Setting up an AI register: an overview of all AI in your organisation
Short answer
An AI register is an overview of all AI systems your organisation uses: what, for what, with which data, from which supplier and at which risk. It is not legally mandatory for every organisation, but without that overview you cannot answer any of the questions from the AI Act, the GDPR or NIS2. Start small, with the ten fields that matter, and link it to your existing record of processing activities.
Why you need an AI register
- AI Act: you need to know whether you use prohibited practices, where transparency duties apply and which applications will be high-risk. See The EU AI Act in 2026.
- GDPR: AI applications that process personal data belong in your record of processing, and often need a DPIA. See A DPIA for generative AI.
- NIS2: AI services are suppliers in your chain. See NIS2 and AI.
- AI literacy: who needs which training follows from which AI someone uses.
Public bodies also have their own track: in the Netherlands, government organisations publish their high-impact algorithms in the national Algorithm Register, and public bodies deploying high-risk AI must register that use in the EU database.
Which fields belong in it?
| Field | Example |
|---|---|
| Name and description | Customer service summary assistant |
| Purpose | Summarising customer questions for handover |
| Owner | Customer service team lead |
| Model and supplier | Open-weight model on own node; or outside service X |
| Where does it run? | Own server room; EU datacentre; outside the EU |
| Data | Customer name, contact details, question |
| Users | Customer service, 40 staff |
| AI Act risk level | Minimal; transparency; high-risk |
| DPIA and processing agreement | DPIA completed on date; not needed (own infrastructure) |
| Human review | Employee checks summary before sending |
How to set it up
- Inventory broadly. Not just the tools IT knows, but also AI in existing software (CRM, HR systems, office suites) and what staff use themselves. See Shadow AI.
- Start small. Ten fields in a shared table beat an elaborate system nobody updates.
- Link it to existing processes. Only allow a new AI tool once it is in the register, and link it to the DPO’s record of processing.
- Assign an owner for the register as a whole, and per system.
- Review periodically, for example every quarter and with every new tool.
The fewer separate AI services, the shorter the register
Every outside AI service is a row in the register with its own questions: supplier, location, processing agreement, transfer. Organisations that bring AI together in one environment of their own have fewer rows and simpler answers.
With werqly your models and automations run on one node of your own. werqly AI Control shows per role which model and automation is available, and the audit log shows what is actually used. That is the living part of your AI register. See What is private AI?
Frequently asked questions
Questions on this topic
Is an AI register mandatory?
Not for every organisation. Public bodies deploying high-risk AI must register that use in the EU database, and Dutch government bodies publish algorithms in the Algorithm Register. For other organisations the register is mainly the means to comply with the AI Act, GDPR and NIS2.
How does it differ from the record of processing activities?
The GDPR record of processing describes processing of personal data. The AI register describes AI systems, also those that process no personal data, with AI-specific fields such as model, risk level and human review. Link the two.
Does AI in existing software belong in the register?
Yes. AI features in CRM, HR and office software often process the same sensitive data as separate AI tools. They belong in the register, with the software vendor as the party involved.
Who manages the AI register?
Assign one owner for the register, often someone from risk, compliance or the CISO’s team, and a business owner per AI system. Work closely with the DPO, who manages the record of processing.
Sources
- AI Act — Regulation (EU) 2024/1689
- Dutch government Algorithm Register
- European Commission — AI Literacy: Questions & Answers
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.