AI Tools Register: How to Create and Maintain It

An AI tool registry is a company document that lists all artificial intelligence (AI) systems in use - from "ChatGPT" to AI features in accounting software - along with information on who uses them, for what purposes, and which risk category they fall under. This is a key tool that helps companies understand what AI technology they actually use and demonstrate compliance with the EU AI Act. This registry is not a formality for its own sake - it helps identify the systems in use, assess their risks and plan relevant literacy measures; Article 4 does not prescribe this particular register.

Many Lithuanian companies believe that they "do not use AI". In reality, AI is present almost everywhere: in email clients, Microsoft 365 and Google Workspace, translation tools, accounting systems, and customer service bots. An inventory often reveals 5 - 15 systems where a manager expected none. This is precisely why the AI tool registry is the starting point for all other compliance documents.

What Is an AI Tool Registry and How Does It Differ from a Simple List?

An AI tool registry (sometimes called an AI system registry) is a structured document that records which AI tools a company uses, what data they process, and their associated risks. The difference from a simple "software list" is that the registry is compliance-oriented: each entry is assigned a purpose, a responsible person, and a risk category according to the EU AI Act.

Think of it as the company’s AI "asset accounting". Just as you record long-term assets in accounting, here you record AI systems. The only difference is that the risk here does not come from depreciation but from improper handling of personal data, incorrect decisions, or insufficient AI literacy among employees and other relevant persons.

The registry is a living document. It is not created once and forgotten but continuously updated as the company starts using new tools or retires old ones. For more on how not to neglect this discipline, read our article how to update AI documents.

Why Is an AI Tool Registry Useful Under the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) does not explicitly require companies to maintain a "registry" under that name. However, the registry is a practical way to fulfill three real obligations:

1. AI Literacy (Article 4, applicable since 2 February 2025). Companies must take measures to support the development of AI literacy for employees and other relevant persons, considering their knowledge, experience, training, the context of use, and the people who may be affected. To train people to work with specific systems, you first need to know which systems they use. The registry serves as the foundation for this training. Note: Article 4 does not require guaranteeing a specific or sufficient individual level of literacy.
2. Risk Classification. The EU AI Act categorizes systems into prohibited, high-risk, limited-risk, and minimal-risk categories. Without an inventory, it is impossible to know whether any of your tools fall under the high-risk category, which is subject to strict obligations. For more on categories, read our overview of AI Act risk categories.
3. Accountability Proof. If questions arise from a supervisory authority or a client, the registry, together with the Article 4 compliance record, allows you to demonstrate that the company consciously manages its AI use rather than using it haphazardly.

It is important to understand the timeline: the AI literacy obligation has been in effect since 2 February 2025, general-purpose AI model rules began applying on 2 August 2025 subject to transitional provisions, Article 50 transparency rules applied from 2 August 2026, and high-risk Annex III rules apply from 2 December 2027, while high-risk AI embedded in regulated Annex I products apply from 2 August 2028. This means that an inventory should already be in place, not left until the last minute. For more on deadlines, see the list of all articles.

What to Include in the AI Tool Registry? (Fields)

A good AI system registry does not need to be complex. A simple table with a few clear columns is sufficient for a company. Here is a minimal but adequate set of fields:

Start with the most important columns and do not aim for perfection. It is better to have a complete list of all tools with basic information than a highly detailed description of only two systems.

Which Tools Are Often Overlooked?

When conducting an inventory, do not forget about "hidden" AI:

• Office Suite Features - Microsoft Copilot, Google Gemini integrations in Workspace, Gmail smart replies.
• Accounting and Business Management Systems - Many already have built-in AI forecasting or document recognition. For more, read AI Tools in Accounting.
• Translation and Transcription Tools - DeepL, Whisper, meeting note generators.
• Image and Design Generators - Canva AI, Midjourney.
• Shadow AI - Tools that employees start using on their own, without management’s knowledge. For more on this risk, read Shadow AI in Companies.

