AI Asset Register

With so many new AI tools being made available every day, it’s more important than ever that organisations are aware of the tools their staff are using.

New AI tools are landing in our inboxes, browsers and phones every week. Staff are using them to take meeting notes, draft funding applications, write social posts, generate images and summarise policies.

Most not-for-profits have less visibility over their staff AI use than they realise. For leaders in small to mid-sized organisations, closing that gap is a key first task. What's needed is an accurate list of what's already in use, and an AI Asset Register is the most practical way to build and maintain that list.

A spreadsheet is sufficient. What matters is that the register exists, that someone owns it, and that it is reviewed often enough to stay current.

Why should you implement an AI Register?

The primary purpose of a register is visibility. Without it, decisions about risk, training and procurement are made without a clear picture of what is deployed. With it, organisations can begin to address the harder questions: which tools are approved for use with client data, which require further review, which should be retired, and who is accountable for each one.

There is also a governance benefit. When a board member, funder or auditor asks what AI your organisation is using, a register provides an immediate and credible answer.

⬇️ Download the AI Asset Register template below ⬇️

What to track in the register

We've put together a template you can download and adapt. The columns below are what we'd recommend including, and why each one earns its place.

Solution ID

A unique identifier for each entry. We recommend using the format AIS-### (e.g. AIS-001).

Date Added

Date this solution was first added to the register (YYYY-MM-DD).

Name

The name of the tool itself recorded specifically enough that a colleague reading the register a year from now can identify exactly what is being referred to. Distinguish between vendor platforms and custom builds developed on top of them.

Team(s)

Team or department that owns or operates this solution.

Business Owner

Named individual accountable for the solution.

Purpose

What problem does this tool solve? A plain-language description of what the tool does. Try to keep to 1-2 sentences at most.

Client Facing

Whether the tool interacts with the people your organisation serves, directly or indirectly. This is where risk considerations become most acute, particularly for organisations working with vulnerable populations.

Status

The tool's position in its lifecycle. Common values include proposed, in development, in production and deprecated.

Risk

A consistent rating against a simple scale. Low, medium and high categories are sufficient for most organisations, as is a 1–5 numerical scale. Consider data sensitivity, autonomy and impact.

Next Review

The date by which the entry is due to be reassessed. Three to six months is a reasonable default for most entries, with shorter cycles applied to anything rated as higher risk.

Notes

Supporting information that does not fit cleanly into the other columns, or anything else worth recording - vendor, model, dependencies, caveats.

Be across your organisation’s AI use

Formally registering your AI assets means knowing what is in your environment to inform sensible and appropriate decisions for the safety of your staff, clients and organisation’s reputation. For most APAC not-for-profits, a register is a simple first step toward AI governance that makes every subsequent decision easier.

Ready to build your organisation’s AI Use Policy? We have a DIY template ready to save you the hard work and get you on the pathway to safe and responsible AI adoption.