AI tool register for small businesses

An AI tool register for a small business is a simple list of the AI systems your team uses, what each one is allowed to do, who owns it and when it was last checked. It gives you one place to answer a surprisingly difficult question: where is AI already part of the business?

The register does not need to be a governance platform. For a small team, a controlled spreadsheet can be enough. The value comes from keeping the list complete, assigning real owners and using it to make decisions, not from building an impressive document that nobody updates.

Here is a practical structure you can set up without turning the exercise into a technology census.

Why an AI tool register is worth keeping

AI use can spread quietly. Somebody adds a meeting assistant, another person tests a writing tool, and a software supplier introduces an AI feature inside a product the team already uses. Each decision may look small. Together, they change where business information goes and how work gets produced.

The National Cyber Security Centre describes unauthorised AI tools as a form of shadow IT. Its guidance explains that unknown assets are harder to protect because the organisation does not have a complete view of what it needs to manage. It also notes that people often adopt unofficial tools because an approved process is slow or does not meet the job they are trying to do.

A register makes that use visible. It helps you:

distinguish approved tools from experiments and blocked services;
see which systems receive customer, employee or confidential information;
find the person responsible for a tool when a feature, price or policy changes;
connect each tool to its risk assessment, contract, instructions and review history;
remove old accounts and integrations instead of leaving them running;
spot repeated needs that the approved technology does not currently meet.

This is not just an enterprise idea. The UK Government’s AI Management Essentials tool starts with an AI system record and asks whether an organisation documents all the AI systems it develops and uses, has a process for adding new systems, collects information from third-party providers and reviews the record regularly. The accompanying guidance says the tool is primarily intended for SMEs and start-ups.

Decide what belongs in the register

Include a product, feature or workflow when AI contributes materially to a business task. That could include:

a standalone generative AI assistant;
an AI meeting transcription or summarisation service;
a writing, design, research or analytics feature inside another platform;
an automated workflow that uses an AI model through an integration;
an AI agent connected to email, documents, customer records or publishing tools;
a supplier system that uses AI to score, recommend or make decisions about people.

You do not need to list every conventional automation. A fixed rule that copies a form response into a spreadsheet is not automatically an AI system. Concentrate on tools that generate, infer, classify, recommend or act using AI, especially where the output affects customers, staff, money, public content or access to business data.

Record experiments too, but give them an explicit status such as trial only. A trial can still involve a real account, uploaded data or a connection to another system. Hiding it until somebody decides whether to buy it defeats the purpose of the register.

Use 12 fields for a useful first version

Start with one row per tool or distinct AI-enabled workflow. These 12 fields are enough to support most small-business decisions:

Tool or system name: Use the supplier and product name, plus the feature if only part of the product uses AI.
Status: Mark it proposed, trial, approved, restricted, suspended or retired.
Business purpose: Describe the job it supports in one sentence, not a vague label such as “productivity”.
Team and owner: Name the team using it and one person accountable for its review.
Users: Record who can access it, including shared accounts, external suppliers and automated connections.
Information used: List the categories of data entered, accessed or created, such as public content, customer enquiries, employee notes or sales records.
Connected systems: Note integrations, plug-ins, APIs and folders the tool can read from or write to.
Output and action: State what it produces and whether it only drafts, recommends, updates records, sends messages or takes another action.
Human check: Name the person or role that reviews the output and the point at which approval is required.
Key evidence: Link to the supplier terms, privacy information, contract, internal instructions, risk assessment and any data protection assessment.
Decision: Record why the use was approved, restricted or rejected, plus any conditions.
Dates: Include the approval date, last review, next review and retirement date where relevant.

Keep the cells short and link to supporting documents rather than pasting long assessments into the register. The register is an index and decision record, not a replacement for every other control.

If you already maintain an information asset register, software inventory or record of processing activities, connect the records instead of duplicating them. The Information Commissioner’s Office says organisations should document their processing activities and review accountability measures over time. Its AI governance and accountability toolkit also recommends mapping information flows and keeping processing records accurate and easy to amend.

An AI register does not by itself satisfy UK GDPR documentation duties. Where a system uses personal information, check what separate records, lawful basis, contracts, privacy information or data protection impact assessment may be required for the actual use.

Find the tools you do not know about

Do not start by emailing a blank spreadsheet and asking people to fill it in. Give the team examples and ask about the work, not only the product names.

Use a short discovery conversation:

Which tools summarise meetings, documents or customer messages?
Where do you ask AI to draft, rewrite, translate or analyse work?
Which browser extensions or add-ons can read company pages or files?
Has a supplier switched on an AI feature inside an existing product?
Are any workflows connected to email, cloud storage, a CRM or the website?
Which tools would people miss if access stopped tomorrow?
Have people created free or personal accounts to get around an unavailable feature?

