free AI Register Template: Track Every AI Tool Your Business Uses

If different staff members are trying AI tools without one central record, that is a common starting point rather than a sign your business has failed. This guide explains what an AI register is, what information is useful to record, and how to build a practical list that can grow with your business.

What an AI register does

An AI register gives a business one reliable place to see where AI is being used. It can include public tools such as chat assistants, AI features inside existing software, specialist systems purchased by a department, and free browser tools adopted by individual staff. The purpose is visibility, not paperwork for its own sake.

For Alex, the owner of a small professional services firm, the starting point may be scattered and informal. A marketing employee uses a writing assistant, an administrator uses meeting transcription, and a consultant uploads documents to a summarisation tool. After completing the register, Alex can see the purpose of each tool, the data it touches, the internal owner, its risk level and the next review date in one place.

The register does not decide whether a tool is legally compliant or safe. It helps the business organise the facts needed for better decisions, such as whether a tool should be approved, restricted, replaced, reviewed by an adviser, or removed from use.

Why businesses lose track of AI tools

Most AI use enters a business through ordinary software decisions, not a formal technology project. An employee opens a free account to finish a task, an existing platform adds an AI feature, or a department buys a low-cost subscription on a company card. Each decision may look minor by itself, but the combined result can be a large collection of tools with no clear owner.

This is often called shadow AI, meaning AI use that has not been formally reviewed or recorded. The immediate problem is not that every unrecorded tool is dangerous. The problem is that the business cannot answer basic questions when a client, insurer, customer, regulator or senior manager asks how AI is being used.

A register also reduces repeated work. Without one, different managers may review the same product separately, staff may keep paying for duplicate subscriptions, and an old tool may continue receiving business information after the employee who introduced it has left.

What regulators and standards say about AI inventories

International frameworks increasingly treat an inventory of AI systems as a basic governance building block. They do not all impose the same duties on every business, but they show why organisations are being encouraged to know which systems they use before trying to manage risk.

The US National Institute of Standards and Technology AI Risk Management Framework is a voluntary framework for managing AI risk. NIST supporting material includes mechanisms to inventory AI systems and suggests documenting intended uses, responsibilities and risk management activities. This makes an AI register useful even for businesses outside the United States because the underlying management question is universal: what systems exist, and who is accountable for them?

ISO/IEC 42001 sets out requirements for an AI management system. ISO describes it as a structured approach to managing AI-related risks and opportunities, including governance, accountability, transparency and continual improvement. A simple register does not create ISO certification, but it can support the practical work of identifying systems within the scope of an AI management programme.

The EU Artificial Intelligence Act also includes registration requirements for certain high-risk AI systems in an EU database under Article 71 and related provisions. Those requirements do not mean that every small business must publicly register every AI tool it uses. They do show that formal system identification and traceability are part of the wider regulatory direction for higher-risk uses.

Who should keep an AI register

Any business with more than occasional, purely personal AI use can benefit from a register. It becomes particularly useful when staff handle customer records, confidential documents, employee information, financial data, health information, intellectual property or decisions that affect people.

A five-person firm may only need a short spreadsheet reviewed twice a year. A 50-person manufacturer may need separate owners for production, quality, human resources, sales and finance systems. The format can stay simple, but the level of detail and review frequency should match the consequences of something going wrong.

Businesses supplying services to larger organisations may also be asked to disclose AI use during tenders, security reviews or contract negotiations. A current register makes those conversations easier because the information has already been collected rather than assembled under deadline pressure.

What to record for each AI tool

A useful register records enough detail to support a decision without becoming too difficult to maintain. The free template below includes the core fields most small and medium businesses can start with.

How to assign a simple risk level

A risk rating should help you prioritise review, not create false precision. A practical starting point is to consider the sensitivity of the information, the importance of the task, the people affected, the ability of staff to check the output, and the difficulty of reversing a mistake.

Low-risk use might include brainstorming generic social media topics without entering confidential information. Medium-risk use might include drafting internal documents that a qualified employee reviews before use. High-risk use might include analysing sensitive records, influencing recruitment or credit decisions, providing professional advice, controlling machinery, or producing output that people may act on without meaningful human checking.

The rating is an internal flag, not a legal classification. A tool may be low risk in one context and high risk in another. For example, a chat assistant used to rewrite a public product description is different from the same service being used to summarise a confidential client file.

