Keeping the register of AI uses

What the register of AI uses contains

• A “How to use” tab: purpose of the register, completion rules, data processing and review frequency.
• A “Register” tab of two hundred rows, at one row per use.
• The columns: function, task, tool, purpose, place of processing, person responsible designated by function, date of entry, next review.
• Drop-down lists: consumer, professional or internal offering; personal and sensitive data, yes or no; level N1, N2 or N3.
• A calculated alert: personal data in a consumer tool, sensitive data with authorisation from the National Commission for the Control of Personal Data Protection (CNDP) to be examined, review overdue.
• Finally, white cells for input and greyed-out calculated cells.

When to keep the register

The register accompanies each new AI use in the organisation, to be entered on a dedicated row. It is then used at each review, no later than twelve months after the previous one. Moreover, it informs the formalities provided for by Law No. 09-08, particularly when sensitive data are involved. It is aimed at organisations that inventory their AI uses and organise their governance.

Instructions for use

First, each use receives a row in the register of AI uses: function, task, tool, type of offering and purpose. Next, the drop-down lists qualify the data processed, personal or sensitive, then the place of processing is entered. The verification level and the person responsible, designated by function, then complete the row. Finally, the next review date is set no later than twelve months after the previous one, and the alerts are read.

Expected outcome

The register of AI uses provides an up-to-date inventory of uses and a list of points to examine. Each alert thus points to a specific review: consumer tool, CNDP authorisation or overdue review.

Key facts

Limitations

The register designates persons by function; it contains no personal data on clients, service users or employees. In addition, the sensitive data alert flags a review to be carried out, without determining the applicable formality. A management-support tool, to be adapted to the organisation and the applicable regulations.

Further reading: Information Systems & Digital Transformation; Law No. 09-08 on the protection of individuals with regard to the processing of personal data.