Free resource · Word Kit

AI Governance Kit: Register, Declaration and Grid AI Act

Inventory, qualify and govern your organization's AI systems and agents within your collaborative tools, without a dedicated platform.

📄 Word, 15 pages🗂️ 15-column register🇪🇺 AI Act Qualification Grid🆓 Free

Download the kitSee the four levels of the AI Act

The scene repeats itself in all large organizations. A Copilot agent created by an account manager, a customized GPT shared within a department, an AI function activated by a vendor in the CRM, a pilot program launched by R&D: each of these systems engages the organization's responsibility, and most have never been declared. When the question arises, whether from senior management, an auditor, or the regulator, the honest answer is often, "We don't know exactly."

This page explains what an AI systems registry should contain, how to classify each system according to the European regulation, how to make decisions without creating bottlenecks, and how to maintain the system with a small committee. It is accompanied by a complete toolkit, in Word format, with the registry, form, grids, and template ready to use.

1. Why a register, and why now?

The register is the essential document without which nothing else holds together. You can't define what you don't understand, you can't train users on a system you don't know, and you can't produce audit evidence for an unregistered system. The European regulation on artificial intelligence effectively makes it an obligation for any organization using AI: avoiding prohibited practices requires knowing what you're using, complying with high-risk obligations requires having identified the systems involved, and training users under Article 4 requires knowing who is using what.

The second reason is speed. With agents, any trained employee can create a system in an hour that accesses documents, makes preparatory decisions, and serves an entire team. Organizations that had a few AI projects in 2024 will have hundreds by 2026, most of them developed outside of any established process. A governance framework that takes weeks to respond is bypassed; a non-existent framework leaves the organization discovering its infrastructure on the day of an incident.

The third reason is that the register is a deployment tool as much as a compliance tool. It reveals use cases that work and could be generalized, duplicates between departments, orphaned agents whose creator has changed positions, and it directly feeds into the training plan.

2. What is entered in the register, and how to find it

An "AI system" as defined by the registry is any software, service, or agent that produces content, recommendations, or decisions based on a model, whether purchased, embedded in vendor software, configured by a business unit, or developed in-house. Five categories cover the essentials:

Family	Examples	Where to find them
Generalist assistants	Copilot, ChatGPT, Claude, Gemini, Mistral, internal AI	Contracts and licenses, IT department
Agents and assistants created by the professions	Copilot Studio or Agent Builder agents, custom GPTs, Claude projects, Gems, Dust spaces	Tool administration consoles
AI embedded in software	AI features for CRM, HR suite, customer support, and security tools	Review of supplier contracts with purchasing
In-house development or external providers	Models and applications in production or pilot phase	Project portfolio, data, R&D
Automations that call for a model	Power Automate flow, Zapier, n8n, scripts	Interviews by management, AI ambassadors

The register itself consists of fifteen columns: identifier, name, type, department and owner, purpose, users, data processed, provider and model, sources and connectors, automatic or manual decision, AI Act level, verdict, conditions, status, and dates. It resides in a SharePoint list, a Notion database, or, to begin with, a shared workbook, with three rules: a single register for the entire organization, a named register owner, and locked columns. The kit provides the template with a completed example row and a three-source method for retrieving what no one has declared: administration consoles, departmental interviews, and supplier contracts.

3. The four levels of the AI Act, translated into questions

The regulation distinguishes four situations, which are not mutually exclusive. The kit's grid translates these into a four-question decision tree, based on the answers to the declaration form.

Level	Question to ask oneself	What this means for you
Prohibited practices (Article 5)	Is the system used to recognize emotions at work, to socially rate people, to manipulate or exploit vulnerabilities, to build facial recognition databases through untargeted collection?	Immediate cessation of proceedings and referral to legal action. Rare in a company setting, but to be explicitly ruled out.
High risk (Article 6, Annex III)	Does the system make, prepare, or influence a decision concerning individuals in matters of employment, access to credit or essential services, education, or biometrics?	Legal analysis, use in accordance with the supplier's instructions, trained supervisors, logs kept, information provided to employees and those concerned.
Transparency (Article 50)	Do people interact with the system or do they receive generated content (chatbot, realistic images or voices, texts published without proofreading)?	Informing people, reporting generated content. This is in addition to the other levels.
Minimal risk	None of the above: writing, summarizing, translating, coding, internal agents reviewed by a human.	The vast majority of the register. Internal rules (charter, GDPR, confidentiality) and user training.

Two pitfalls are common in almost every organization. A "minimal" system at the supplier's can become "high risk" within your organization depending on its use: a general-purpose assistant used to screen applications changes its classification level because the qualification relates to its use, not the product itself. And the GDPR doesn't disappear behind the AI Act: any AI that processes personal data must go through the Data Protection Officer (DPO), with an impact assessment if the processing is high-risk.