How to build your first register

Start by finding actual use, then improve the detail over time. Trying to create a perfect governance programme before asking staff what they use usually produces an attractive spreadsheet with missing tools.

1. Name a register owner. Choose one person to maintain the master copy, coordinate reviews and follow up incomplete entries.
2. Ask every team. Send a short, non-punitive request asking staff to list AI tools, AI features and browser extensions they use for work, including free accounts.
3. Check purchasing and sign-in records. Review company cards, expense claims, software lists, identity-provider logs and browser management records where available.
4. Record the basics first. Capture the tool, purpose, owner, users, data handled and approval status before researching every contract detail.
5. Prioritise higher-risk entries. Review tools touching sensitive data, employment, safety, professional advice or consequential decisions first.
6. Set review dates. Use a shorter cycle for higher-risk or rapidly changing systems and a longer cycle for stable, low-risk uses.
7. Connect the register to everyday processes. Add a register check to software purchasing, employee onboarding, security reviews and contract renewal.

When asking staff, make it clear that the first goal is visibility rather than punishment. Employees are more likely to disclose informal tools when they believe the business wants to understand and improve current practice. Immediate threats of discipline can drive the same use further out of sight.

How to keep the register current

An outdated register can create misplaced confidence, so maintenance matters more than the initial spreadsheet. The simplest approach is to give each entry an owner and a next review date, then make updates part of existing business routines.

Review an entry when a vendor changes its terms, a tool adds a major feature, staff begin using it for a new purpose, the data being entered becomes more sensitive, an incident occurs, or the business changes subscription level. Also remove tools that are no longer used and record whether accounts, integrations and stored data have been closed or deleted.

A quarterly check is a reasonable starting rhythm for active AI use, while a small business with only a few stable tools may choose a six-monthly review. Higher-risk systems may need closer oversight. The right interval depends on change and consequence, not the size of the vendor.

Common mistakes to avoid

The most common mistake is treating the register as a list of approved subscriptions only. That misses free tools, trial accounts, AI features built into existing products, automated functions supplied by contractors, and systems used by a single department.

• Do not record only the vendor name. Write the specific business purpose.
• Do not use one vague owner such as “IT” for every entry. Name an accountable role or person.
• Do not assume a business plan automatically makes all data use suitable.
• Do not rate the product once and ignore how staff actually use it.
• Do not delete retired entries without recording that access and data were addressed.
• Do not turn the register into a 50-column form that staff cannot complete.

Free AI register template

Copy the template below into a spreadsheet and adapt the fields to your business. One row should represent one tool and one distinct use. If the same tool is used for two very different purposes, create separate rows so the data, owner and risk can be assessed clearly.

Questions to ask during each review

A review should confirm that the recorded use still matches reality. Ask whether staff use the tool for any new purpose, whether different data is now being entered, whether access is still appropriate, and whether the vendor or product has materially changed.

Also check whether staff can verify the output, whether incidents or complaints have occurred, whether a cheaper or safer approved tool now covers the same task, and whether the current restrictions are understood. Record the decision and the reason so the next reviewer can see what changed.

AI register FAQ

Related reading: our free AI acceptable use policy template and our AI governance by region.

Free tools: AI Tool Pricing Tracker to check current pricing across the major AI platforms | AI Compliance Checker to check whether your AI tools meet your compliance obligations.

What is an AI register?

An AI register is a central list of the AI tools and AI-enabled systems a business uses. It normally records the purpose, owner, users, data handled, risk level, approval status and review date for each use.

Does every business need an AI register?

There is no single global rule requiring every business to keep the same register. However, a register is a practical governance tool for any organisation that uses AI with business, customer, employee or confidential information.

Should free AI tools be included?

Yes. Free accounts, trials, browser extensions and AI features inside existing software can handle the same sensitive information as paid products. Cost is not a reliable measure of risk.

Is an AI register the same as an AI policy?

No. A policy sets the rules for how staff may use AI, while a register records the actual tools and uses within the business. The two work best together because the register shows where the policy is being applied.

How often should an AI register be reviewed?

Set a review date for every entry and update it whenever the use, data, vendor terms, features or risk changes. Many businesses can begin with quarterly checks for active or higher-risk tools and six-monthly checks for stable, low-risk uses.

Does this template make a business compliant with AI laws?

No. The template helps organise information and responsibilities, but it does not determine which laws apply or confirm compliance. Use official regional guidance and qualified advice for specific legal questions.