This step gathers approved AI use programs in one Excel register and manages them from registration to disposal. Its purpose is to see the AI use status of the whole company at a glance. You receive the AI operational control register and the register operating rules.
Approved AI use programs (instructions and prompts, custom GPTs, automations, API integrations, in-house models) are managed company-wide in one AI operational control register. Your company chooses how to divide the register (by department, division, project, site, or enter your own).
For each program, a number and version are assigned, and important content from registration → risk assessment → control method → review → approval → deployment → monitoring → change history → suspension and disposal is viewed on one line. The register is built from the results of Steps 4 to 8, or if you specify the register file your company uses, an updated version (Excel) reflecting the new results is prepared for you.
Only AI that received use approval (approval or conditional approval) in Step 8 is entered in the operational control register, and AI without an approval record is collected separately and routed to suspension of use or an approval request.
Output
- AI operational control register (Excel)Summary / program registry (category, number, version, status) / risks and controls / review and approval / deployment / monitoring / change history / code table
- Register operating rulesMaster owner, update timing (approval, deployment, change, incident), how to assign versions, where the original prompt text is kept
- List of blank fields, use before approval and reassessment needed, and next actions
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Register developed and deployed models and instructions (prompts) in the operational control register by program number and version, and manage training data, verification results, deployment destinations and change history on one line | Manage AI products and services provided to customers in the operational control register together with the provided version, customer, contract and notice items, and record whether customers were notified when changes are made | Register instructions (prompts) and tools used in departments, projects and sites in the operational control register, and manage approval conditions, users, prohibited input information, deployment location and version |
Operational control: AI operational control register
With an AI use program, changing even a single line of the instruction (prompt) can change the result. For this reason, the company-wide AI use programs are registered in one register by number and version, and the important content of the lifecycle is viewed on one line per program. The traceability that auditors look at (risk assessment → Statement of Applicability → approval → operating records) can also be followed through this one register (ISO/IEC 42001 7.5, 8.1, Annex A.4, A.6, A.9).
⬇ Download the blank register form (Excel) for free It can be downloaded without logging in or paying. It contains selection lists and formulas for risk level and grade.
Register division: chosen by your company
Choose from by department · by division · by project · by site, or enter your own criterion (example: by factory, by customer company). The "division criterion" and "division name" columns of the registry and the summary are grouped by that criterion.
Sheets of the register
| Sheet | Content |
|---|---|
| Summary | For each division name: number registered, number by status, high risk, reassessment needed |
| Program registry | Program number · division · type · AI used · scope of application · confidentiality grade · LEVEL · owner · location of original text · version · status |
| Risks and controls | Main risk · category · likelihood × severity (formula) · grade (formula) · impact assessment · control method · grounds control · implementation · residual risk |
| Review and approval | Review and verification (V&V) · reviewer · result · approver · approval date · approval conditions · next reassessment |
| Deployment | Deployment date · target · method · location · usage guidance · version to revert to · approval check |
| Monitoring | Indicator · measurement method · frequency · alert criterion · latest value · judgment · incident · action |
| Revision history (change control) | Versions before and after the change · content of change · reason · reassessment needed · reverification · approval |
Register operating rules
- Program number: AIP-division abbreviation-serial number (example: AIP-QA-001). A number once assigned is not changed. If an existing one is modified and reused (derivative reuse), a D number is added, as in AIP-QA-001-D1, and the original number is written in "derived from".
- Revision number Rev.N.M: the first approval is Rev.1.0. For significant changes (use, input data, model, scope of use, subjects), the first number changes (Rev.2.0, risk assessment and re-approval); for minor changes (wording, format, typos), the second number changes (Rev.2.1, review and confirmation by the approver). If in doubt, treat it as a significant change.
- Change control status: change request → under review → approved → implemented (or rejected). One line each is entered in the revision history sheet, and the current revision number in the registry is updated on the implementation date. The Rev to revert to is written together.
- Approved-version fingerprint: if you specify the prompt file on this screen, a SHA-256 fingerprint (first 12 characters) is created inside the browser and compared with the approved-version fingerprint in the register. If they differ, it is reported as an unapproved change (the original text is not entered in the register).
- Not used before approval. If the status is "in use", there must be an approval date.
- The original prompt text is not pasted into the register but is kept by version in a designated folder, and only the location is entered in the register (to protect trade secrets and personal information).
- The master is managed by one person (for example, the AI secretariat), who updates the line at each registration, approval, deployment, change, incident and suspension. The summary is reviewed once a month.
How to use
- Download the blank register form and keep it as the master on your company's computer (AI Management System\09_Operational Control).
- When you use Steps 4 to 8, those results are kept in this browser. In Step 9 Operational Control, choose the "register division", specify the register file, and then write with AI.
- Receive the updated version with "Download as Excel", check and approve it, and replace the master with it (changed fields are in "Changes in this update").
- Step 11 Monitoring, Step 12 Internal Audit and Step 14 Management Review take over this register (indicators, traceability audit samples, summary).
Next steps
Previous steps: 4 AI System Inventory · 5 AI Risk Assessment · 6 AI System Impact Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 8 Verification and Use Approval · 10 Documented Information Control · The output of this step is carried forward in: 3 AI System Selection · 10 Documented Information Control · 11 Monitoring, Change and Revision Control · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring · 14 Management Review · 16 Improvement
