Building an AI use case register: the inventory every firm needs

An AI use case register — sometimes called an AI inventory — is a central record of every way your firm uses artificial intelligence. It answers the questions a board, a regulator or an auditor will ask first: where do you use AI, who is responsible, how risky is it, and how do you know it is working as intended?

The FCA’s good practice publication highlights a central inventory of AI agents with owners, access and controls. This article explains how to build a register that is useful rather than decorative.

What counts as a use case

A use case is a specific way AI is used for a specific purpose. “We use ChatGPT” is not a use case; “Client Services uses an approved generative AI tool to draft first responses to complaints, reviewed by a senior handler before sending” is.

Include:

• AI built or trained in-house.
• AI features in vendor software (CRM, telephony, document management).
• General-purpose AI tools used by staff for defined purposes.
• AI agents that can take actions in systems.
• Proposed uses that have not yet been approved — and uses you have decided to stop.

What to record

Each entry should hold enough information to make and evidence decisions:

Risk tiering

Not every use case needs a full assessment. A simple tiering approach — the FCA describes tiers that intensify testing and monitoring — makes the register workable:

• Low: internal drafting, summarising non-confidential material, coding help. A short assessment and standard controls.
• Medium: use with confidential data, or internal decisions with some impact. A fuller assessment, defined controls, periodic review.
• High: customer-facing output, financial promotions, advice, or decisions about customers. Full assessment, testing before deployment, human oversight, closer monitoring and senior approval.
• Critical or prohibited: uses outside your risk appetite, or that you decide not to pursue.

Score likelihood and impact against factors such as customer harm, Consumer Duty implications, accuracy and explainability, data sensitivity, autonomy and third-party dependence. Then record how much your controls reduce the risk to reach a residual rating.

How the register drives everything else

A register earns its keep when it is connected to the rest of your governance:

• Approvals. New use cases enter as proposals and move through risk-routed approval, with separation of duties so the person proposing a use case does not approve it. See human oversight and approvals.
• Access. Only approved use cases should be available to staff, and retiring a use case should remove access.
• Monitoring. Each use case defines what is monitored, with thresholds that raise alerts.
• Reviews. Review dates create tasks for owners, and overdue reviews are visible to management.
• Incidents. Incidents link to the use case involved, so patterns are visible.
• Third parties. Each provider appears once in a supplier record, linked to every use case that depends on it. See third-party AI risk.
• Management information. The register is the source for the board’s view of AI: how many use cases, at what risk, with what open issues.

For firms within scope of SYSC 15A, the FCA notes that mapping AI dependencies forms part of operational resilience requirements.

Getting started

1. Collect what exists. Start with a discovery exercise — surveys, team conversations, procurement and expense data. See shadow AI.
2. Assign owners. Every entry needs a named business owner before anything else.
3. Tier quickly. Rate each entry roughly first, then assess the high-risk ones in depth.
4. Decide. Approve, approve with conditions, or stop. Record the decision and the reasons.
5. Set review dates. Higher risk, shorter interval.
6. Report. Agree a summary for management and the board.

Common pitfalls

• A spreadsheet nobody owns. Registers decay unless updates are part of how work happens.
• Only counting models. Everyday use of general-purpose AI is often the largest exposure.
• No retirement. Use cases that have stopped should be marked retired, not deleted, so the history remains.
• Ratings without reasons. A risk rating without a recorded rationale is hard to defend.

How Dutira helps

Dutira’s AI use case register holds each use case with its owner, risk assessment, approval history, controls and review date, and connects it to the approval workflow, workspace access, monitoring and the evidence centre. Every change is recorded in an audit trail. See Policy & Control.