SERVICES › SAMPLES › AI GOVERNANCE › A2
AI use register

Part of the AI governance review worked example for Quillmarrow Supplies Pte. Ltd. (fictional). Read it here in full or download the files.

Fictional organisation, illustrative only, not a client case study

« Back to the AI governance review pack
Downloads
A2 · AI use register
OrganisationQuillmarrow Supplies Pte. Ltd. (fictional)
DocumentA2 · AI use register
Version1.0
Date30 October 2026 (illustrative)
Prepared byAlex Lew, reviewer and sign-off
Client approver (role)Chief Operating Officer
LabelFictional organisation, illustrative only, not a client case study

This register records every AI use agreed in scope at Quillmarrow: what it is for, who owns it, what information it handles, what it may do, its working risk tier, the human check that applies, how it maps to the reference frameworks, what evidence is still missing, and what event forces a re-review.

The register is the single list management works from. The Chief Operating Officer owns it. Each business owner keeps their row current, and any new tool or newly enabled vendor feature is added before use. The full register, with all columns and filters, is supplied as an XLSX workbook. This print version splits the columns across two tables.

Risk tiers are working categories for Quillmarrow, set using the practical risk tiering method (A3). They are not statutory classifications. Evidence status shows exactly what was and was not supplied during the review. Missing evidence stays visible.

Framework tags use short names: MGF 2020 is the Model AI Governance Framework, Second Edition (January 2020); GenAI MGF 2024 is the Model AI Governance Framework for Generative AI (May 2024); Agentic MGF 2026 is the Model AI Governance Framework for Agentic AI (January 2026); PDPC AI Guidelines 2024 are the PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (March 2024); AI Verify refers to the 11 principles of the AI Verify testing framework.

