In short
Before you buy another AI tool or write a policy, you need to know what is already there. The AI tools register is a one-page table: tool, who uses it, for what, with which data, who approved it. You build it in a week by asking the team with no blame, and it becomes the base for policy, permissions and training.
Key points
- A policy written without knowing which tools are in use governs a company that does not exist.
- The register is a five-column table, not a project: tool, users, use, data involved, owner.
- You build it by asking the team with no blame: people who fear a reprimand do not say what they use.
- The register also helps you decide what to buy: the functions you lack are often already inside tools you pay for.
- The register is never finished: review it every quarter and at every new purchase.
When a company decides to “do something about AI”, the first move is usually to buy a tool. The second is to write a policy. Neither works if you do not already know what is in the company.
The starting point is smaller and cheaper: one page that says who uses what.
The problem: tools arrive one at a time
AI does not enter a company through a project. It comes in with a subscription paid on someone’s card, a browser extension, or a feature that switches on inside software you already used.
The result is that nobody has the map. The owner thinks one tool is in use. The office uses three. The sales rep uses a fourth, from their phone.
Sometimes a team finds out for itself what AI can do. Someone builds a tool on their own, with a personal account, and whoever leads hears about it by chance. At times that is good news: it saves a cost. But it is still a chance discovery, not a decision.
The opposite case is more frequent. The owner knows AI is used in the company, but not how or why. In the companies I meet, this is the most common situation: AI is there, but whoever leads has no map.
This is the ground of shadow AI: not ill will, but the absence of a system.
What goes into the register
The register is a table with five columns. You do not need software.
The five columns
- Tool: name and version or plan (free, paid, business).
- Who uses it: people or roles, not just “the team”.
- For what: the concrete task (writing quotes, summarising documents, preparing analyses).
- Which data goes in: public, internal, confidential, customer or employee data.
- Who approved it and who answers for it: one person, with first and last name.
How to collect the information
- Ask the team, in a ten-minute meeting, which AI tools they use. Say it up front: no blame, the aim is to understand.
- Check invoices and company cards for subscriptions.
- Look at the AI features already switched on in the software you pay for: management system, CRM, email, office suite.
The question I start with is simple, and it does not judge:
“What is your experience with artificial intelligence?”
It asks for an experience, not a confession. From there come the tools, the uses and also the ideas the team has already tried.
What to do with the register
The register is not an archive. It serves to make three decisions.
1. Which tools stay, which go
Tools that handle confidential data through personal accounts are the first to replace with a company tool. The right tool is the one the team actually uses, not the one management likes.
2. Which permissions each role needs
Not everyone should be able to upload everything. A simple rule is in the operational checklist for an AI policy in SMEs: neutral data is free to use, internal documents only in company tools, price lists and customer data only in controlled environments.
3. What to buy, if anything
Often the function that seems to be missing is already inside a tool you pay for. The register shows it before a new purchase.
Mistakes we see repeated
- Doing it once. The register goes stale in three months. Review it every quarter and at every new purchase.
- Leaving it to IT alone. IT sees the installed tools, not the ones used in a personal browser.
- Turning it into an investigation. If people fear a reprimand, the register will be incomplete exactly where you need it.
- Not assigning an owner. A register with no name next to each row is a list, not a control.
- Building it for the analyst, not the decision-maker. In Italy, as I see it, we are a Republic founded on Excel: registers built to be read by system integrators, never by owners. An AI register the owner cannot read in five minutes governs nothing.
The next step
If someone asked you tomorrow which AI tools your company uses, who uses them and with which data, how long would it take you to answer?
The SME diagnostic starts from this and tells you in a few minutes where you stand. For the full path, see For Companies. For the wider picture on governing AI without blocking it, read How to govern AI in an Italian SME.
Frequently asked questions
What is an AI tools register?
A list, even in a spreadsheet, of the artificial intelligence tools used in the company: which ones, who uses them, for which tasks, with which data and who approved them.
How long does it take to build one in an SME?
For a first usable register, usually a week: a few days to collect the team's answers and one short meeting to classify the tools and assign an owner.
Is the register also needed for the AI Act?
It is not an obligation in itself, but knowing which tools you use is the starting point for meeting the obligations that already apply, such as staff AI literacy. For the updated picture, see the article on the high-risk delay.