The AI Systems Register: The Document Your Regulator Asks For First

Most organisations cannot list the AI systems they already have in production. That list is the first thing an auditor asks for, and the cheapest artefact to build properly.

Ask a leadership team how many AI systems they have in production and you will usually get a confident number. Ask them to name the systems, their owners, and which ones touch a decision about a person, and the confidence evaporates. That gap is neither unusual nor embarrassing. It is simply the first thing a regulator asks about.

Why the register comes first Every other governance artefact depends on it. A risk classification needs a list of things to classify. An impact assessment needs to know which systems affect people. A controls framework needs an inventory to attach controls to. Without a register, governance work has nothing to stand on and quietly turns into a policy document nobody uses.

What belongs in it For each system: what it does, who owns it on the business side, which data it consumes, whether it makes or informs a decision about a person, what the consequence of a wrong output is, and when it was last reviewed. In a bank the owner is an accountable executive. In a hospital it is usually a clinical lead. The register is only useful if the named person would accept the phone call.

Where finance and healthcare differ Financial supervision tends to expect a central register that a compliance function maintains and can produce on request. Healthcare governance is more fragmented, spread across clinical, quality and information-governance functions, and often tied to patient-safety reporting channels. Same artefact, different reader, and the register should be written for the reader it will actually meet.

Conclusion Building the register takes weeks, not quarters. It is the cheapest piece of compliance work available to you, and the one that makes everything after it possible.