Register, part 1: use, ownership, data and oversight

IDUseTool or vendorOwner roleUsersData categoriesPermissionsRisk tierHuman checkStatus
AI-01Catalogue product description draftingFictional Draft StudioHead of MarketingMarketing team (4 users)Product names, specifications and catalogue content; no personal data intendedRead supplied product details; draft copy; no publishing permissionTier 1 LowHuman-in-the-loop: Head of Marketing checks factual claims and copy before publicationApproved with conditions
AI-02Helpdesk reply draftingFictional Helpdesk (V-01)Head of Customer ServiceCustomer Service team (9 agents)Customer contact details; order history; customer enquiriesRead helpdesk conversation data; draft replies; no autonomous sendingTier 2 MediumHuman-in-the-loop: agent sends nothing until a Customer Service user checks and approves the replyApproved with conditions
AI-03Supplier reorder agent pilotFictional Reorder Agent (V-02)Purchasing LeadPurchasing team (3 users; Purchasing Lead approves)Stock levels; supplier price lists; supplier contact details; purchase-order informationRead stock and supplier price lists; prepare purchase orders; can submit purchase orders by emailTier 3 HighHuman-in-the-loop: agent sends nothing until Purchasing Lead approves each purchase orderPilot with approval gate
AI-04CV screening and candidate rankingFictional Talent Screen (V-03)HR ManagerHR team (2 users, proposed)Candidate CVs; contact details; employment and education historyProposed access to CVs and candidate details; ranking use is on holdTier 3 HighHuman-in-the-loop: no candidate ranking or screening use until the hold is reconsidered and controls are approvedOn hold, recommended not to proceed in current form
AI-05Microsoft 365 Copilot for email, documents and spreadsheetsMicrosoft 365 Copilot (company licences, 25 seats)IT Manager25 licensed users across Sales, Finance, Operations and managementBusiness emails and documents; may include customer, staff or supplier personal dataMay access content available to the signed-in user; produces drafts and summaries; write or sharing settings to be confirmedTier 2 MediumHuman-in-the-loop: user checks outputs and recipients before using or sharing themApproved with conditions
AI-06ChatGPT on staff personal accountsChatGPT (staff personal accounts found in use)COOAbout 15 staff on personal accounts (from staff survey, client-reported)Prompts may contain business information; customer, staff or supplier personal data is prohibitedStaff submit prompts through personal accounts; company access, retention and settings are not controlled or confirmedTier 2 MediumHuman-in-the-loop: staff must not submit personal data and must move permitted work to an approved toolRestricted (no customer, staff or supplier personal data; move to an approved tool)
AI-07Marketing banner image generationFictional Image StudioHead of MarketingMarketing team (2 designers)Marketing briefs and product imagery; no personal data intendedRead supplied briefs; generate draft images; no publishing permissionTier 1 LowHuman-in-the-loop: Head of Marketing reviews images before publicationApproved with conditions
AI-08Meeting transcription and summariesCopilot in TeamsIT ManagerManagement meetings and Sales team calls (about 20 users)Participant voices and names; meeting discussions may include staff, customer or supplier informationProcesses meeting audio or transcript to prepare summaries; sharing and retention settings to be confirmedTier 2 MediumHuman-in-the-loop: meeting organiser checks transcript and summary before circulationApproved with conditions
AI-09Sales quotation drafting assistantMicrosoft 365 Copilot (company licences, 25 seats)Sales ManagerSales team (6 users)Customer business contact details; quotation and product informationRead user-accessible business content; draft quotations; no authority to approve or sendTier 2 MediumHuman-in-the-loop: Sales Manager or authorised salesperson verifies prices and terms before sendingApproved with conditions
AI-10Supplier invoice data extractionCloud accounting system AI featureFinance DirectorFinance team (4 users)Supplier names and contact details; invoice and payment detailsReads supplier invoices and extracts fields; posting or payment permissions to be confirmedTier 2 MediumHuman-in-the-loop: Finance checks extracted fields before posting or paymentApproved with conditions
