title: “AI System Registration” description: “Register AI systems and establish the governed system record used throughout the AIGO lifecycle.”
AI System Registration
AI system registration establishes the controlled identity and governance record for an AI system within the organization’s AIGO scope. Registration is the starting point for system-level governance. Once an AI system is registered, subsequent governance activities can be connected to that system, including classification, risk assessment, controls, assessments, approval, monitoring, incidents, changes, assurance, improvement, and retirement.1. Purpose
The purpose of registration is to establish a reliable and traceable record of the AI systems that fall within the organization’s governance scope. Registration should allow the organization to answer: * What is the AI system? * Who owns it? * What is it intended to do? * Where is it used? * Who is affected by it? * What stage of its lifecycle is it in? * What governance activities have been performed? * What risks and controls are associated with it? * What governance decisions have been made? Registration is therefore more than an inventory entry. It establishes the identity against which subsequent governance records are connected.2. When to register an AI system
An organization should define when an AI system must enter the AIGO governance inventory. Potential registration triggers include: * development of a new AI system * acquisition of an AI system * procurement of an AI-enabled service * integration of an external AI service * deployment of an existing AI system into a new context * material expansion of an existing system * identification of an previously unregistered AI system * changes that cause an existing system to enter the organization’s governance scope The organization’s governance policy should define the authoritative registration trigger.3. Registration identity
Each registered AI system should have a stable identifier. The identifier should allow governance records to refer consistently to the same governed system throughout its lifecycle. A registration record should distinguish between: * system identifier * system name * system version where applicable * model or component identifiers where applicable * organizational ownership * deployment instances where relevant * lifecycle status Identifiers should not be changed merely because the system undergoes routine lifecycle changes. If a change creates a materially different governed system, the organization should apply its change and governance rules to determine whether a new registration or re-registration is required.4. Minimum registration information
The registration record should contain sufficient information to establish the identity and context of the system. Typical information includes:
Not every field will be applicable to every organization or AI system.
The organization should define its required registration fields according to its governance scope and risk environment.
5. Establish ownership
Every registered AI system should have an identifiable owner. The system owner should be accountable for ensuring that the system remains subject to the organization’s governance requirements throughout its lifecycle. Ownership should not necessarily imply that the owner performs every governance activity. For example: * the system owner may own the system * a risk owner may own identified risks * control owners may own specific controls * a governance function may operate governance processes * an assurance function may assess governance effectiveness * an approval authority may make formal governance decisions These responsibilities should remain distinguishable. See Governance Roles.6. Define intended purpose and use
Registration should describe what the AI system is intended to do. The intended purpose should be sufficiently specific to support later: * classification * risk assessment * control selection * approval * monitoring * change management * assurance Where relevant, the registration should also identify uses that are explicitly outside the approved scope. This distinction is important because governance treatment may depend on how an AI system is actually used rather than only on its technical capabilities.7. Record deployment context
The same AI technology may present different governance considerations depending on its operating environment. Registration should therefore capture relevant deployment context. Depending on the system, this may include: * business process * geographic deployment * jurisdiction * user population * affected population * operational environment * level of autonomy * human oversight * decision-making role * integration with other systems * external service dependencies Deployment context should be updated when material changes occur.8. Identify stakeholders
Registration should identify relevant stakeholders. These may include: * system owners * users * operators * developers * affected individuals * customers * suppliers * regulators * internal governance functions * security teams * privacy teams * legal or compliance functions * assurance functions The appropriate stakeholder set depends on the system and its context. Stakeholder information supports later risk, control, approval, monitoring, and assurance activities.9. Establish lifecycle status
The registration record should indicate the current lifecycle state of the AI system. Possible lifecycle states may include: planned → development → testing → approval → deployed → monitored → suspended → retired The exact vocabulary should follow the organization’s adopted AIGO lifecycle definitions. Lifecycle status should be updated when governance decisions or material system events change the system’s state.10. Connect registration to classification
Registration provides the information required for classification. The registered system should therefore proceed to the organization’s classification process after sufficient initial information has been established. The relationship is: registered system → classification → governance treatment Classification should be recorded as a separate governance decision or structured attribute as defined by the applicable AIGO implementation. See AI System Classification.11. Connect registration to risk
Registration establishes the governed entity to which risks can be assigned. A risk record should therefore be traceable to the relevant AI system. The relationship is: AI system → risk → treatment This allows risk assessments to remain connected to the system even when risks are managed through separate governance records. See Risk Assessment.12. Connect registration to controls