4. Three verdicts, and the self-approval that avoids the bottleneck

The regulatory qualification states what the law requires. The verdict states what the organization decides. Three verdicts are sufficient: approved, approved with conditions, to be reviewed. What differentiates a system that works from one that is circumvented is the self-approval rule: a system with minimal risk, based on an already referenced tool, without confidential or personal data beyond professional contact information, connected to sources its users already have, with a trained owner and users, and with human review before any external impact, is approved by the AI ​​expert in a few days, without going through a committee.

In practice, seven to eight out of ten systems meet these criteria. The committee focuses on the remaining requirements, and the conditions it attaches to its verdicts are drawn from a short list of standard conditions (human review, data scope, connector scope, informing personnel, documented training, informing employee representatives, logging, and advance review), referenced by a code in the registry. The toolkit details the criteria and the eight standard conditions.

5. The AI ​​committee: light, regular, traced

The AI ​​committee makes decisions that are not based on self-approval, arbitrates the conditions, reviews the register quarterly, and adapts the criteria as the organization matures. It does not manage projects or replace existing bodies; it mobilizes them. Its composition is simple: a sponsor from senior management, the AI ​​lead who prepares the files, representatives from the IT or security department, the legal or compliance department, and the Data Protection Officer (DPO), plus two or three representatives from the departments most heavily involved in implementation.

Initially, the meeting is held for one hour per month, then every six weeks, with a fixed five-point agenda: register, files to be decided, overdue reviews, incidents and signals, and system adjustments. Each decision is added to the file for the system in question, which serves as the audit record: identification sheet, qualification, decision and conditions, evidence of implementation, and follow-up. It is the quarterly register review with each owner, more so than the committee, that keeps the system active: systems that have not been used for six months are removed from the register.

6. What the kit contains

The kit is a 15-page, editable Word document, each part of which can be copied independently to your tools. It contains, in order: instructions for use and three ways to use it; the AI ​​systems register, with required information, the fifteen commented and exemplified columns, where to keep it, and how to find undeclared AI; the ten-question declaration form, with the reason for each question; the risk-level qualification grid, with prohibited practices, Annex III areas, transparency obligations, minimum risk, and the decision tree; the three verdicts, self-approval criteria, and eight standard conditions; the seven-section system template; the AI ​​committee, with its mandate, composition, agenda, and indicators; and three appendices: a twelve-point self-assessment of the system, frequently asked questions, and resources for further exploration.

The kit, part by part: what each part contains and what it is used for. The templates to fill in are in the Word document.

INSTRUCTIONS FOR USE

Three ways to use this kit

Starting with an initial register (parts 1, 2, and 3, two-day workshop with management), installing the complete system (the entire kit, six weeks), or auditing the existing system (Appendix A, then the sections with low scores, half a day). The kit is organized into six components: inventory, data collection, qualification, decision-making, documentation, and management.

The European regulation timetable, updated to September 2026

Since February 2, 2025, prohibited practices (Article 5) and AI control (Article 4), reformulated as an obligation of means by Omnibus Regulation (EU) 2026/1744, have been in effect. Since August 2, 2025, obligations have been in effect for providers of general-purpose AI models. Since August 2, 2026, transparency (Article 50) has been in effect, with a deadline of December 2, 2026, for labeling the content of systems already on the market. The high-risk category of Annex III will follow on December 2, 2027, a date postponed by the AI ​​Omnibus Regulation, and that of Annex I on August 2, 2028. This postponement is not a reason to wait: the register is operational immediately.

Part 1. The AI ​​Systems Registry

1.1 What is entered in the register

Any software, service, or agent that produces content, recommendations, or decisions based on an AI model falls into five categories: general-purpose assistants, agents and assistants created by business units, AI embedded in software, in-house or outsourced development, and automations that call upon a model. Individual uses of a previously declared assistant, draft agents that are not shared, and software without AI are not included. When in doubt, declare: an extra line is less expensive than forgetting the system altogether.

1.2 The fifteen columns

Each system is described in fifteen columns, from the unique identifier (e.g., IA-2026-042) to the dates of declaration, decision, and next review, including the purpose (in a one-sentence sentence with a verb), the data processed, the sources and connectors, whether the decision was automated, the AI Act level, the verdict, the conditions, and the status. The kit provides the expected content and a completed example for each column.

1.3 Where to keep it

A SharePoint list, a Notion database or a shared Excel workbook is sufficient, with three rules: a single register for the entire organization, a named owner of the register, generally the AI ​​referent, who alone validates columns 11 to 15, and columns locked by choice lists so that the register remains filterable.

1.4 Finding undeclared AI: three sources

Administration consoles (Microsoft 365, OpenAI, Anthropic, Google) for agents and automations, 30-minute interviews per department for real-world use cases, and a review of software contracts renewed since 2023 for embedded AI. The initial inventory takes one to two weeks; an agent seen in the console but mentioned by no one is likely an orphan.

