An AI use register is a single list of every place your firm uses AI. APRA's letter expects regulated firms to keep an inventory of AI tools and use cases. Even if you aren't APRA-regulated, it's the first thing a board, auditor or insurer will ask for.
Keep it simple. One row per use. If it takes more than a few minutes to fill in a row, you've made it too complicated.
| Field | What to write |
|---|---|
| Use case | What the AI does, in one line (e.g. drafts the first version of annual review letters) |
| Owner | One named person |
| Tool and model | The product and the AI model behind it, if known |
| Supplier | Who provides it, and where they store your data |
| Data used | Client data, personal information, documents, nothing sensitive |
| Who sees the output | Staff only, clients, a regulator |
| Human review | Who checks it, and before what step |
| Risk rating | Low, medium or high, with a one-line reason |
| Approved by and date | Who said yes, and when |
| Monitoring | How you check it still works, and how often |
| Exit plan | What you'd do if you had to stop using it |
Three tips
- - Include tools staff started using on their own. That's usually where the surprises are.
- Include AI features inside software you already own, like a meeting assistant in your video tool.
- Review it every quarter, and any time a supplier changes its model.
Source for the inventory expectation: APRA letter, 30 April 2026.