The AI Register: One Export, Three Regulatory Frameworks

Ask the compliance team at any enterprise organization to produce their AI Register — a complete inventory of AI systems deployed across the organization — and you'll get one of three responses.

The first: "We have one. Here it is." (Rare. These organizations are ahead of the curve.)

The second: "We're working on it. It's in a spreadsheet." (Most common. Usually 6-18 months out of date and missing shadow AI entirely.)

The third: "We don't have one, but we need one." (Increasingly common as August 2 approaches and the EU AI Act enforcement date becomes real.)

What an AI Register contains — the minimum viable version that satisfies the foundational requirement across the US AI Executive Order, EU AI Act, and Canadian sector guidance simultaneously:

Every AI system deployed in the organization. Not just the ones IT provisioned. Including tools that employees are using independently that generate spend signals even if they were never formally sanctioned.

Per-system: vendor, product name, plan tier, deployment context.

Per-user: masked identity, assignment to team or department, active or inactive status, last usage date.

Per-system cost data: monthly spend, annual run rate, plan cost vs. actual consumption cost.

Authorization scope: for agentic systems, documentation of what the agent is authorized to access and under whose authority.

A generation timestamp and reporting period.

A regulatory disclaimer that accurately scopes what the document is and is not.

What makes an AI Register genuinely useful rather than a compliance checkbox exercise is currency. A register that was accurate six months ago and hasn't been updated is worse than no register, because it creates a false sense of completeness. Shadow AI doesn't appear in a register built from procurement records alone. Usage data from across all connected vendors does.

The organizations that will be most prepared when the first regulatory inquiry arrives are the ones whose AI Register updates automatically — not the ones whose compliance team updates a spreadsheet once a quarter.

The seat behavioral classification system that powers the AI Register export is the subject of a pending US patent application filed by PromptKing Inc. (USPTO ref: 2-01025019).

Can your organization produce a complete, current AI Register today — across every vendor, including tools that weren't formally provisioned?