The board secretary of a housing association asks the privacy officer whether the AI register is finished. She opens the file: nine columns, five rows, two of them marked "No decision yet". She says yes, and that is the right answer.
An AI register is finished once every row has an owner, a decision and a review date, and once the tools that have been seen but not yet assessed are in it too. The register below is fictional, but the rows will look familiar to almost any organisation. What a register is and why you keep one is covered in our guide to the AI register. This article shows what one looks like once it is filled in.
What does a completed AI register look like?
Five rows, one per application. The risk outcomes are examples: yours depend on the account type, the data that goes in and what the vendor's terms say at the time.
| Application | Vendor | Purpose | Owner | Data | Risk assessment | Decision | Date | Review |
|---|---|---|---|---|---|---|---|---|
| ChatGPT, free account | OpenAI, US | No defined purpose; noticed in use | CISO, for the decision | None. Personal accounts may use input for training; no data processing agreement (DPA) | High, 3 March 2026, CISO | Not allowed; alternative: Microsoft 365 Copilot | 3 March 2026 | March 2027, or earlier if the terms change |
| Microsoft 365 Copilot | Microsoft, US | Drafting and summarising in Word, Outlook and Teams | Head of Operations | Internal documents and personal data within the user's own permissions; no special-category data | Medium, 17 February 2026, CISO with DPO; DPIA attached | Allowed | 17 February 2026 | February 2027, or earlier if new features are added |
| Perplexity | Perplexity AI, US | Not yet known; noticed in use | Not yet assigned | Until the decision: public information only | Not yet assessed | No decision yet | 14 May 2026, first sighting | Assessment scheduled, June 2026 |
| Meeting transcription tool | European vendor, processing in Germany | Recording and summarising internal meetings | Team lead, Secretariat | Voices and names of participants; no conversations with tenants or applicants | Medium, 9 April 2026, DPO; DPA signed, recordings kept 30 days | Limited use: internal meetings only, participants informed in advance | 9 April 2026 | April 2027, or earlier after a vendor incident |
| HR screening tool | Dutch vendor | Pre-sorting applications against job requirements | Head of HR | CVs and cover letters | Under assessment; high-risk under Annex III of the AI Act, DPIA in progress | No decision yet | 2 June 2026, requested | After the DPIA, and in any case before 2 December 2027 |
Why is each column there?
Application and vendor. A row is about an application, not a product. Copilot for memos and Copilot for interview notes in HR are two rows with the same vendor. The vendor's country is there because it determines which agreement you need and which rules apply.
Purpose. One sentence. "No defined purpose" is an answer too, and a telling one: the tool is in use and nobody has written down what for. That alone is a reason to take a decision.
Owner. Someone in the business: the role that uses the application, can answer the assessment questions and drives the review. For a tool that is not allowed, the owner is whoever took the decision. Who holds which role is set out in our article on who is responsible for the AI register.
Data. What may go in, and what explicitly may not. This is the column where the risk lives. The same transcription tool is one thing in an internal meeting and another in a conversation with a tenant about arrears.
Risk assessment. The outcome, the date and who did it. A risk band is advice alongside the decision, not the decision itself; two tools with the same outcome can rightly end up with different statuses. Our guide to assessing the risk of an AI tool explains how to reach the outcome.
Decision. One of four values, and more than the word alone. "Limited use" carries its condition; "Not allowed" carries its alternative. Our article on the four statuses for AI tools explains why two values are too few.
Date and review. An undated decision cannot be defended. A decision without a review date ages unnoticed: the vendor's terms change, the tool gains a feature that reads documents and the row stays green.
Why are two rows marked "No decision yet"?
Because it is true, and because otherwise the register only describes what somebody once reported.
The Perplexity row appeared when the association first looked at which AI services were being opened in its browsers. Nobody had requested the tool and nobody did anything wrong, because nothing had been decided. The tool got a row with the date of its first sighting, an interim instruction and an assessment date. That took two minutes, and the tool has been visible ever since.
The HR screening tool is marked "No decision yet" for a different reason. HR requested it, the assessment is under way and the outcome is not a formality: a system that filters applications falls under Annex III of the AI Act, with the deployer duties of Article 26 applying from 2 December 2027. The EU AI Act for employers explains what that means for an employer. While the DPIA is running, "No decision yet" is the only accurate status.
Which row is missing from most registers?
The first one. A free ChatGPT account was never procured and does not appear on any invoice or purchasing list. Yet in many organisations it is the most-used AI tool. A register built from purchasing records misses it, and so misses exactly the row where the decision matters most. Our comparison of free and business AI accounts explains why the account type matters more than the tool.
Note how the decision on that row is written: "Not allowed", with an alternative next to it. Without the alternative, "Not allowed" is a wish rather than a decision, and use simply moves to people's phones.
BeeSensible connects a catalogue of over 1,000 AI tools to the use observed in the organisation: only the domain of an opened AI tool, at most once per day per device, with no user ID and no content. So a tool nobody reported shows up in the Inbox on its own, marked "No decision yet", and an administrator records the decision. The AI register page explains how that works.