How to Conduct an AI Inventory in a Company: Step by Step

An AI inventory is the process of gathering information about all AI systems in use. Here is a practical sequence for a company:

1. Survey the Team. Ask each employee to list the online tools and software they use for work. Even a 10-minute conversation often reveals more than a week of guesswork.
2. Check Subscriptions. Review which SaaS services you pay for - bills reveal many AI tools.
3. Identify AI Features in Existing Software. Check whether your current tools have enabled AI features.
4. Assess Data. For each tool, note whether it processes personal data. This is also important from a GDPR perspective - read more about the connection in AI and Personal Data (GDPR). Note: GDPR does not impose a blanket ban on AI tools; lawful basis, data minimization, approved tools, and safeguards must be assessed.
5. Assign Risk Category. For most company tools, this will be minimal risk, but check for exceptions.
6. Record in the Registry and Assign a Responsible Person.

This process should not be a one-time effort. The goal is to create a system that can be repeated every six months.

How the Registry Relates to Other Compliance Documents

The AI tool registry is not a standalone document - it is part of a larger set. A typical company documentation set includes:

• AI Usage Policy - Rules on how employees may and may not use AI. The registry shows what you use, while the policy defines how. For more, see AI Usage Policy in Companies.
• Compliance Record - A document confirming that the company has fulfilled Article 4 obligations, including inventory and training. See Article 4 Compliance Record. Note: Our documents and quizzes are practical tools, but they are not mandatory legal requirements or a guarantee of compliance.
• Employee AI Guide - Practical guidelines for daily use.
• AI Literacy Training - Based on the tools listed in the registry.

All these elements rely on the registry as their foundation. Therefore, it should be prepared first.

Practical Tips for Maintaining the Registry with Ease

A company does not need expensive software. Here are some practical tips:

• Use a Spreadsheet. Excel, Google Sheets, or even a shared document are perfectly sufficient.
• Link Updates to Existing Processes. For example, review the registry once a quarter along with invoice reviews.
• Introduce the Rule "New Tool = New Entry". When someone starts using a new AI system, it is immediately recorded.
• Keep the Registry Accessible. The responsible person must know where it is so they can present it when needed.

If you do not want to do all this manually, nebedirbam.lt automatically prepares a full set of compliance documents - AI usage policy, AI tool registry, compliance record, and employee AI guide - for a fixed €149 + VAT (€299) price without any human intervention. Documents are generated automatically from templates reviewed by a compliance specialist, using the company’s answers. Learn more on the homepage. For those who first want to learn, there are also free AI literacy training courses with knowledge checks. The free path is for one signed-in participant; team training is included in the paid documentation package.

Common Mistakes When Maintaining an AI System Registry

Observing how companies begin to organize their AI documentation, several recurring mistakes stand out:

• Registry Created "for the Sake of It". A few obvious tools are listed, but a real inventory is not conducted. The result is a registry that does not reflect reality.
• Shadow AI Is Ignored. Without surveying employees, half of the tools remain outside the registry.
• Forgetting to Update. The registry becomes a snapshot of the past, not a living document.
• Mixing Up Risk Categories. All tools are assigned the same category without proper assessment. For correct evaluation, refer to the AI Act Risk Categories overview.

By avoiding these mistakes, you will have a document that genuinely helps manage AI, not just one that takes up space in a folder.

Brief Summary

An AI tool registry is a list of all AI systems used by a company, including information on their purpose, users, data, and risk category. While it is not explicitly named as mandatory in the EU AI Act, it is a useful way to support literacy planning, risk assessment and evidence of the measures taken. Start with a simple spreadsheet, conduct a thorough inventory by surveying your team, assign risk categories, and update regularly. The registry is the foundation on which all other AI compliance documents are built.

Sources: The EU AI Act Article 4 explanations and European Commission’s AI Regulatory Framework provide official information on AI literacy obligations, timelines, and scope. The data from both sources align with the statements in this article.