> Bron: https://neuralex.nl/en/blog/ai-register-bijhouden > A practical AI register creates visibility into AI systems, suppliers, data, risks and oversight. Learn which fields to record, who should maintain them and how the register connects to GDPR records, DPIAs and AI governance. [Back to Insights](/en/blog) AI Act ·6 October 2026 ·6 min read # Keeping an AI register: what should you put in it? A practical AI register creates visibility into AI systems, suppliers, data, risks and oversight. Learn which fields to record, who should maintain them and how the register connects to GDPR records, DPIAs and AI governance. An AI register records, for each AI application, what the system does, who is responsible for it, which supplier and model are being used, what data enters the system, which risks have been identified and how human oversight, logging and user instructions are organised. It therefore acts as the central inventory of AI used within your organisation. An internal AI register is not automatically a general legal requirement for every organisation. It is primarily a practical governance tool. It can, however, make many of the documentation, control and oversight obligations under the regulation easier to manage. The exact obligations depend, among other things, on your role, the type of AI system and how it is used. Deadlines and details may change and should therefore be checked against the current text of the regulation before use. For broader context, see [AI Act for SMEs](/en/blog/ai-act-voor-het-mkb). ## Why is an AI register useful? The first purpose of an AI register is straightforward: knowing which AI your organisation is actually using. That sounds obvious, but AI often enters an organisation through several routes. A central IT team may procure official systems while employees independently use AI services, browser tools, built-in copilots or experimental models. This second category can create shadow AI: applications that management, security or privacy teams do not know about. Without an inventory, it becomes difficult to determine which data is being shared, which contractual conditions apply or where an AI output may affect customers, employees or business processes. A register also supports accountability. If someone later asks why a system is being used, who approved it or which safeguards were introduced, you do not have to reconstruct the answer from contracts, emails and project documentation. ## Which fields should you record for each AI application? Keep the register practical. It does not need to become a legal case file, but it should contain enough information to identify, assess and review an application. As a minimum, consider recording the following fields for each AI application: - **Name and purpose:** what is the application and which business purpose does it support? - **Owner:** which person or function is internally responsible for its use and periodic review? - **Supplier and model:** which supplier, service, model version or technical solution is being used? - **Data used:** what information is entered, retrieved or generated, and does it include personal data, confidential information or trade secrets? - **Risk-category assessment:** how does the organisation provisionally classify the use under the regulation and its own risk framework? If there is uncertainty about potentially high-risk uses, the explanation of [high-risk AI systems](/en/blog/hoog-risico-ai-systeem) provides a useful starting point. - **Human oversight:** when does a person review or make the decision, and which actions may the system perform autonomously? - **Logging and control:** which relevant inputs, outputs, decisions, errors or system actions are recorded? - **Date of the latest review:** when was it last checked whether the purpose, model, risks and safeguards were still accurate? - **User instructions:** which rules apply to employees, for example regarding personal data, confidential information, verification of outputs and permitted uses? You can add further fields for contracts, data location, security measures, incidents or connected systems. The important point is that the register remains usable. A very detailed register that nobody updates is less valuable than a concise inventory embedded in normal operational processes. ## How do you get started in a small organisation? Do not start with the regulation; start with an inventory. Ask teams and employees which AI tools they actually use. Look beyond standalone chatbots and include AI features inside CRM systems, office software, customer service platforms, recruitment tools, marketing applications, document-analysis systems and automation platforms. Then create a single list and assign an owner to each application. Ask that owner to complete the core fields and determine whether further assessment is required. Not every application needs the same level of scrutiny. A tool used to suggest wording for internal documents requires a different assessment from AI that influences selection, credit, access to services or other decisions affecting individuals. Also record which applications or forms of use are not permitted. This turns the register from a simple inventory into a practical mechanism for reducing uncontrolled shadow AI. Users should also understand why restrictions exist. This connects with the broader need for [AI literacy within organisations](/en/blog/ai-geletterdheid-artikel-4). ## Who maintains the register and when should it be updated? There should be one clearly identified process owner. This could be someone in IT, security, privacy, compliance or operations. Responsibility for the substance of each individual AI application should, however, remain with that application's owner. A central administrator cannot independently determine whether usage within every department has changed. A shared-responsibility model therefore works well: centrally, the organisation defines which information must be recorded and how reviews are performed; locally, the application owner confirms that the information remains current. Do not update the register only during a scheduled periodic review. A change in model, supplier, purpose, data source, user group or degree of autonomy can justify a new assessment. The same applies when an application becomes connected to other systems or begins processing additional personal data. ## How does the AI register relate to the GDPR record of processing activities and a DPIA? An AI register does not replace the GDPR record of processing activities. They are different records with different purposes. The GDPR record focuses on processing personal data. The AI register primarily focuses on AI systems and their use, including applications that may not process personal data at all. There can nevertheless be substantial overlap. If an AI application processes personal data, the AI register can refer to the relevant processing activity in the GDPR record. This reduces duplicate documentation and makes it clearer which privacy processes apply to the system. The same applies to a DPIA. An AI register is not a DPIA, and an entry in the register does not demonstrate that privacy risks have been assessed adequately. Where the use of AI requires a DPIA, the register can link to that assessment and its associated safeguards. See [What is a DPIA and when do you need one for AI?](/en/blog/dpia-voor-ai) for further explanation. ## What common mistakes should you avoid? One common mistake is registering only formally procured AI systems. That approach misses precisely the tools that entered the organisation outside normal procurement and security procedures. Ask about actual use rather than only approved software. A second mistake is treating the register as a one-off inventory. AI services change. Suppliers modify models, functionality and terms, while organisations later connect systems to additional data sources. A register that does not evolve with those changes can create a false sense of control. Descriptions such as “marketing uses AI” are also too vague. The register should show which application is used, for what purpose, with which data and under whose responsibility. At the same time, avoid creating a separate bureaucratic record for every small prompt or experiment. Register AI at a level where risk, ownership and control can be managed meaningfully. ## Have the legal position reviewed An AI register helps make AI use visible and manageable, but it does not determine which legal obligations apply to your organisation. Neuralex does not provide legal advice. Use the register as a practical governance tool, verify relevant requirements against the current text of the regulation and ask a qualified lawyer to determine which obligations, documentation and procedures apply to your organisation and its AI applications. AI Act & compliance ## Do you know which AI your organisation uses? We help you set up a usable AI register — compact enough to maintain, concrete enough to steer by. For the legal assessment you work with a lawyer. Curious what that looks like for your situation? [Ask your question](/en/contact) [Read the AI Act for SMEs](/en/blog/ai-act-voor-het-mkb) --- Volledige (opgemaakte) versie: https://neuralex.nl/en/blog/ai-register-bijhouden