What Is an AI Registry and Why Is It the First Step in Any AI Governance Program? | V-PROOF
There is a term that appears in all AI governance frameworks—Gartner, the EU AI Act, ISO 42001, and the NIST AI RMF—and that most organizations mistake for something they already have.
AI registry. It is not a list of tools. It is not a license inventory. It is not a catalog of data science projects.
An AI registry is a centralized registration system that documents, classifies, and continuously tracks all AI models and systems in production—including the attributes needed to manage their risk, meet regulatory obligations, and demonstrate compliance to third parties.
Without it, everything else in AI governance is just window dressing.
The Difference Between Inventory and Registry
It tells you what you have
Record the system, the vendor, and the deployment date. Describe the inventory.
It tells you how it performs—and whether it delivers
Track version, AI-to-human ratio, regulatory classification, active controls, and change history. Manage operational reality.
The difference isn't a matter of detail. It's a matter of category. An inventory describes. A registry manages.
What an AI registry should capture
Name, version, vendor, type, date of first deployment, and date of last update.
What decisions does he make or help make, regarding whom, and how often ? In functional, non-technical language.
Low risk under the EU AI Act; applicability of ISO 42001; additional regulated sectors (DORA, NIS2, financial, healthcare).
The field that most organizations leave blank—and the first one an auditor looks for. What percentage of outputs undergo active human review?
Which controls are active, which are pending, which have approved exceptions, and by whom.
A reference to the system that generates verifiable evidence that the controls are functioning. The link between the registry and the test.
Why the registry is the foundation for everything else
It requires verifiable human oversight. To verify it , you need to know which systems it applies to, at what ratio, and for which outputs. That information is in the registry.
It requires a continuous risk management system. To manage it , you need to know which models are in production, what their current risk profile is, and whether it has changed. That information is in the registry.
It requires evidence of active controls. To demonstrate this , you need to be able to specify which controls apply to which systems, along with their history. That information is in the registry.
Without a registry, each regulatory requirement is managed in silos, with inconsistent data, by teams that do not share the same view of reality.
V-PROOF Protocol · AI Governance Infrastructure 2026The registry is the architecture. V-PROOF is proof that the architecture works.
The AI registry defines which controls must be applied to each system. V-PROOF generates cryptographic evidence that those controls were applied— asset by asset —in real time, using blockchain- timestamp .
Model X requires human review of all outputs from process Y
This output from process Y, today at 10:23, was reviewed and approved — V-Seal SHA-256 + blockchain
Build the registry—and provide evidence that the controls are working
AI Registry · Regulatory Classification · AI-to-Human Ratio · Verifiable Evidence.
The infrastructure that enables true compliance.
