This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
If you've accepted that tracking your business's AI tools is something you should be doing, the next question is what that actually looks like. An AI register is the answer: a structured record of the AI tools your organisation uses, what they do, and what risks they carry. It is not a complex system. Most businesses can build a working one in an afternoon.
In short: An AI register is a documented list of every AI tool your business uses, including what data each tool handles, who is responsible for it, and what risks have been considered. Australian regulators do not yet mandate one for most SMBs, but the OAIC's accountability guidance makes clear that businesses using AI to handle personal information should be able to demonstrate they know what those tools are doing. A register is the practical way to do that.
This article is general information, not legal advice. For advice on your specific Privacy Act obligations, consult a qualified privacy professional.
What an AI Register Actually Is
An AI register is a business record, not a technical system. It lists the AI tools your organisation relies on and captures key facts about each one: what the tool does, what data it touches, where that data goes, who inside your business owns the decision to use it, and what risks have been acknowledged.
Think of it as the inventory you'd want if a regulator, a client, or an insurer asked you to explain how your business uses AI. A register lets you answer that question with a document rather than a scramble to remember what tools different staff members are using.
The term comes from enterprise AI governance, where large organisations build formal risk registers covering algorithmic systems that affect customer outcomes. For an SMB, the same concept scales down considerably. You're not cataloguing a bespoke AI model your developers built. You're recording that your team uses ChatGPT for drafting, your CRM uses an AI feature for lead scoring, and your accounting software summarises transactions automatically.
Who Needs One, and Who Doesn't (Yet)
No Australian law currently requires a private-sector SMB to maintain a formal AI register. The Privacy Act 1988 does not name AI registers specifically. The AI-specific legislation being discussed at a federal level had not passed at the time of writing.
That said, the accountability principle under the Privacy Act, and the OAIC's published guidance on privacy and AI, both point toward the same expectation: if your business uses AI to handle personal information, you should be able to demonstrate that you know what those tools are, what they do with personal data, and what steps you've taken to manage the risks.
An AI register is the simplest way to satisfy that expectation. It is also the foundation for every other AI governance step: you can't write an AI policy, conduct a privacy impact assessment, or brief staff on AI risks if you don't first have a clear picture of what tools are actually in use.
Shadow AI is a real problem for this. Staff often adopt AI tools without telling anyone, particularly free-tier tools like ChatGPT or AI writing assistants. If you haven't audited what tools are in use, your register will miss them. A shadow AI audit is the recommended first step before building a register. See our guide on conducting a shadow AI audit for Australian businesses.
Businesses that handle sensitive personal information, such as healthcare providers, financial services firms, law practices, and accountants, face a higher practical expectation even before formal regulation arrives. If your business already operates under professional or sector-specific obligations, treat an AI register as part of meeting those obligations rather than waiting for AI-specific law to catch up.
What Australian Regulators Currently Expect
The Office of the Australian Information Commissioner (OAIC) released guidance in 2024 on how privacy obligations apply when businesses use AI. The guidance does not create new obligations beyond the Privacy Act, but it clarifies how existing ones apply to AI-enabled processes.
The key expectation is accountability: organisations using AI to make or inform decisions about individuals need to understand what those systems are doing and be able to explain their approach to managing privacy risks. That aligns directly with Australian Privacy Principle 1, which requires entities to have a clear and up-to-date privacy policy and to take reasonable steps to manage personal information responsibly.
The OAIC guidance is not prescriptive about format. It does not say you need an AI register specifically. What it describes is an outcome: demonstrable accountability for how AI is used with personal data. An AI register is the most practical way for an SMB to demonstrate that outcome. For the full detail on OAIC expectations, see our article on how OAIC AI guidance applies to Australian businesses.
The Privacy Act accountability principle also applies here. Under Australian Privacy Principle 1.2, the OAIC's guidance outlines that APP entities are expected to take reasonable steps to implement practices, procedures, and systems consistent with the APPs. See the full APP 1 guidance at oaic.gov.au. If AI tools are handling personal information and you have no record of what they are or what they do with that data, that is a gap in your compliance posture. For more on how the Privacy Act accountability principle applies to AI use, see our guide on the Privacy Act and AI in Australia.
What an AI Register Looks Like in Practice
A working AI register for an SMB covers six things for each tool: what the tool is, what it does in your business, what data it handles, where that data goes (including whether it leaves Australia), who is responsible for it internally, and what risks have been considered.