AI-11Reorder reminder emails to web-shop customersMarketing automation AIHead of MarketingMarketing team (2 users); web-shop customers receive emailsCustomer contact details; order history; marketing preferences and consent recordsMay use customer and order data to prepare or send reminders; sending permissions to confirmTier 2 MediumHuman-in-the-loop: no reminders sent until consent and audience rules are checked and approvedRestricted pending consent check
AI-12Customer web-chat bot on the online storeFictional Helpdesk widget (V-01)Head of Customer ServiceWeb-shop customers (proposed); Customer Service team reviews hand-offsCustomer messages and contact details; order details if collectedProposed access to chat messages; live status is not yet established; pilot permissions to be boundedTier 3 HighHuman-in-the-loop: pilot responses are reviewed by Customer Service before any customer-facing useNot yet live, pilot only after controls
AI-13Code assistant used by the outsourced web developerCode assistant used by the outsourced web developer; vendor to confirmIT ManagerOutsourced web developer (1 contractor)Source code and technical information; personal data should not be included in promptsDeveloper submits code or prompts; repository and deployment permissions to confirmTier 1 LowHuman-in-the-loop: outsourced developer reviews and tests suggestions before changes are approvedApproved with conditions
AI-14Demand forecasting in the inventory systemCloud inventory systemPurchasing LeadPurchasing team (3 users)Product sales and stock history; no personal data intendedReads inventory and sales history; produces forecasts; purchasing changes remain with staffTier 2 MediumHuman-over-the-loop: Purchasing Lead reviews forecast exceptions and stock decisionsApproved
AI-15Translation of supplier correspondenceTool/vendor to confirmPurchasing LeadPurchasing team (3 users)Supplier correspondence and contact details; commercial termsReads supplied text and produces translated drafts; no sending permissionTier 1 LowHuman-in-the-loop: Purchasing user checks material terms before responding or placing an orderApproved with conditions
AI-16Credit-limit recommendation for B2B accountsAccounting add-on; vendor to confirmFinance DirectorFinance team (2 users); B2B account holders affectedB2B account and transaction information; contact details; credit-related business recordsRecommendation use only; automatic credit decisions are not permittedTier 3 HighHuman-in-the-loop: Finance Director or authorised finance staff make the decision; no automatic limit changesNot permitted for automatic decisions; human decides
AI-17Fraud flagging on web-shop ordersPayment provider feature; vendor to confirmFinance DirectorFinance team (2 users); Customer Service handles disputesOrder and payment-related information; customer identifiers and transaction detailsReads order or payment signals and flags transactions; blocking or payment actions to confirmTier 2 MediumHuman-in-the-loop: staff review flags before taking adverse action on an orderApproved with conditions
AI-18Delivery route suggestionsMalaysia fulfilment partner systemHead of OperationsPartner dispatch staff; Operations team views routesDelivery addresses and order details; customer contact information if sharedPartner system reads fulfilment details and suggests routes; access and write actions to confirmTier 1 LowHuman-over-the-loop: partner operations review exceptions and route changesApproved
AI-19Internal HR policy Q&A assistantMicrosoft 365 Copilot (company licences, 25 seats)HR ManagerPilot group of 10 staff; HR Manager owns contentHR policy content; staff questions may include personal informationProposed access to HR handbook; access to employee records is not established and must be confirmedTier 2 MediumHuman-in-the-loop: HR checks pilot answers and handles decisions or personal casesPilot
AI-20Social media reply draftingFictional Draft StudioHead of MarketingMarketing team (2 users)Public comments and messages; may include customer contact or personal informationReads supplied comments and drafts replies; no posting permissionTier 1 LowHuman-in-the-loop: Head of Marketing or authorised user checks and posts each replyApproved with conditions

