What an AI use register should capture

Most organisations cannot say with confidence where AI is being used. Tools are bought by individual teams, and AI features arrive inside software that was already approved. An AI use register fixes the basic problem: it gives you one place that lists every AI system in use, what it is for, and who is accountable for it.

In October 2025 the Department of Industry, Science and Resources and the National AI Centre published the Guidance for AI Adoption, an update to the 2024 Voluntary AI Safety Standard. The guidance is voluntary. It recommends that organisations keep an AI register and publishes a template as a starting point. The department notes that the register should cover all AI systems, including AI features built into common software, and that it supports transparency but does not replace impact assessments or risk management.

Core fields

These reflect the fields in the government’s AI register template.

System name and version. A clear identifier, so everyone is talking about the same thing.
System owner. The named person accountable for the system, not a team or a vendor.
Status. Where it is in its life: for example pilot, operational or decommissioned.
Source. Who developed or provides the system, and whether it is built in-house, bought or embedded in other software.
Purpose and business goals. Why the organisation uses it and what it is meant to achieve.
Intended use cases. The specific tasks it is approved for.
Known limitations and prohibited uses. What it cannot do reliably and what it must not be used for.
Foreseeable misuse. Plausible ways it could be used beyond its approval, so controls can be designed around them.
Data sources and type. What data it learns from or processes, and in what form (text, images, audio, structured data).
Date registered. When it was first added to the register.
Risk screening result. The outcome of your initial risk screening, which decides how much oversight it needs.
Key stakeholders affected. Who could be affected by the system’s outputs: customers, staff, applicants, the public.

Fields worth adding for Australian privacy obligations

The Privacy Act applies whenever personal information is involved. These fields help connect the register to that work.

Personal information involved. Whether personal or sensitive information goes in or comes out, in broad categories.
Data location and provider access. Where data is processed and stored, and whether the provider can retain it or use it for training.
Decisions about people. Whether the system makes, or does something substantially and directly related to making, decisions that could significantly affect individuals. This matters for the automated decision-making disclosures that APP privacy policies must contain from 10 December 2026.
Privacy impact assessment. Whether one has been done, when, and where it is kept.
Human oversight. Who reviews outputs, and when review is required before action is taken.
Next review date. When the entry, and the approval behind it, will be checked again.

One illustrative entry

This generic row shows the level of detail to aim for. It is not a recommended configuration.

Field	Example
System name and version	Meeting transcription feature in collaboration software
System owner	Head of Operations
Status	Pilot
Intended use cases	Draft minutes of internal meetings
Prohibited uses	Client meetings, HR or disciplinary meetings
Personal information involved	Names and voices of attendees
Human oversight	Meeting chair reviews minutes before circulation
Next review date	End of pilot

Keeping the register useful

Give the register an owner and a simple way for staff to propose new entries.
Check procurement, software renewals and vendor release notes for new AI features.
Review entries on a set cycle and when a system, its terms or its use changes.
Make sure board and executive reporting draws on the register, so the picture is consistent.

Next step

A register shows what you have; it does not tell you whether the oversight around each system is adequate. Lexora’s AI Governance Readiness Assessment looks at that question across your AI use as a whole.

General information, not legal advice. The Guidance for AI Adoption is voluntary, and you should obtain legal advice on the obligations that apply to your organisation.