Then compare the answers with practical evidence you are authorised to inspect: the approved software list, expense claims, browser extension management, identity provider applications, shared inbox rules and integrations inside core platforms. The aim is not to catch people out. It is to find useful demand and unmanaged risk.

The NCSC says shadow IT is rarely malicious. Treat an undeclared tool as a signal to understand the job it solves. If the need is legitimate, provide a workable approval route or an approved alternative. A policy that only says “do not use unapproved AI” can push the same behaviour further out of sight.

Our AI policy guide for small businesses provides the rules around approved tools and data boundaries. The register is how you make those rules operational by showing which tools have actually passed the process.

Give every new tool the same route

A register stays useful only if new systems enter it before normal use begins. Keep the intake small enough that people will use it.

Ask the requester for six things:

the job they want to improve;
the proposed tool and plan level;
the information it will receive;
any systems it needs to connect to;
the output or action it will produce;
the person who will own and review it.

From there, choose a proportionate check. A public-information research trial with no integration may need a brief owner review. A system that reads customer records, makes recommendations about people or sends messages may need security, contract, data protection and operational checks before a trial is appropriate.

Do not let “approved” become permanent. Approval belongs to a defined use, information boundary and set of connections. If a team wants to add customer data, enable an agent, connect a mailbox or automate sending, update the record and reassess the change first.

For higher-risk workflows, use an AI risk register to examine what could go wrong and a human-in-the-loop workflow to design the approval gate. The tool register points to those records and shows who owns the result.

Review the register without creating busywork

Set a regular review, then add event-based triggers. The AI Management Essentials self-assessment asks whether an organisation reviews its AI system record at least twice a year, annually or less often. That provides a useful benchmark, but the right frequency depends on the use and risk.

A small team could review the complete list every six months and review higher-impact systems more often. Review immediately when:

the supplier changes important terms, data use or hosting arrangements;
a new AI feature or model changes how the product behaves;
the tool gains access to another account, dataset or action;
an error, complaint, security event or data incident occurs;
the owner changes role or leaves the business;
the team stops using the system;
the original purpose, audience or risk changes.

During the review, ask whether the tool is still needed, whether the recorded use matches reality, whether users and connections are correct, whether the human check works and whether the evidence remains current. Record the decision and next review date.

Retirement needs a process too. Revoke integrations and tokens, remove users, export records you legitimately need, handle retained data under the contract and your own retention rules, and confirm who will own any replacement workflow. Change the register status to retired rather than deleting the history.

Turn the register into a management tool

Once the inventory is reliable, use it to make better choices. Sort it by data sensitivity, customer impact, cost, owner or next review. Look for:

several tools doing the same job;
tools with no active owner;
trials that quietly became business-critical;
systems with broad access but a narrow purpose;
approvals with no review date;
workflows that still depend on shared personal accounts;
repeated corrections that suggest poor instructions or unsuitable tooling;
retired tools with live integrations or continuing charges.

That turns the register from a compliance list into an operating view. It can guide training, reduce duplicate subscriptions, prioritise risk work and show where an AI marketing audit should look more closely.

Start with what is in use today. Give each item an owner, purpose, information boundary and next review. Then make the register part of the route for new tools. A complete, modest spreadsheet that changes decisions is far more useful than a sophisticated inventory assembled once and forgotten.

Frequently asked questions

What is the difference between an AI tool register and an AI risk register?

An AI tool register lists the systems and workflows the business uses, including their owners, purpose, data access, status and review dates. An AI risk register records specific things that could go wrong, their likelihood and impact, controls and actions. Link the two: every important AI risk should point to the relevant system, and higher-risk systems should point back to their assessment.

Can a small business keep its AI register in a spreadsheet?

Yes. The NCSC says asset management for a very small organisation can be as simple as a manually maintained spreadsheet, while the Government’s AI Management Essentials guidance says an AI system record may be held in shared-drive files or a wider management system. Control access, name an owner, keep a change history and make updating it part of approval and review.

Should free AI tools and employee trials be included?

Yes, if they are used for business work. Mark them as proposed or trial rather than approved, record the information and connections involved, and set an end or review date. A free plan may have different contractual, security or data-use conditions from a business plan, so do not treat the price as an indication of risk.

How often should an AI tool register be reviewed?

Review the full register on a defined schedule, such as every six months for a small team, and use shorter intervals for systems with greater access or impact. Also review when a supplier, feature, data source, integration, owner or business purpose changes. The date matters less than having a repeatable cycle and clear triggers between scheduled reviews.

Need a clear view of the AI already inside your business? Book an AI marketing audit to map the tools, workflows and controls worth improving first.

Sources checked on 30 September 2026: UK Government AI Management Essentials tool, NCSC shadow IT guidance and the ICO AI governance and accountability toolkit. This is practical business guidance, not legal advice.