Free template + interactive tool · No sign-up · Browser-only
AI Use Register Template for Small Business
Build a simple living record of the AI tools and use cases already in your business. Use the template here, or download a blank CSV and work in Excel or Google Sheets.
When a client, procurement team, insurer or manager asks where your business uses AI and what happens to their data, a current register gives you a factual place to start.
What is an AI use register?
An AI use register is a living list of how AI is actually used in your business. Record one row per real use case — not just one row per vendor — so you can see the tool, purpose, owner/users, data category, approval status, human review and review date. It is a visibility and evidence-preparation tool, not a compliance certificate.
Your AI use register
No uses recorded yet
Start with one real use case. Add another row only when the task, data or review process is materially different.
Your entries stay in this browser unless you download them.
No AI uses recorded yet
Start with a tool and the real task you use it for.
What to track: the nine free fields
- AI tool
- The product, model or service name.
- Owner
- The person or role accountable for this use.
- Team / department
- The team or people who use it.
- Business use case
- The real task. Use separate rows for materially different tasks, even with the same tool.
- Data category
- The kind of information that can enter this workflow.
- Approval status
- Approved, restricted, pilot, pending, blocked or retired.
- Human review
- Whether a person checks the output before it matters externally or materially.
- Review date
- When this row should be checked again.
- Notes / evidence
- Useful links, settings, policy notes, open questions or evidence. Keep unknowns UNKNOWN rather than guessing.
How to build an AI use register
Build a first draft in 10 minutes; leave facts that need checking as UNKNOWN.
Ask what is actually in use
Ask each team what AI they actually use for work, including AI embedded in software the business already pays for.
Add one row per real use case
Record the real task, not just the brand. Give materially different uses of the same tool separate rows.
Record responsibility and data
Add the accountable owner, the team or users, and the category of information that can enter the workflow.
Record approval and human review
Record whether the use is approved, restricted, a pilot or pending review, and whether a person checks important output.
Keep unanswered facts UNKNOWN
Put unanswered facts in Notes as UNKNOWN, with the question or evidence to check. Do not invent an answer.
Set the next review
Set a review date and update the row whenever the tool, use, data, owner or settings materially change.
Three fictional examples
Fictional examples — not customer claims.
| Business | AI tool | Business use case | Team | Data | Approval | Human review | Notes / evidence |
|---|---|---|---|---|---|---|---|
| 8-person marketing agency | ChatGPT Team | Draft first versions of campaign copy | Marketing | Internal/public | Approved with restrictions | Yes | Client confidential data excluded by team rule. |
| 12-person accountancy | Microsoft Copilot | Summarise internal Teams meetings | Operations | Internal | Pilot | Yes | Retention/config evidence still UNKNOWN and being checked. |
| Small warehouse/distributor | Canva AI | Draft recruitment and social graphics/captions | Office/marketing | Public/internal | Pending review | Yes | Account ownership needs to move from an employee to a business-controlled account. |
Why one row per use case?
The same AI tool can appear more than once when the task, data or review arrangements are materially different. ChatGPT for public-data marketing drafts and ChatGPT for summarising customer support tickets should be separate entries: the information involved and the checks needed may differ.
When to review a row
- A new AI tool or use case is added.
- Vendor or account settings materially change.
- A new data category or client workflow is involved.
- Ownership changes.
- An external questionnaire or request arrives.
- An AI-related incident or near-miss reveals a gap.
Some small teams also schedule a periodic review. Choose a rhythm that fits your actual use; this template does not prescribe a universal legal frequency.
Why keep an AI system inventory?
The NIST AI Risk Management Framework includes a governance outcome calling for mechanisms to inventory AI systems. NIST's framework is voluntary guidance, not a legal requirement for every small business.
NIST AI RMF Core · Further reading: NIST AI RMF Playbook: Govern
From a register to client AI questions
A current register is a foundation for answering client or procurement AI questions, but it is not the whole evidence set. You may also need confirmed settings, policies, evidence and a clear record of gaps.
How to answer a client AI questionnaireFrom inventory to action
A register tells you what exists. Readiness tells you what needs control.
Once you know which AI tools are in use, the next question is which gaps matter most. The AI Readiness Assessment scores eight areas and turns them into a prioritised 30/60/90-day plan.
The free register gives you the structure and you maintain it yourself. The AI Readiness Operating Pack is a separate business-specific service that organises confirmed facts, evidence, gaps, policies and external-response material for a real request.
Frequently asked questions
What is an AI use register?
An AI use register is a living list of how AI is actually used in your business. Record one row per real use case, including the tool, purpose, owner, users, data category, approval status, human review and review date. It is a visibility and evidence-preparation tool, not a compliance certificate.
Is an AI use register legally required?
There is no universal rule requiring an AI use register for every small business. Requirements can vary by jurisdiction, sector and profession. NIST's AI Risk Management Framework is voluntary guidance, not a universal legal obligation. Check the obligations that apply to your business where relevant.
Is this the same as an AI policy?
No. A register records actual AI use. A policy sets the rules and boundaries for that use. They serve different purposes and can support each other.
Should the same AI tool appear more than once?
Yes, when it is used for materially different tasks, data categories or review processes. One row per real use case makes those differences visible.
How often should I update it?
Update a row when the use, tool, data, owner or account settings materially change, or when a request or incident reveals a gap. Some small teams also schedule periodic reviews; there is no universal legal review frequency stated by this template.
Where is my data stored?
Your entries stay in this browser's local storage unless you download them. Register contents are not sent to WorkplaceReady servers. If you clear your browser data, the register is lost.
What is the difference between the free template and WorkplaceReady AI Readiness or Operating Pack?
The free template is a self-maintained inventory. The AI Readiness Assessment helps prioritise readiness gaps. The separate AI Readiness Operating Pack organises business-specific confirmed facts, evidence, gaps, policies and external-response material for a real request. Neither is certification or legal advice.
Related Business Readiness Tools
Continue with another practical tool from WorkplaceReady.
Readiness Assessment
AI Readiness Assessment
The premium next step after the free exposure check: an eight-area AI readiness baseline with prioritised actions and a 30/60/90-day plan.
OpenAI & Technology
AI Exposure Check
Find out whether AI use inside your business is creating unmanaged data, security, decision-making or operational risk. Free practical exposure check — not a compliance audit or legal assessment.
OpenCybersecurity
Cyber Attack Exposure Check
Quickly estimate how exposed your business may be to today's most common cyber threats — phishing, business email compromise, ransomware and more. Practical estimate, not a penetration test.
Open