Applicable controls should be traceable to the AI system and, where appropriate, to the risks or requirements they address. A practical governance relationship is: AI system → risk → control → evidence This allows organizations to determine which controls apply to a particular system and why.13. Connect registration to governance decisions
Registration should remain connected to governance decisions throughout the lifecycle. Relevant records may include: * classification decisions * risk assessments * control assessments * approvals * risk acceptance * monitoring results * incident records * change records * assurance findings * improvement actions * retirement decisions This creates a system-level governance history.14. Registration workflow
A practical registration workflow is: 1. Identify the AI system. 2. Determine whether it falls within the AIGO governance scope. 3. Assign a unique system identifier. 4. Assign system ownership. 5. Record the intended purpose. 6. Record relevant deployment context. 7. Identify users and affected stakeholders. 8. Record lifecycle status. 9. Identify relevant suppliers and dependencies. 10. Complete the required registration information. 11. Submit the registration for governance review where required. 12. Create or update the AI system profile. 13. Proceed to classification. 14. Establish related risk and control records. 15. Maintain the registration throughout the lifecycle. The organization may combine or separate these steps according to its operating model.15. Registration review
Registration information should be reviewed when material changes occur. Review triggers may include: * change in intended purpose * change in deployment context * change in system ownership * material model change * significant data change * new users * new affected stakeholders * new jurisdiction * material incident * significant change in risk * change in applicable requirements * change in lifecycle state A review may result in: * no change * updated registration * reclassification * new risk assessment * additional controls * renewed approval * other governance action16. Registration and traceability
AIGO treats the AI system as a central governed entity. Other governance records can establish relationships to the registered system, including: * risks * controls * assessments * approvals * monitoring activities * incidents * changes * assurance activities * evidence * improvements * retirement activities A resulting traceability chain can be represented as: AI system → classification → risk → control → evidence → assessment → approval → monitoring → assurance → improvement → retirement Not every system will require every record or activity. The applicable governance pathway should be determined according to the system’s classification, risks, applicable requirements, and organizational policies.17. Registration and machine-readable governance
The registered AI system can act as a central entity within the machine-readable AIGO governance model. The AI System Schema provides a structured representation of the governed system. Canonical schema:schemas/01-ai-system/01-AIGO-AI-System-Schema-v0.1.json
Schema documentation:
schemas/01-ai-system/01-AIGO-AI-System-Schema-Documentation-v0.1.md
Machine-readable representation can support:
* governance registries
* workflow systems
* GRC platforms
* AI inventories
* automated traceability
* governance evaluation
* evidence relationships
* lifecycle monitoring
Machine-readable records should remain consistent with the organization’s authoritative governance records.
18. Registration and evaluation
A registered AI system may become an evaluation entity within the AIGO evaluation architecture. The evaluation layer can use the system and its related governance information as inputs to defined governance rules. Conceptually: governance records → rules → evaluation → findings This separates: * the identity of the governed system * the governance information associated with it * the rules used for evaluation * the resulting evaluation findings This separation allows evaluation rules to evolve without changing the fundamental identity of the AI system. Evaluation results should support governance decisions rather than being interpreted automatically as legal or regulatory conclusions.19. Registration and validation
Registration records participate in the broader AIGO validation and traceability model. Validation may examine aspects such as: * schema validity * required fields * identifier integrity * references * relationships * traceability * evidence relationships * governance consistency Validation provides evidence about the integrity of the relevant artifact or repository content. It does not establish legal compliance, certification, accreditation, or regulatory conformity.20. Practical implementation
An organization implementing AIGO should establish an authoritative AI system inventory. The inventory may initially be implemented using: * a structured database * a GRC platform * an AI governance platform * a controlled spreadsheet * a document-management system * an internal registry * another controlled system of record As governance maturity increases, organizations may transition toward machine-readable records and automated governance workflows. The technology used to maintain the inventory is less important than maintaining: * unique identity * ownership * completeness * traceability * lifecycle status * governance relationships * controlled updates21. Registration artifacts
A typical implementation should produce: 1. AI system registration record 2. AI system identifier 3. system ownership assignment 4. intended-purpose description 5. deployment context 6. stakeholder information 7. lifecycle status 8. initial governance information 9. AI system profile 10. links to classification, risks, controls, and subsequent governance records The AI System Registration Template can be used as a starting point.22. Next step
After registration, the organization should establish the detailed AI system profile and determine the appropriate governance classification. Continue with: 1. AI System Profiles 2. AI System Classification 3. Risk Assessment 4. Control Assessment 5. AI Governance ApprovalCanonical sources
The canonical machine-readable AI System Schema is:schemas/01-ai-system/01-AIGO-AI-System-Schema-v0.1.json
The canonical schema documentation is:
schemas/01-ai-system/01-AIGO-AI-System-Schema-Documentation-v0.1.md
The canonical implementation procedure is:
guidance/02-procedures/02-AIGO-AI-System-Registration-Procedure-v0.1.md
The corresponding implementation template is:
guidance/03-templates/02-AIGO-AI-System-Registration-Template-v0.1.md