What to include
Keep it practical. A spreadsheet is a perfectly good start. These fields cover most needs:
| Field | Example |
|---|---|
| System or use case | Credit application pre-assessment |
| Business owner | Head of Lending |
| Vendor / model | Third-party decisioning platform |
| Purpose | Score applications and automatically decline those below a set threshold |
| Personal information used | Identity, income, expenses, credit report data |
| Sensitive information? | No |
| Decision role | Makes decision / substantially supports / minor help |
| Impact on individuals | High: affects access to credit |
| Human oversight | Declines reviewed on request; overrides logged |
| Disclosed in privacy policy? | To be updated before 10 Dec 2026 |
| Last reviewed / next review | Nov 2026 / May 2027 |
Building the register
- Agree what counts. Define “AI and automated decision systems” broadly: machine learning models, generative AI, scoring and rules engines, and AI features in SaaS products.
- Collect. Ask each business unit, check procurement and SaaS records, and include staff use of public tools (see shadow AI).
- Assign owners. Every entry needs a named business owner, not just IT.
- Rate impact. Flag systems that affect people’s rights, money, jobs, health or access to services. These need deeper assessment.
- Link to actions. Use the register to drive updates to your privacy policy, vendor reviews and monitoring.
- Keep it alive. Make registration part of procurement and change management, and review it at least twice a year.
Who should own it?
Usually a central function maintains the register, such as risk, privacy or a cross-functional AI governance group. It while business owners keep their entries accurate. Senior leadership should see a summary of high-impact systems regularly.
Where to find authoritative guidance
Refer to the OAIC, the Federal Register of Legislation, and the Australian Department of Industry. New to the terminology? See our AI governance glossary. This article is general information, not legal advice.
Not sure where you stand? Try the free automated decision scope check or the AI governance readiness checker. Both are indicative starting points, not certifications.