An AI registry is a structured, centralised inventory of every AI system an organisation develops, deploys, or procures. It is the foundation of responsible AI governance — you cannot manage risks you have not catalogued.
Why AI Registries Are No Longer Optional
Three converging forces are making AI registries mandatory for most organisations:
- The EU AI Act requires high-risk AI providers to maintain technical documentation and register systems in a public EU database before market placement
- ISO 42001 requires organisations to maintain records of AI systems as part of their AI Management System
- Enterprise customers are adding AI disclosure requirements to vendor contracts, asking suppliers to list every AI system that touches their data
What an AI Registry Must Contain
A compliance-grade AI registry should capture, at minimum:
- System identity — name, version, internal ID, owner, and responsible team
- Purpose and use case — what the system does, what decisions it informs or automates
- Risk classification — EU AI Act tier, internal risk rating, and applicable regulations
- Data inputs — what data the system consumes, including personal data categories
- Model provenance — foundation model or algorithm used, training data sources
- Deployment context — where the system runs, who uses it, and in which jurisdictions
- Human oversight controls — what human review or override mechanisms exist
- Monitoring and performance — how the system is tracked for accuracy, drift, and bias
- Incident history — documented failures, near-misses, and corrective actions
The Difference Between a Spreadsheet and a Real Registry
Many organisations start with a spreadsheet. This works for the first three to five AI systems. Beyond that, spreadsheets break down: they go stale, they lack audit trails, they cannot be queried for regulatory reporting, and they create single points of failure when the person maintaining them leaves.
A production-grade AI registry provides versioned records, change history, role-based access, integration with deployment pipelines, and automated alerts when systems are updated or go out of compliance.
Who Owns the AI Registry?
Ownership is a common stumbling block. The registry spans multiple functions — engineering (knows what was built), legal/compliance (knows what's regulated), and procurement (knows what was purchased). The most effective model is a central AI governance function that owns the registry with mandatory submission requirements for all teams deploying AI.
Building Your First AI Registry
Start small and expand:
- Send a discovery survey to all engineering, data science, and product teams asking them to list AI systems in production
- Include AI embedded in third-party SaaS tools — most organisations undercount these by 40–60%
- Classify each system by EU AI Act risk tier and assign an owner
- Prioritise high-risk systems for immediate documentation
- Establish a mandatory registration process for all new AI deployments