What is an AI agent data controls register?

A register is a single document that lists every AI agent your team runs, what personal or sensitive data it touches, which systems it connects to, who owns it, how long it retains data, and whether its activity is logged. It turns "we use some AI tools" into an auditable inventory.

Why do small teams need to document AI agent data access?

Because you can't scope a breach, answer a regulator or revoke access for an agent you don't know about. Surveys agree the gap is wide: IBM found fewer than one in five organizations keep a complete AI inventory, and Okta found 47% of security leaders are confident they can identify every agent.

Does GDPR require documenting AI agents?

Not by name. Article 30 requires a record of processing activities, so whatever an agent does with personal data has to be in it: purposes, data categories, recipients, erasure time limits and security measures. Firms under 250 staff are exempt only if processing is occasional, low-risk and avoids special categories.

What does EU AI Act Article 12 require for AI agent logging?

Article 12 says high-risk AI systems must technically allow automatic recording of events over their lifetime. Providers and deployers keep those logs for at least six months (Articles 19 and 26). For Annex III high-risk systems this applies from December 2, 2027, after the AI Omnibus moved the date.

How often should we review the AI agent register?

Review it monthly for fast-moving teams, or at minimum every time a new agent, integration, or MCP server goes into production. Assign one named owner per agent so the register does not go stale the way most shadow IT inventories do within a quarter.

AI Agent Data Controls Register: A Free Template for 2026

Image: Unsplash.

If you can't name every AI agent your team runs, what each one can read, and how to switch it off tonight, start here. A register is one row per agent, and the template below is the row. You don't need a governance platform for this; you need an owner per agent and a review date someone keeps.

Why most teams can't answer the question yet

The surveys this year agree on the shape of the problem. IBM's Think 2026 recap says only 18% of organizations maintain a current and complete AI inventory, and that most large enterprises will run a "digital workforce of over 1,600 AI agents" by the end of the year. In a separate IBM study of 2,000 technology executives, 70% said teams across the business deploy technology faster than IT can track it.

The security side looks the same. Kiteworks' summary of three 2026 surveys reports that in Okta's Global CISO Insights 2026 (306 security executives), only 47% were confident they could identify every AI agent in their environment and 46% that they could control what those agents access. 1Password's survey of 1,000 security and engineering staff, run in late May and early June, found roughly four in ten organizations had agents reaching data outside their approval scope. Kiteworks' own survey of 459 security and compliance leaders found only 26% restrict agents to authorized tasks and data scopes, and only 21% can automatically cut off a misbehaving agent.

The same frustration shows up in small threads, not just reports. In an August 24 r/artificial post titled "Most AI agents processing sensitive data right now have ZERO documented controls," the most practical reply came from u/adeelraza86:

"The thing that actually moved us from zero controls to something defensible was logging every tool call the agent made, with the inputs, before we wrote a single policy doc."

https://www.reddit.com/r/artificial/comments/1vwr687/most_ai_agents_processing_sensitive_data_right/

That's the right order. Find the agents, see what they touch, then write the policy.

What the law already asks for

GDPR Article 30. Every controller keeps a record of processing activities. It doesn't mention agents, but whatever an agent does with personal data is processing, so it belongs in the record with the fields Article 30 lists: the purposes, the categories of data subjects and personal data, the categories of recipients, transfers to third countries, "where possible, the envisaged time limits for erasure," and a general description of security measures.

Small firms often assume the under-250-staff exemption covers them. Read the condition: it doesn't apply if the processing is likely to result in a risk to people, "the processing is not occasional," or it includes special categories of data. An agent that runs every day on customer records isn't occasional processing, so we'd plan on keeping the record.

GDPR Article 30, records of processing activities, listing the information the record must contain

Screenshot: Art. 30 GDPR, Records of processing activities, gdpr-info.eu.

EU AI Act Article 12. For high-risk systems, "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." The retention rule sits elsewhere: providers (Article 19) and deployers (Article 26(6)) keep those logs for at least six months. The Article 50 transparency obligations and the GPAI fining regime started on August 2, 2026, but the high-risk rules for Annex III systems, Article 12 included, apply from December 2, 2027 after the AI Omnibus moved the date. If an agent falls into a high-risk category (see what applies and what was delayed), build the automatic logging before then.

EU AI Act Article 12, record-keeping, in the consolidated text on EUR-Lex: high-risk AI systems shall technically allow for the automatic recording of events over the lifetime of the system

Screenshot: Regulation (EU) 2024/1689, Article 12, consolidated version of July 27, 2026, EUR-Lex.

There's a plainer reason too. If a key leaks or a vendor is breached, the first question is what the agent could reach. Without a register you rebuild that answer from logs under pressure; with one you read it off a row. Our LiteLLM breach audit checklist shows what that question looks like in practice.

Analytics dashboard displaying monitoring metrics on a dark screen, representing the visibility gap in AI agent oversight

Image: Unsplash.

What "documented controls" means for one agent

A register needs to answer, for every agent, the questions an auditor or your own incident responder will ask:

What is this agent for, and who owns it
What data categories can it read or write
What systems and vendors does it connect to
Does it send data to any third party or sub-processor
How long does it retain what it touches
Who or what can invoke it, and under what access controls
Is its activity logged, and where are those logs kept
Can access be revoked immediately if it misbehaves
When was it last reviewed, and by whom

That's the shape of the template below. Copy it into a spreadsheet, a Notion database or your GRC tool, whichever your team will actually keep current.

