What should an AI use register contain?

Why the question comes up at all

The record of processing activities has its basis in Article 30 GDPR. For artificial intelligence there is no provision on an internal list of use cases. The question about a register therefore looks like a question about good practice. It looks that way until the first time a client or an auditor asks where AI is at work in the organisation.

The second reason is organisational. Artificial intelligence entered the organisation by several routes at once. Some tools were bought deliberately. Some appeared as a new feature in software used for years, and some were built by teams on general-purpose models. None of those routes ends with an entry in any list.

The third reason concerns evidence. The Regulation does not provide for an internal list of use cases. It does speak of informing, of oversight and of assessment. Each of those activities requires knowing what it applies to. Article 49 provides for registration in the EU database of selected systems listed in Annex III. That registration falls on providers or, where applicable, their authorised representatives. It also falls on public authorities and Union institutions, bodies, offices or agencies that deploy such high-risk AI systems. The same applies to persons acting on their behalf. An entry in that database does not replace an internal list of use cases.

What to establish before deciding

Three obligations that already bind

The register should primarily make it possible to perform the obligations that apply today.

AI literacy, Article 4, since 2 February 2025. Since 27 July 2026 the provision has had the wording given to it by Regulation (EU) 2026/1744. Providers and deployers take measures supporting the development of AI literacy among their staff and other persons dealing with the operation and use of the systems on their behalf. The provision states expressly that the duty does not mean guaranteeing a particular level of AI literacy in individual people. It is therefore a duty of care rather than of result.

Performing it requires knowing who uses which tool and in what role. Without that knowledge, training reaches either everyone or nobody.

Prohibited practices, Article 5, since 2 February 2025. The prohibition does not depend on the risk classification. It concerns what the system does and how the organisation uses it. The register should therefore describe the intended purpose and the manner of use precisely enough to be set against the list of prohibitions. Two new prohibitions take effect on 2 December 2026. For those two the conditions of infringement depend on the role (Article 5(1a)). A deployer infringes them only where it uses the system for the purpose of generating the prohibited material or manipulating it.

Transparency, Article 50, since 2 August 2026. The obligations divide according to role. The provider ensures that a system intended to interact directly with people is designed and developed so that they are informed that they are interacting with an AI system. Among other exceptions, the duty does not apply where this is obvious to a reasonably well-informed, observant and circumspect person. Obviousness is assessed taking into account the circumstances and the context of use. The provider is also responsible for marking synthetic content in a machine-readable format. A provider whose system generating synthetic content was placed on the market before 2 August 2026 has until 2 December 2026 to do so (Article 111(4)). The deployer informs people about emotion recognition and biometric categorisation. It also discloses deep fakes and text published with the purpose of informing the public on matters of public interest. The duty concerning text does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication.

In the register this comes down to three questions for each use case. Does the system talk to people? Does it generate content? Does it recognise emotions or categorise people on the basis of biometric data?

What to add now, so the register is not built twice

The obligations in Articles 25 and 26 concern high-risk AI systems. They sit in Chapter III Section 3. They start to apply on 2 December 2027 to high-risk AI systems under Annex III and on 2 August 2028 to high-risk AI systems under Annex I. They do not bind yet.

That is not a reason to leave them out of the register. The fields they will call for are already known. Filling them in after the fact costs more than entering them straight away.

The date of placing the system on the market or putting it into service settles whether and from when the obligations in Articles 25 and 26 will cover a high-risk AI system. For operators of a high-risk AI system placed on the market or put into service before the date of application of Chapter III, the Regulation applies only after a significant change in its design (Article 111(2)). This is without prejudice to the application of the prohibitions in Article 5. In any case, providers and deployers of high-risk AI systems intended to be used by public authorities must take the necessary steps to comply with the Regulation by 2 August 2030. According to recital 39 of Regulation (EU) 2026/1744, what decides whether the transitional period in Article 111(2) applies is the date on which the first unit of that type and model was placed on the market or put into service. The date on which the organisation bought the system is therefore not decisive.

Article 25 calls for knowledge of three things. It has to be known whose name the high-risk AI system runs under, whether it has undergone a substantial modification and whether a change of intended purpose has turned the system into a high-risk AI system. These answers have to be known at the moment of the change, not a year later.

For deployers of high-risk AI systems Article 26 adds elements worth knowing before 2 December 2027 (Annex III) or 2 August 2028 (Annex I).

• Automatically generated logs kept for a period appropriate to the intended purpose of the system, of at least six months (Article 26(6)). The obligation covers logs under the deployer’s control. Applicable Union or national law, in particular Union law on personal data protection, may provide otherwise. The retention decision is made when the tool is configured, not when it is audited.
• Informing workers before a high-risk AI system is used in the workplace (Article 26(7)). The employer informs workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system. This obligation is easy to overlook. It looks like a matter of employment law and it sits in a regulation on AI.
• Human oversight assigned by name. The provision calls for natural persons who have the necessary competence, training and authority, as well as the necessary support. An entry reading “oversight by the process owner” does not show that any of those conditions is met.
• Information from the provider under Article 13. The deployer uses it for the data protection impact assessment where one is required. This is where the AI register connects with the GDPR documentation.

What does not belong in the register

The register does not replace the assessment. An entry reading “recruitment system, high risk” is a conclusion rather than a finding. Without a record of the reasoning it evidences nothing.

Nor is the register a list of tools. The unit of entry is the use case, meaning a specific use of a system in a specific process. The same tool used for drafting content and for initial screening of candidates produces two entries with different classifications.

Finally, fine levels and estimates of the likelihood of inspection do not belong there. As a rule, under Article 5(1) of the Polish Act on Artificial Intelligence Systems, Poland’s market surveillance authority for AI systems is the Commission for the Development and Security of Artificial Intelligence (the AI Commission). The AI Office has exclusive competence over the providers of the systems listed in Article 75(1) of the Regulation. The obligations under the Regulation bind regardless of how far the national authority has been set up.

Conclusions and next steps

An internal AI use register is not a legal obligation, and presenting it to the board as one does not help. It is a precondition for performing the obligations that already bind. It is also the basis for an answer given to a client or an auditor.

The order that produces a result fastest.

1. Collect use cases from process owners rather than from IT. IT knows the tools; process owners know how they are used.
2. For each use case answer the three Article 50 questions — interaction, synthetic content, emotion recognition and biometric categorisation.
3. Set the intended purpose against the list of prohibited practices. This is the one part that does not tolerate delay.
4. Assign the role of the organisation and record the reasoning, not just the outcome.
5. Name the person responsible for keeping the entry current, and the review date.

The evidence that this work was done is a register in which every entry carries an author, a date and a reason for the classification. A register without those three is a list of tools, not documentation.

Related materials

• When does an organisation using AI become the provider of a system? — the role assessment the register is meant to make possible.
• Who is responsible for AI Act transparency obligations? — the three Article 50 questions in full.
• What should a personal data breach register contain? — the same problem under the GDPR. The provision speaks of documentation, not of a register.
• What does the AI literacy obligation require? — the obligation for which the register of uses is the starting point.
• What new prohibitions does the AI Act introduce from 2 December 2026 and whom do they cover? — two new Article 5 prohibitions to check for every generative tool.

Sources

• Regulation (EU) 2024/1689 (AI Act), consolidated text as of 27 July 2026, Articles 4, 5, 6, 25, 26, 49, 50, 75, 111 and 113 — eur-lex.europa.eu.
• Regulation (EU) 2026/1744 of 8 July 2026 amending Regulation (EU) 2024/1689, recital 39 — OJ L, 2026/1744, 24.7.2026.
• Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003) — Article 5(1) (in Polish).