Start with the AI uses that affect people, sensitive information, funding decisions, service delivery or the organisation's public reputation. Do not wait until every detail is known. Record what is known, who owns the use and what still needs confirmation.
Keep the first step simple
Ask teams what AI tools and features they use, why they use them and what information is involved. Make it easy to say “I do not know” and send technical or privacy questions to the person best placed to answer them.
Put effort where it matters
A basic drafting tool may only need a clear owner and usage guidance. A tool that influences services, decisions or sensitive personal information needs a fuller review, evidence and approval.
Use the record for reporting
Leaders and boards need a concise picture: where AI is used, what needs attention, who owns the next action and what changed. A maintained register makes that reporting much easier.