This is narrower than a general AI tool inventory. For every SaaS app with an AI feature bolted on (ChatGPT logins, Notion AI, Grammarly), use the AI tool register template. For a 12-field format mapped to EU AI Act deployer duties and Colorado SB 26-189's three-year record keeping, use the free AI register template. This register is for agents: systems that call tools, read and write to your production systems, and act with some autonomy.

The AI agent data controls register template

Fill in one row per agent. The two example rows below show what a completed entry looks like; delete them and start your own list from the blank row.

Agent name	Owner	Purpose	Data touched	Connected systems	Third-party recipients	Retention	Access control	Logging	Kill switch	Last reviewed
Support copilot	Maria R, Support lead	Drafts replies to customer tickets	Customer name, email, order history	Zendesk, order database	OpenAI API (no training, per DPA)	30 days for draft logs	Support team SSO group only	Yes, Zendesk audit log + vendor API log	Yes, revoke via Zendesk app settings	2026-08-01
Sales research agent	Devon K, RevOps	Enriches lead records before outreach	Company name, contact email, firmographic data	CRM, Clearbit, LinkedIn Sales Nav API	Clearbit (enrichment vendor)	Indefinite, tied to CRM record	RevOps team API key, rotated quarterly	Partial, CRM writes logged, API calls not	No, shared API key	2026-06-15
[blank]

A few notes on filling this in honestly, since the value of the register depends entirely on how truthfully it is completed:

"Partial" and "no" are valid answers. The sales research agent example above has real gaps, a shared API key with no kill switch and incomplete logging. Writing that down is the point. A register that only records agents you are already confident about is not an inventory, it is a highlight reel.

Owner means a named person, not a team. "Engineering" is not an owner. When something goes wrong with an agent late at night, you need one name to page, not a channel to broadcast into.

Retention needs a number, not "as needed." If you genuinely do not know how long an agent retains what it processes, that itself is the finding. Put "unknown, investigating" and set a deadline to resolve it, rather than leaving the field blank.

Access control should name the actual mechanism. "Restricted" tells you nothing. "SSO group X, MFA required" or "shared API key, no MFA" tells you exactly what to fix first.

Building the first version in an afternoon

List the API keys in each model provider's admin console. A key nobody recognizes is an undocumented agent until proven otherwise.
Check your MCP server configuration, if you run any. Every server exposes tools to a model, and every tool is a data-access path worth its own row. Our MCP server security governance checklist covers this in more depth.
Ask engineering, support, sales and finance leads directly whether they use any AI tool that reads customer, employee or financial data, even informally. That's how the agent someone built on a Friday afternoon gets found, the pattern our shadow AI policy guide is built around.
Cross-check your SSO and password manager for AI tool logins. Anything with an active login and no register row goes on the list.
Turn on logging before you write policy. Record each tool call with its inputs, as the r/artificial reply above suggests; it tells you what the "Data touched" column really says.
Set a recurring review, not a one-time task. We'd review monthly, and whenever a new agent, integration or MCP server goes into production.

What to look for in the first pass

Flag these as you fill the rows: agents with no named owner, API keys shared by several agents (you can't revoke one without breaking the others), agents that can read far more data than their purpose needs, and agents with no logging at all. The survey numbers above say those last two are the norm, not the exception: about a quarter of organizations restrict agents to their authorized scope, and about a fifth can cut one off automatically.

The fix is the same at any size: one document, one owner per row, and a review date that gets kept. Once you know what you're running, our AI vendor due diligence checklist and SOC 2 AI controls guide build on the same inventory.

What this template doesn't cover: whether a given agent is a high-risk AI system under the EU AI Act (that depends on its use, not on being an agent), and the separate GDPR duties (DPIAs, lawful basis, processor contracts) that a register only points to.

Correction (October 19, 2026): Earlier versions said enforcement for high-risk systems began August 2, 2026. The AI Omnibus moved the high-risk rules for Annex III systems to December 2, 2027 (consolidated AI Act, Article 113; European Commission).

Correction (October 20, 2026): The summary at the top still said Article 12 logging "took effect August 2, 2026"; it applies to Annex III systems from December 2, 2027. Earlier versions also called the r/artificial post "viral" with "a wave of agreement" (it had a handful of comments), attributed the inventory figure and the agent-count projection to one 2,000-executive IBM study presented at Think 2026 (they come from IBM's Think 2026 recap; the 2,000-executive study is a separate June release), described the inventory figure as covering "agents" (it covers AI inventories), and gave IBM figures we could not find in either source (a central-platform share, and seven in ten saying governance is "not fit for purpose"). Article 12 was described as setting six-month retention; that duty is in Articles 19 and 26(6). We removed unsourced claims that teams with a register "answered in an afternoon" after the LiteLLM breach and that first inventories find problems "in roughly this order of frequency."

Sources: IBM, "Managing agentic AI's speed, scale and sprawl: Insights from Think 2026", IBM Newsroom, June 8, 2026, Kiteworks, "AI Agents Are Reaching Data No One Approved", GDPR Article 30, Regulation (EU) 2024/1689, consolidated text, European Commission, AI Omnibus, r/artificial thread.