What is an AI register, and do we need one?
Short answer
An AI register is an overview of every use of AI in your business: what the AI is used for, which tool, which data, who is responsible and what risk the use carries under the AI Act. The AI Act doesn't require a register by that name, but without one you can't find high-risk uses, give the right staff the right AI literacy or answer a regulator. It is similar to GDPR's record of processing activities – and can be built together with it.
The fields in a good register
| Field | Example |
|---|---|
| Use | Draft replies to customer enquiries |
| Tool and plan | ChatGPT Business |
| Data | Customer names, orders, free text (pseudonymised) |
| Decisions about people? | No |
| Risk under the AI Act | Minimal |
| Responsible | Head of Customer Service |
| Confirmed | 3 October 2026 |
The register in GoalCube
In GoalCube the register builds itself: when an employee asks the AI for something new on company data, the AI registers the use, and GoalCube classifies it using fixed rules. Low risk is approved automatically; high-risk uses and decisions about people need a person to confirm first.
Approved automatically under your rules. Staff need sufficient AI literacy (Art. 4).
Users must be able to see they are talking to an AI (Art. 50). GoalCube has ready-made wording you can use.
Recruitment is listed in Annex III. A person confirms the use before the AI gets any data, and decides each case (Art. 14 and 26; Art. 22 GDPR).
Emotion recognition in the workplace is prohibited (Art. 5). GoalCube won’t help with it.
The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.
What to do
- Ask your staff.Which AI tools do they use, and for what? Including the free ones.
- Register each use separately.The same tool used for two purposes is two entries.
- Record the data and the purpose.Personal data? Sensitive data? Decisions about people?
- Find the risk.Prohibited, high-risk, limited or minimal.
- Have a responsible person confirm.Especially for high-risk uses and decisions about people.
- Keep it up to date.New uses of AI are registered before any data is shared.
What the law says
- Articles 4, 5, 26 and 50 AI Act
- The obligations depend on the use. A register is the practical way to keep track of them.
- Article 30 GDPR – records of processing activities
- The record of processing activities, which AI use on personal data is part of.
Questions and answers
How detailed should the register be?
Enough for an outsider to understand the use, the data and the risk. One line per use with a few fields is a good start.
Who should keep it?
A responsible role, for example HR, IT or management. Staff must be able to report new uses.
How does GoalCube register uses?
The AI registers the use based on the task, and a person confirms the answers. Only then does the AI get any data.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.