When should a new row be created?
When a team starts considering or using a new AI application — even before formal approval, a PoC or backlog entry. A distinct process or purpose needs its own row.
Open portfolio template
AI system and use-case register
What is an AI use-case register? An AI use-case and system register is a shared inventory of every AI initiative, including shadow AI tools. For each entry, it records the use, owners, stage, data, supplier or model, volume, impact of error and review date. It does not decide legal classification, provider/deployer role, risk level or a go/no-go outcome. The AI portfolio owner or a nominated coordinator maintains the register, while business and technical owners keep their entries current.
Capture every AI initiative in one place — including work created outside the official backlog. The register shows what exists, its current stage and who needs to review it next.
Register parameters
Register owner
Organisational scope
Register version
Review cadence
Operational questions
When should an entry be updated?
When the owner, stage, supplier, model, data, integrations, user group or scale of use changes, and at the agreed review date.
Who approves the status?
The person with the mandate recorded in governance or the RACI for that stage. The register owner checks completeness but does not approve status by default.
When should a risk review or Evidence Pack be opened?
Open a risk review when the data, use, impact of error or legal roles are unclear. Create an Evidence Pack for a specific version before testing, pilot or production, and update it after a material change.
How to use the register
Start broad
Include ideas, pilots, SaaS tools with AI features and local team automations — not just approved projects.
Record facts, not verdicts
Provider/deployer role and risk-review outcome remain for the appropriate people to verify.
Set a review cadence
Update the entry when its stage, supplier, model, data or user scope changes.
Move to evidence
For a system entering testing or production, open a separate Evidence Pack for the specific version.
Three artefacts, three different questions
The register answers: what exists in the portfolio.
One list of initiatives, owners, stages and review dates.
RACI answers: who does the work and who owns the outcome.
Roles and accountability for acceptance, data, risk and system operation.
The Evidence Pack answers: what evidence exists for a specific system and version.
Tests, logs, criteria, limitations and the go/no-go decision for the named version.
Stage and maturity
IdeaPoCPilotProductionRetired
Record one current stage. If an initiative is stuck between stages, explain that in “Last / next review”.
AI portfolio register
Each row describes one system or one clearly distinct use case. Do not combine different processes just because they use the same model.
| # | System / use case | Business owner | Technical owner | Department / unit | Stage and maturity | Data and integrations | Supplier / model | Estimated volume | Impact of error | Provider / deployer — review required | Risk review | Evidence Pack status | Last / next review |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | |||||||||||||
| 2 | |||||||||||||
| 3 | |||||||||||||
| 4 | |||||||||||||
| 5 | |||||||||||||
| 6 | |||||||||||||
| 7 | |||||||||||||
| 8 |
Whole-register review
Last portfolio review date
Next review date
Review participants
Material decisions and escalations
What to do with each row
Is the process not ready for a PoC yet?Check the foundations with the AI Readiness Scorecard.Is the system entering testing or production?Open a separate Evidence Pack for the specific version.Does the AI Act scope need checking?Review current dates, roles and assessment scope.Is it unclear who approves the status?Assign accountability and decision authority in the RACI.Does the portfolio need a broader diagnosis?See what the AI readiness audit covers.Do you need implementation support?See services from audit to accountable operation.
Tool boundary: This register is an inventory tool. It is not legal advice, a risk classification or an automated conformity assessment. A “provider / deployer” entry and risk-review status are points for verification, not legal conclusions. Register accuracy depends on an accountable owner and an agreed review cadence.