Register, part 2: rationale, controls, mapping and evidence

IDTier rationaleKey controlsFramework mappingEvidence statusReview triggerNext reviewLinked
AI-01Low potential harm; no personal data intended; drafts only; errors are reversible before publication.Use approved product facts only; check claims and restricted content; human approval before publicationMGF 2020: operations management; GenAI MGF 2024: content provenancePartial: prompt, access settings and review records not suppliedTool access changes; personal data proposed for prompts; inaccurate or misleading catalogue copy30 Apr 2027-
AI-02Personal data is involved; incorrect advice could affect customers; staff review makes errors more reversible.Complete AIA-01; restrict access to authorised users; sample replies and record complaints or errorsMGF 2020: human involvement; GenAI MGF 2024: data, incident reporting; AI Verify: human agency and oversightPartial: AIA-01 is identified, but settings, data flow and review evidence are not suppliedVendor enables new AI feature; replies can be sent without review; Malaysia orders enter scope; any complaint about a sent reply31 Dec 2026AIA-01; V-01
AI-03Supplier data is involved; submitted orders create financial and operational consequences; sending is not readily reversible.Complete AIA-02; pilot with bounded suppliers and order limits; require approval and retain sent-order logsAgentic MGF 2026: assess and bound the risks upfront; implement technical controls and processes; MGF 2020: human involvementPartial: AIA-02 is identified, but technical bounds, approval workflow and test evidence are not suppliedPilot scope or supplier list changes; order limits change; any unauthorised, duplicate or incorrect order31 Dec 2026AIA-02; V-02
AI-04Sensitive employment decisions involve personal data; ranking could affect opportunities and be hard to reverse.Complete AIA-03; keep the use on hold; assess fairness, data handling and human decision process before reconsiderationMGF 2020: human involvement; PDPC AI Guidelines 2024: assessment of personal-data use; AI Verify: fairness, human agency and oversightPartial: AIA-03 is identified, but vendor due diligence, data details and assessment findings are not suppliedHR seeks to lift the hold; vendor or ranking method changes; candidate complaint or suspected unfair outcome31 Jan 2027AIA-03; V-03
AI-05Business and personal data may be involved; output is advisory, but disclosure or inaccurate content can cause harm.Confirm client-reported settings and access; prohibit unapproved personal-data use; train users to verify outputsMGF 2020: internal governance structures and measures; GenAI MGF 2024: data, securityPartial: licence count is client-reported; settings, access review and usage evidence are not suppliedLicence or configuration changes; new data categories used; sharing incident or material output error30 Apr 2027-
AI-06Prompts may expose business or personal data; use is not centrally controlled; disclosures may be difficult to reverse.Ban customer, staff and supplier personal data in prompts; communicate restriction; review and approve an alternative toolMGF 2020: internal governance structures and measures; GenAI MGF 2024: data, securityPartial: use is reported, but user population, prompt history and exposure assessment are not suppliedPersonal data is found in prompts; approved-tool decision; material change in staff use31 Dec 2026-
AI-07Low direct harm and no personal data intended; human review makes unsuitable images reversible before use.Use approved briefs and assets; check image suitability and rights; retain human publication approvalGenAI MGF 2024: content provenance; AI Verify: accountabilityComplete: tool settings, approved prompt guide and image review log providedPersonal data or third-party likenesses proposed; tool or publication workflow changes; image complaint30 Apr 2027-
AI-08Personal and confidential information may be captured; summaries can misstate decisions; review can correct errors.Confirm client-reported settings; notify participants and limit circulation; check and correct summariesMGF 2020: stakeholder interaction and communication; GenAI MGF 2024: data, securityPartial: meeting notice, settings, retention and circulation controls are not suppliedNew meeting types or external attendees; settings change; sensitive information appears in an unintended summary30 Apr 2027-
AI-09Customer information may be involved; incorrect prices or terms could cause commercial harm but can be checked before sending.Use approved price sources; verify terms and recipient; confirm client-reported settings and accessMGF 2020: human involvement; GenAI MGF 2024: dataPartial: quotation workflow, source controls and settings are not suppliedAssistant gains sending or pricing authority; new customer data used; quotation error or complaint30 Apr 2027-
AI-10Supplier and financial data are involved; extraction errors can affect records or payments but are reviewable.Confirm system permissions; reconcile key fields to invoices; retain exception and correction recordsMGF 2020: operations management; GenAI MGF 2024: data, testing and assuranceComplete: configuration export, posting permissions and monthly reconciliation providedFeature gains posting or payment authority; extraction errors recur; accounting workflow changes30 Apr 2027-
AI-11Personal data and marketing preferences are involved; unwanted messages can affect customers; sending may be hard to reverse.Keep restricted pending consent check; verify audience and suppression rules; log approvals and complaintsMGF 2020: stakeholder interaction and communication; PDPC AI Guidelines 2024: personal-data usePartial: consent basis, audience logic and sending configuration are not suppliedConsent check completed; audience or data use changes; any complaint or unintended message31 Dec 2026-
