Skip to content

Free template

A free AI risk register and AI tool register

One simple register that lists every AI tool your firm uses, what it's allowed for, and the risks that come with it. Copy the columns into a spreadsheet, start with the filled-in example, and review it every few months.

Copy the columns into a spreadsheet to use it.

Last checked .

How to use it

  1. 01

    Find out which AI tools your team really uses, including personal accounts. Our shadow AI guide shows you how.

  2. 02

    Add a row for each tool and plan, and fill in every column. Check each plan's facts with the free AI plan checker.

  3. 03

    Give each row an owner and a review date, and update the register whenever a tool or plan changes.

The template

[Firm name]: AI tool and risk register

Owner: [name, role]. Last reviewed: [date]. Next review: [date].

Columns

- Tool: the AI tool, for example ChatGPT.

- Plan: the plan and account type, for example ChatGPT Business, signed in with work accounts.

- Contract: is there a contract and data processing agreement with the firm? Yes or no.

- Data allowed: what may go in, for example "client work, with client details kept out where not needed", or "no personal data".

- Owner: who's responsible for this tool.

- Review date: when the row will next be checked.

- Risk: the main risk, and whether it's low, medium or high.

- Mitigation: what you do about it.

Example rows (made-up example)

Made-up example, not a real firm.

- ChatGPT | Business, work accounts | Yes | Client work, client details kept out where not needed | Office manager | [date] | Medium: client data in prompts | Business plan only; AI policy; client details swapped out before sending.

- ChatGPT | Free or Plus, personal accounts | No | No personal data | Office manager | [date] | High: client data on an account with no contract | Personal accounts warned about or blocked; AI policy.

- Microsoft Copilot | Work account (Entra ID) | Yes | Client work | IT provider | [date] | Medium: web search queries fall under Microsoft's services agreement | Staff told not to put client details into questions that search the web.

- New AI note-taker | Personal sign-up | No | Not approved | Partner | [date] | High: recordings of client meetings stored by an unknown provider | Under review; not to be used in client meetings until approved.

Fill in the parts in [square brackets]. General information, not legal advice.

Keep the register up to date without the spreadsheet

A register is only useful if it's current, and new AI tools turn up all the time.

Saiela shows every AI tool your team uses in the browser, including new ones as they appear, with each plan's contract and training facts. You approve each tool for client work, allow it for work with no personal data, put it under review or block it, and it keeps your vendor register for you.

See how approved AI tools work

Questions

What's the difference between an AI tool register and a risk register?

A tool register lists which AI tools you use and what for. A risk register records the risks they bring and what you're doing about them. For a small firm, one register with both sets of columns is simpler to keep up to date.

How do we find the AI tools our team uses?

Ask the team without blame, check company card spending, and ask your IT provider what device management shows. Tools used without the firm knowing are often called shadow AI.

Do we have to keep an AI register?

No law asks for an "AI register" by that name, but UK GDPR expects you to keep records of processing, including who you share personal data with. An AI tool register makes that much easier, and feeds your risk assessment (DPIA).

Sources

Stuart Kinsey

Stuart Kinsey

Co-founder of SimpleKPI

Stuart has worked in creative and analytical services for over 25 years and co-founded SimpleKPI in 2007. He writes about how small firms can use AI safely and what UK data protection law expects.

Stuart on LinkedIn

Let your team use AI. Keep the proof.

Try every Team feature free for 7 days.

Start free trialSee pricing