AI Register Template for Small Teams (2026)

TL;DR: A copy-paste AI tool register template tracking tool name, owner, use case, data sensitivity class, DPA status, and last review date. One row per tool; update monthly.

What Is an AI Tool Register?

An AI tool register is a maintained list of every AI-powered tool your organization uses, including tools that come with AI features built in, with details about ownership, data handling, approval status, and review dates.

A copy-paste AI tool register template tracking tool name, owner, use case, data sensitivity class, DPA status, and last review date. One row per tool; update monthly.

Think of it as the master inventory that makes all your other AI governance work possible. You cannot write a meaningful policy, run an audit, or assess vendor risk for tools you do not know exist.

Why Small Teams Need One

Most small teams discover they have more AI tools in use than they realized. A developer using GitHub Copilot, a marketer using ChatGPT, a support rep using a helpdesk with AI suggestions built in, an ops lead who signed up for a summarization tool last quarter and forgot to tell anyone, this is the normal starting point.

An AI tool register:

• Surfaces shadow AI before it creates a data or compliance incident
• Makes vendor risk reviews tractable (you need a list before you can score it)
• Gives you the inventory required for a quarterly governance audit
• Supports contract reviews, you cannot check DPA status for a vendor you do not know you have

The Template

Copy this table into your preferred tool (Notion, Airtable, Google Sheets, any works). One row per tool.

Starter List: Tools to Check First

When building your register from scratch, start with these categories, they are where most unapproved AI use hides:

1. Writing assistants: ChatGPT, Claude, Gemini, Grammarly (has AI features)
2. Code assistants: GitHub Copilot, Cursor, Codeium, Tabnine
3. Meeting tools: Otter.ai, Fireflies, Fathom, Zoom AI Companion
4. Productivity tools with AI features: Notion AI, Microsoft 365 Copilot, Google Workspace AI
5. Customer-facing tools: AI chatbots, helpdesk AI (Intercom, Zendesk AI)
6. Specialist tools: AI for design (Figma AI, Adobe Firefly), AI for finance, HR AI features
7. Developer tools: Any model API access (OpenAI, Anthropic, Mistral)

How to Build the Register: 4 Steps

1. Survey the team. Send a short 3-question form: "What AI tools do you use at work? What data do you put into them? Do you pay for them personally or on a company card?" Anonymize if needed to get honest answers.

2. Check your payment records. Look for AI vendor charges in corporate card statements and expense reports. This catches tools that were signed up for quietly.

3. Review SaaS and browser extensions. Ask IT (or do it yourself) to check installed browser extensions and OAuth connections to company Google/Microsoft accounts. Many AI tools are accessed this way.

4. Score each entry. For every tool found, fill in the register fields above. Flag anything with Confidential or Restricted data access for immediate review.

Maintenance Cadence

What to Do With What You Find

• Shadow tools with no sensitive data access, add to the register, have the owner document the use case, decide whether to approve or replace with an approved alternative
• Shadow tools with PII or confidential data, treat as an AI incident; assess exposure, remediate, and decide on tool status
• Tools with no DPA, contact the vendor or move to a plan that includes a DPA before allowing sensitive data use
• Unused tools, retire them; reduce your attack surface and your bill

Handling Tool Escalations: When the Register Flags a Problem

Not every tool you find in the register will be straightforwardly approvable. Here is how to handle common escalation scenarios:

A tool is processing personal data without a DPA. This is the most common escalation. Do not simply revoke access, assess what data has already been processed and whether it creates a disclosure obligation under GDPR or state law. For minor exposures (one employee using a tool for a week), documenting the finding and remediation is sufficient. For sustained exposure (a tool used by the whole team for customer data over several months), involve legal before deciding on next steps.

A vendor's AI training terms are ambiguous. Some vendors use vague language like "may use interactions to improve our services" without specifying whether this includes customer data. For these vendors, send a written inquiry asking specifically: "Does your service train AI models on data submitted by business customers? What is our opt-out mechanism?" Document the response. If the vendor cannot give a clear answer within 5 business days, treat as "unknown, training may occur" and restrict the tool to public data only until resolved.