Part 2. The declaration form

The ten questions on the form

The single entry point to the register, the form can be completed in ten minutes by the future owner, using Microsoft Forms, SharePoint or Notion. Its ten questions cover the name and owner, purpose, tool, users, data, connections, effect on people (high risk detection), human review, contact with external people (Article 50) and user training.

Installation advice

Making the form visible where agents are created (charter, tool homepage, training path) and responding quickly: an acknowledgement of receipt on the same day and a verdict in less than ten days for simple cases do more for spontaneous declaration than any obligation.

Part 3. The AI Act Qualification Grid

3.1 Prohibited practices (Article 5)

Eight practices must be explicitly prohibited for each system: subliminal or deceptive manipulation, exploitation of vulnerabilities, social scoring, risk assessment based solely on profiling, non-targeted image collection for facial recognition, recognition of employees' or students' emotions, inference of sensitive characteristics from biometric data, and generation of non-consensual intimate content—a prohibition added by the AI ​​omnibus. A checked box triggers an immediate halt and legal action.

3.2 High risk (Article 6 and Annex III)

A system is considered high-risk when, in any area listed in Annex III, it is used to make, prepare, or influence a decision concerning individuals: employment and workforce management, access to essential services (credit, life insurance, and healthcare), education, biometrics, critical infrastructure, law enforcement, and justice. The exception in Article 6.3, particularly for a narrow procedural or preparatory task, never applies to profiling and must be documented.

What high risk means for you, the deployer (article 26)

Use the system in accordance with the supplier's instructions, entrust human supervision to competent and trained persons, monitor operation and report incidents, keep logs for at least six months, inform staff representatives and employees before any commissioning in the workplace, inform the persons subject to a decision and carry out the required impact analyses.

3.3 Transparency (Article 50)

Tell people that they are interacting with an AI, report hyper-realistic manipulations (realistic images, sounds, videos), report generated texts published to inform the public on topics of general interest, unless reviewed by a human with editorial responsibility, and inform people exposed to authorized emotion recognition or biometric categorization.

3.4 Minimal risk

Writing, summarizing, translating, researching, coding, and internal processes whose results are reviewed by a human: this constitutes the vast majority of the register, often 85 to 95% of the entries. There are no specific requirements under the AI Act beyond mastering AI; internal rules (charter, GDPR, confidentiality, security) apply.

3.5 The decision tree in four questions

Is a prohibited practice checked? Does the system influence a decision concerning individuals in a field listed in Annex III? Do individuals interact with it or receive its content? If not, it is minimal and eligible for self-approval. A word of caution: substantially modifying a system or designating it for high-risk use could make you a provider as defined in Article 25.

Part 4. The Three Verdicts

Approved, conditionally approved, or subject to review: the qualification states what the law requires, the verdict states what the organization decides. Target timeframe: less than ten days for approval, the next committee meeting for a case requiring review.

4.1 Self-approval criteria

The AI ​​expert approves, without a committee, a system that meets six criteria: minimum AI Act level, already referenced tool, no confidential or personal data beyond professional contact information, sources already accessible to its users, a named owner and trained users, and human review before any external effects. Seven to eight out of ten systems meet these criteria.

4.2 The eight standard conditions

The conditions attached to a verdict are referenced by their code in the register, each with its expected proof: C1 human review, C2 data scope, C3 connector scope, C4 informing people, C5 certified user training, C6 informing staff representatives, C7 logging, C8 early review at three months instead of twelve.

Part 5. The standard folder by system

Each non-self-approved system opens a file with seven sections: identity sheet, qualification, decision, supplier documentation, evidence of implementation, monitoring, and reviews; the first three are sufficient for a self-approved system. This is the audit evidence: a third party must understand within ten minutes what the system is, why it was approved, and how its compliance is verified.

When to reopen a case

New source or connector, new user population, change of purpose, change of model or provider, incident: the owner resubmits the form and the qualification is redone. The rest of the time, the annual review is sufficient.

Part 6. The AI ​​Committee

6.1 Mandate

The committee makes decisions without self-approval, arbitrates the conditions, reviews the register quarterly, and updates the criteria. It does not manage projects and does not replace existing bodies (safety committee, works council, risk committee): it coordinates them.

6.2 Composition

A senior management sponsor who chairs the meeting, the AI ​​lead who maintains the register and facilitates the discussions, representatives from the IT department or security, legal or compliance, the DPO, and two or three representatives from the departments most heavily involved in implementation. HR and a representative from employee relations are invited whenever a matter concerns employment or employee management.

6.3 Pace and agenda

One hour per month for the first six months, then every six weeks, with a fixed agenda: register, files to be decided (ten minutes maximum each), overdue reviews, incidents and signals, adjustments to the system. Each decision is recorded in a one-page summary.