AI-12Customers may disclose personal data; autonomous answers can mislead; incorrect advice can be difficult to undo.Pilot only after controls; bound topics and data access; provide human escalation and review logsAgentic MGF 2026: assess and bound the risks upfront; implement technical controls and processes; MGF 2020: stakeholder interaction and communicationPartial: live status is stated, but pilot design, permissions, escalation and test evidence are not suppliedBefore pilot or launch; bot gains access to order records; any harmful answer or customer complaint31 Dec 2026V-01
AI-13No personal data intended; suggestions do not themselves deploy changes; code defects remain possible and can be reviewed.Confirm tool and repository access; prohibit personal data in prompts; require code review and deployment approvalMGF 2020: operations management; GenAI MGF 2024: security, testing and assuranceMissing: assistant vendor, settings, repository access and code-review evidenceVendor or repository access identified; code is generated for sensitive workflows; defect or suspected disclosure31 Jan 2027-
AI-14No personal data intended; inaccurate forecasts may cause stock or service issues; staff can adjust orders.Check forecast anomalies against sales and stock records; keep purchasing approval with staff; review material forecast errorsMGF 2020: operations management; AI Verify: repeatability/reproducibility, robustnessComplete: forecast method note, override log and quarterly accuracy check providedForecasting feature or inputs change; material stock discrepancy; system begins placing orders30 Apr 2027-
AI-15Supplier information may be included; translation is advisory and can be checked before action.Confirm approved tool; avoid unnecessary personal data; verify prices, dates and commitments with a competent reviewerMGF 2020: human involvement; GenAI MGF 2024: dataMissing: translation tool, settings, data handling and review process are not suppliedTool identified or changed; personal data is translated; mistranslation affects a commercial commitment31 Jan 2027-
AI-16Credit recommendations can affect customer access and involve account data; human decisions reduce but do not remove potential harm.Do not automate decisions; confirm recommendation inputs and explainability; record human rationale and reviewPDPC AI Guidelines 2024: personal-data use; MGF 2020: human involvementPartial: vendor, inputs, recommendation logic and decision records are not suppliedAny proposal for automated decisions; vendor or input changes; customer challenge or suspected adverse outcome31 Dec 2026-
AI-17Customer and transaction data are involved; false flags can delay orders; review can correct decisions.Confirm provider actions and data inputs; review false positives and disputes; document staff decisionsMGF 2020: human involvement; AI Verify: fairness, robustness, accountabilityPartial: provider settings, flag logic, data flow and dispute records are not suppliedFeature begins blocking orders automatically; false-flag pattern; provider or data-input change30 Apr 2027-
AI-18Personal data may be involved; route suggestions are advisory; staff or partner can change a route.Confirm data shared with partner; restrict access to fulfilment needs; review route exceptions and complaintsMGF 2020: operations management; AI Verify: robustnessComplete: partner data-processing terms and route data fields confirmedPartner system changes; data shared expands; route issue or customer complaint30 Apr 2027-
AI-19HR questions may involve personal matters; inaccurate policy answers can affect staff; human escalation can correct them.Limit pilot scope and source material; confirm access permissions; provide HR escalation and review answer errorsMGF 2020: human involvement; GenAI MGF 2024: data; AI Verify: transparencyPartial: pilot users, source permissions, settings and answer testing are not suppliedPilot expands; assistant accesses employee records; incorrect answer affects a staff decision31 Jan 2027-
AI-20Personal information may appear in messages; drafts do not post themselves; review can prevent or correct errors.Avoid unnecessary personal data in prompts; verify facts and tone; require human approval before postingMGF 2020: stakeholder interaction and communication; GenAI MGF 2024: content provenancePartial: account access, prompt handling and post-approval records are not suppliedTool gains posting permission; personal data used in prompts; public error or customer complaint30 Apr 2027-

About this sample

Fictional organisation, illustrative only, not a client case study. Quillmarrow Supplies Pte. Ltd., its people, vendors, findings and dates are invented. Nothing in this document reports a client result.

I personally review and sign off every deliverable. You appoint your own DPO. I support them.

This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer.

What's not included

  • Legal advice, legal opinions on vendor terms or regulatory representation.
  • AI Verify technical testing, model benchmarking, penetration testing or security engineering, unless the relevant work is separately scoped.
  • Building an AI system, implementing integrations or changing live permissions and configurations.
  • Certification, a compliance guarantee or an assurance that a model cannot fail.
  • An organisation-wide ISO/IEC 42001 readiness engagement unless expressly included in the quote.
  • Healthcare-sector work or on-site delivery.

ISO/IEC 42001 work is a readiness check only, never certification. Questions about this sample: DM @alewyl1 on X, or ask for a free intro call (coffee chat).
Next

« All items in the pack  |  About the AI governance review  |  DM @alewyl1 on X, or ask for a free intro call (coffee chat).