An employee is using a tool outside approved data classifications. For example, a tool approved for Internal data is being used to paste customer email threads (Confidential). The response is not punitive, most employees do not track data classifications while working. The corrective step: have the tool owner brief the relevant team on the approved use boundaries, document the briefing, and add a note in the register. If the exposure was significant (sensitive customer data, regulated data), escalate to the data privacy review process.

A tool owner leaves the team. Tools without a named owner are effectively unmonitored. For every tool in the register, assign a successor owner within 30 days of the original owner's departure. If no appropriate successor can be identified, temporarily restrict the tool to read-only or lower-risk use until a new owner is assigned and briefed.

A new tool request comes in before it is registered. The most common register failure is tools getting approved verbally or through a purchase card before anyone adds them to the register. The simplest fix: make the register the approval gate. Before any new AI tool can be expensed or added to a company account, the requestor must submit a register entry with the tool name, intended use case, data access scope, and proposed owner. The request is approved or denied based on that entry. Tools that bypassed this gate get a mandatory retroactive compliance review within 14 days of discovery.

Connecting the Register to Regulatory Compliance

The AI tool register is not just an internal governance document, it is the input to several regulatory compliance requirements:

GDPR Article 30 (Record of Processing Activities). Every tool in your register that processes personal data must appear in your ROPA. The register's data classification column maps directly: tools processing personal data (names, emails, behavioral data) are processing activities requiring documentation. The DPA column confirms your lawful processing basis. If you maintain both documents, keep them synchronized, a new tool in the register should trigger an update to the ROPA within 30 days.

EU AI Act classification. If you operate in the EU or process data about EU residents, tools in your register need to be assessed against EU AI Act risk tiers. The EU AI Act risk tier column in your register (Minimal / Limited / High / Unacceptable) is the starting point for your Annex III high-risk classification exercise. Any tool flagged as High risk requires conformity documentation from the vendor before deployment.

State employment AI laws (US). If your team uses AI in hiring, performance evaluation, or HR workflows, you may be subject to New York City Local Law 144, the Illinois AI Video Interview Act, or, from January 1, 2027, Colorado SB 26-189 (deployer notices, adverse-outcome explanations and human review). The register's use case column, combined with the department column, surfaces which tools need state-level compliance review.

SEC examination readiness. For registered investment advisers and broker-dealers, the SEC's FY2026 examination priorities include AI tool oversight. Examiners will ask which AI tools your firm uses in compliance, advisory, or client-facing functions. A current, accurate register is your primary response document. Tools in client-facing functions should have a named supervisory procedure referenced in the register's notes column.

Link This to Your Other Governance Work

The register is an input, not an end in itself. Use it to:

• Feed your AI governance checklist quarterly review
• Prioritize which vendors to run through AI vendor due diligence
• Define scope for your AI usage audit
• Update your AI acceptable use policy as the tool list changes

A register that is updated and actually used is more valuable than a perfect one that nobody maintains. Start with a simple spreadsheet, keep it short, and build the habit of updating it monthly.

References

1. National Institute of Standards and Technology, AI Risk Management Framework (AI RMF 1.0)
2. European Parliament and Council, EU AI Act
3. OECD, OECD AI Principles

Correction (October 16, 2026): Earlier versions pointed to Colorado SB 24-205 deployer obligations. That law never took effect; SB 26-189 repealed and reenacted it, with deployer duties for decisions from January 1, 2027 (signed act).

Related Reading

• Norway's proposed temporary ban on AI glasses and a workplace wearables rule

• Shadow AI governance, detection and controls

• AI regulation deadline calendar 2026, every jurisdiction

• AI governance guide for small teams

• Governing embedded AI in third-party tools

• AI vendor due diligence in 30 minutes

• AI vendor due diligence checklist 2026, 30 questions

• Free AI register template, 12-field spreadsheet formatted for EU AI Act Article 70 compliance

• GDPR-compliant AI assistants comparison, helps you populate the privacy/DPA fields in the register

• AI risk decisioning governance checklist, extra fields to add when any registered tool makes automated decisions

• AI regulatory readiness scorecard, uses your completed register as input for the 25-question maturity assessment

• AI compliance checklist by team size: Tier 1 (1-10), Tier 2 (11-50), Tie

• AI Governance RACI Template for Small Teams: 12 Activities