6.4 Indicators

Six indicators with an indicative target: systems on the register by status and level, share of self-approvals (70% or more), median time between declaration and verdict (less than 10 days), systems with trained owner and users (100%), systems discovered out of declaration (declining) and reviews completed on time (90% or more).

6.5 Quarterly review of the register

Each quarter, the AI ​​coordinator sends each owner a list of their systems with three questions: still in use? still in accordance with the declaration? still the correct owner? Systems not in use for six months go to the status "withdrawn", those whose owner has left their position are reassigned or suspended.

Annexes

Three annexes: a twelve-point self-assessment of the system, frequently asked questions, a glossary and resources.

Appendix A. Twelve-point self-assessment of the system

Twelve criteria, each worth 2 points for yes, 1 for partial, and 0 for no, to be completed individually in twenty minutes or as a committee once a year. If a score is below 12 out of 24, sections 1 and 4 are completed first.

7. Frequently Asked Questions

Do we need to declare the individual uses of a generalist assistant?

No. The generalist assistant is declared once, at the organizational level, along with its usage rules in the charter. What is declared individually are the agents, spaces, and automations that the business units create and share, because they have their own purpose, sources, and users.

Do we need an AI governance platform?

Not for beginners. The kit's components fit within SharePoint, Notion, or a shared workbook and are sufficient for most organizations. A dedicated platform becomes necessary when the system infrastructure exceeds several hundred systems, when multiple entities need to consolidate their records, or when your audit obligations require an automated trail. The kit's records can then be migrated without loss.

What should be done with an agent created by an employee and already used by their team?

Declare it, categorize it, and in the vast majority of cases approve it, often with conditions. The goal isn't to stop what works, but to acknowledge its existence and establish rules. A system perceived as policing usage is circumvented within weeks.

Who is responsible if a system produces an error?

With respect to third parties, the organization is responsible. Internally, the system owner is responsible for its use in accordance with the terms and conditions, as is the AI ​​expert for the system. This is why no system is approved without an owner.

How to reconcile the register with the charter of uses?

The charter establishes what each party has the right to do with AI; the registry and its rulings determine who approves what, on which list, and with what evidence. The two are mutually dependent: the charter stipulates the obligation to declare, and the system relies on the charter's rules to define standard conditions.

How long does the setup take?

An initial, qualified register was created in a two-day workshop with management; a complete system, including forms, decisions, a committee, and initial files, was established in six weeks. Subsequently, the AI ​​liaison officer will dedicate half a day per month to this system, and the committee will hold one hour per session.

8. Going further

This kit is the operational counterpart to our AI charter template The charter sets the rules, and the registry and its rulings enforce them system by system. For an overview of your deployment obligations, the timeline to 2028, and the AI ​​literacy program required by Article 4, see the AI Act kit from the sponsorNextStart.AI also installs the complete system according to your instructions, within six weeks, as part of the mission. Governing your agents, with a two-day entry point for inventory and qualification.

Read also : AI Charter in Business: The 2026 Model (Downloadable), AI Ambassador Network: The 2026 Toolkit, AI Adoption Roadmap in 12 Months: The 2026 Toolkit et AI Maturity Grid: The 2026 Kit.

The entire series of free kits. To drive adoption: AI charter template, AI training plan template, AI Ambassadors Kit, Manager's toolkit for dealing with AI, Adoption Roadmap Kit, AI maturity grid, AI Measurement and ROI Kit, Gift Sets Cowork, Copilot Studio kit, Claude Skills kit et Vibe coding kitFor the AI ​​project sponsor: AI Act kit, GDPR kit, Security and data kit, Shadow AI kit, AI and Social Dialogue Kit, frugal AI kit, AI Sovereignty Kit et responsible AI kitBy profession: AI HR kit, AI marketing kit, AI finance kit, AI kit for lawyers, AI kit for salespeople, AI toolkit for project managers, AI innovator kit et communicator's AI kit.

9. sources

The regulatory references cited on this page are based on the following sources.

• European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Articles 4, 5, 6, 26, 50 and Annex III), 2024.
• European Union, Regulation (EU) 2026/1744 (omnibus IA) amending Regulation (EU) 2024/1689, adopted on 8 July and published on 24 July 2026, in force since 27 July 2026 (reformulated article 4, postponement of high risk).
• European Commission, Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act, February 4, 2025.
• European Commission, Guidelines on the AI ​​system definition, February 6, 2025.
• European Commission, AI Literacy, Questions & Answers (Article 4 of the AI Act), updated on July 27, 2026.
• European Union, Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation), 2016.
• CNIL, Data Protection Impact Assessment (DPIA).
• CNIL, Data protection impact assessment: publication of a list of processing operations for which an assessment is required, November 6 2018.