A privacy officer at a housing association is asked by the board secretary whether the AI register is finished. She opens the file: nine columns, five rows, two of them at "no decision yet". She says yes, and that is the right answer.
An AI register is finished once every row has an owner, a decision and a review date, and once the tools that have been seen but not yet assessed are in it too. The register below is fictional, but the rows will look familiar to almost any organisation. What a register is and why you keep one is covered in an AI register: what it is and what you record in it. This piece shows what it looks like filled in.
What does a completed AI register look like?
Five rows, one per application. The risk outcomes are examples: yours depend on the account type, the data that goes in and what the vendor's terms say at the time.
| Application | Vendor | Purpose | Owner | Data | Risk assessment | Decision | Date | Review |
|---|---|---|---|---|---|---|---|---|
| ChatGPT, free account | OpenAI, US | No defined purpose; noticed in use | CISO, for the decision | None. Personal accounts may use input for training; no data processing agreement | High, 3 March 2026, CISO | Not allowed; alternative: Microsoft 365 Copilot | 3 March 2026 | March 2027, or earlier on new terms |
| Microsoft 365 Copilot | Microsoft, US | Drafting and summarising in Word, Outlook and Teams | Head of Operations | Internal documents and personal data within the user's own permissions; no special-category data | Medium, 17 February 2026, CISO with DPO; DPIA attached | Allowed | 17 February 2026 | February 2027, or earlier on new features |
| Perplexity | Perplexity AI, US | Unknown as yet; noticed in use | Not yet assigned | Until the decision: public information only | Not yet assessed | No decision yet | 14 May 2026, first sighting | Assessment scheduled, June 2026 |
| Meeting transcription tool | European vendor, processing in Germany | Recording and summarising internal meetings | Team lead, Secretariat | Voices and names of participants; no conversations with tenants or applicants | Medium, 9 April 2026, DPO; DPA signed, recordings kept 30 days | Limited use: internal meetings only, participants informed in advance | 9 April 2026 | April 2027, or earlier after a vendor incident |
| HR screening tool | Dutch vendor | Pre-sorting applications against job requirements | Head of HR | CVs and cover letters | Under assessment; high-risk under Annex III of the AI Act, DPIA in progress | No decision yet | 2 June 2026, request | After the DPIA, and in any case before 2 December 2027 |
Why is each column there?
Application and vendor. A row is about an application, not a product. Copilot for memos and Copilot for interview notes in HR are two rows with the same vendor. The vendor's country is there because it determines which agreement you need and which supervision applies.
Purpose. One sentence. "No defined purpose" is an answer too, and a telling one: the tool is in use and nobody has written down what for. That alone is a reason to take a decision.
Owner. Someone in the business: the role that uses the application, can answer the assessment questions and drives the review. For a tool that is not allowed, the owner is whoever took the decision. Who holds which role is set out in who is responsible for the AI register.
Data. What may go in, and what explicitly may not. This is the column where the risk lives. The same transcription tool is one thing in an internal meeting and another in a conversation with a tenant about arrears.
Risk assessment. The outcome, the date and who did it. A risk band is advice alongside the decision, not the decision itself; two tools with the same outcome can rightly end up with different statuses. How you reach the outcome is in how to assess the risk of an AI tool.
Decision. One of four values, and more than the word alone. Limited use carries its condition; not allowed carries its alternative. Why two values are too few is in four statuses for AI tools.
Date and review. An undated decision cannot be defended. A decision without a review date ages unnoticed: the vendor's terms change, the tool gains a feature that reads documents, and the row stays green.
Why are two rows at no decision yet?
Because it is true, and because otherwise the register only describes what somebody once reported.
The Perplexity row appeared when the association first looked at which AI services are opened from its browsers. Nobody had requested the tool and nobody did anything wrong, because nothing had been decided. The tool got a row with the date of its first sighting, an interim instruction and an assessment date. That took two minutes, and the tool has not been invisible since.
The HR screening tool sits at no decision yet for a different reason. HR requested it, the assessment is under way, and the outcome is not a formality: a system that filters applications falls under Annex III of the AI Act, with the deployer duties of Article 26 applying from 2 December 2027. What that means for an employer is in the EU AI Act for employers. While the DPIA runs, no decision yet is the only status that is accurate.
Which row is missing from most registers?
The first one. A free ChatGPT account was never procured, appears on no invoice and sits in no purchasing list. In many organisations it is nevertheless the most used AI tool. A register built from the purchasing records misses it, and with it the register misses exactly the row where the decision matters most. Why the account type weighs more than the tool is in free versus business AI accounts.
Note how the decision on that row is written. Not allowed, with an alternative next to it. Without the alternative, not allowed is a wish rather than a decision, and the use moves to a phone.
BeeSensible connects a catalogue of 865 AI tools to the use observed in the organisation: only the domain of an opened AI tool, at most once per day per device, with no user id and no content. A tool nobody reported therefore shows up at "no decision yet" by itself, and an administrator records the decision. How that works is on the AI tools page.