For a 20-person professional services firm, the register might cover eight to twelve tools. Some will be AI-native products (ChatGPT, Copilot, Claude). Others will be conventional software with AI features added (a CRM with AI-assisted scoring, an accounting platform with automated categorisation, a phone system with AI transcription). Both categories belong in the register if they handle personal information or make business decisions.
The format is less important than the content. A well-structured spreadsheet is sufficient for most SMBs. What matters is that it is maintained and that someone is accountable for keeping it current when new tools are adopted or existing ones change how they work.
The register is also a live document: it needs to be updated when tools are added, when a vendor changes their data handling terms, or when staff begin using a new AI feature that wasn't previously captured. A register that reflects what you were doing twelve months ago is not a compliance document, it's a historical record.
How to Get Started
The fastest way to build your first register is to start with an audit of what tools are currently in use, then document them into a structured template. Do not try to build a perfect register from scratch. Start with what you know, then fill gaps as you discover them.
Step one is the audit: ask your team what AI tools they use, check your software subscriptions, and look at any tools with free-tier access that staff may have adopted without formal approval. This is likely to surface more tools than expected, particularly in businesses where staff have had time to experiment independently.
Step two is documentation: for each tool identified, capture the six fields described above. The vendor's privacy policy and data processing documentation are your primary sources for the data handling and cross-border transfer fields. Under APP 8 of the Privacy Act, cross-border disclosure of personal information to overseas recipients creates obligations for the disclosing entity, so knowing where your data goes is not optional background information.
Step three is assigning ownership: identify who in your business is responsible for each tool's ongoing compliance. In a small business, this may be a single person covering all tools. What matters is that the accountability is named and not assumed to sit with everyone generally.
For a ready-to-use template with all required fields and worked examples for Australian businesses, see our AI register template for Australian SMBs.
Methodology (Real-World, Verified)
This guide is researched against primary regulatory sources and official regulator guidance, verified as of the date shown, and written for a business with no dedicated compliance function.
Read our full methodology and independence and disclosure policy.
Related reading: our can staff upload customer data to AI tools and our free AI staff policy template.
See also: our AI vendor contracts and Privacy Act guide.
Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.
Related reading: our free AI acceptable use policy template and our AI governance by region.
Related reading: Claude AI Review for Australian Business and Notion AI Review for Australian Small Business.
Is an AI register legally required for Australian small businesses?
No, not under current Australian law. No legislation specifically requires an AI register for private-sector SMBs at the time of writing. However, the OAIC's AI guidance and the Privacy Act's accountability principle both expect that businesses using AI to handle personal information can demonstrate they know what those tools are doing. An AI register is the practical mechanism for satisfying that expectation. If your business is in a regulated sector, sector-specific obligations may apply on top of the Privacy Act baseline.
What is the difference between an AI register and an AI policy?
An AI register records what tools your business uses and the facts about each one. An AI policy sets the rules for how staff may use those tools. The register is factual and descriptive. The policy is prescriptive and behavioural. You need both, and the register typically comes first, because you can't write a sensible AI policy without knowing what tools are actually in use. The register informs the policy rather than replacing it.
Do built-in AI features in existing software need to go in the register?
Yes. AI features embedded in software your business already uses, such as AI-generated summaries in your accounting platform, AI-assisted scoring in your CRM, or transcription in your video conferencing tool, are just as relevant to your register as standalone AI products. The question is whether the feature handles personal information and makes or informs decisions about individuals. If the answer is yes, it belongs in the register regardless of whether the AI is the product's main feature or an add-on.
How often should an AI register be updated?
At minimum, review the register when you adopt a new AI tool, when a vendor updates their data handling terms or introduces new AI features, and at least once a year as a general audit. In practice, businesses that make a single person responsible for the register and tie updates to tool onboarding tend to keep it current more reliably than those that rely on periodic sweeps. The register is only useful as a compliance document if it reflects what your business is actually doing right now.
Do I need to share my AI register with clients or regulators?
Not routinely. The register is an internal governance document. Current Australian law does not require publishing it or proactively disclosing it to clients. However, if the OAIC investigates a complaint related to your AI use, or a client contractually requires you to demonstrate AI governance practices, the register is the document you would rely on to show your approach. Keeping it accurate and current is more important than keeping it confidential.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Ready to build your AI register? The NTKAI AI register template covers all required fields with worked examples for Australian SMBs, including cross-border disclosure columns and a built-in risk rating guide.
Get the AI Register Template