Skip to main content
The Tool Register is the list of AI tools your firm uses. It is your written AI register under clause 3.2, and it holds two further records for each tool: an appropriateness assessment (clause 3.2) and, for tools with a material impact, supplier due diligence (clause 4.1). Getting the clause numbers right matters here, because they are different duties with different timing.

Clause 3.2

System Appropriateness Assessment. Is this tool appropriate for what your firm uses it for? One per tool. guardbook has a named surveyor sign it.

Clause 4.1

Supplier due diligence. Before you procure a tool that will have a material impact, ask the supplier in writing about at least six set topics, follow up in writing where needed, record and assess what they tell you, and record how far you have tested the tool. Where they give you little or nothing, record the resulting risks.
The register itself is also what makes the rest of guardbook work. Oversight Log entries link to a tool. Risks can be linked to a tool. Your AI policy draws on the register. A tool that is not on the register cannot be referenced anywhere else.

​
What the register holds

Open Tool Register from the left-hand navigation. Each tool carries:
  • Identity: tool name, vendor, category
  • Compliance details: purpose, known limitations, date first used, next review date, system owner
  • Usage: whether it processes client data, whether it is automated or high volume (and how often to dip sample it), plus internal notes
  • Status: Pending review, Approved, Restricted or Banned
Select a tool to open its record. The System Appropriateness Assessment and Supplier Due Diligence sections sit at the bottom of that page, each showing its own state: no record, draft in progress, or signed with the date and signatory.
A tool missing its purpose, date first used or next review date is flagged Incomplete, on the register and on its record. Hover the flag to see what is missing. These are the details guardbook checks for your clause 3.2 register, and the evidence pack uses the same check. It is a prompt, not a block. The tool still works everywhere else in guardbook.

​
Where to start

1

Get every tool on the register

Including the ones nobody thinks of as AI tools. Transcription, meeting notes, search assistants and the AI features built into software you already pay for all count. See adding a tool.For each new tool, guardbook adds four starter risks to your Risk Register: data exposure, hallucination and inaccuracy, bias, and limited information about the system. Score each one against your firm’s risk appetite, or close any that do not apply.
2

Assess each one

A System Appropriateness Assessment per tool, signed.
3

Record what the supplier told you

Supplier due diligence for tools with a material impact. Where the supplier gave you nothing useful, guardbook turns that gap into a risk automatically.
Only the tool name and status are required to add a tool. Everything the assessments depend on is optional at that stage.A register of names with no purpose, no owner and no assessment is not evidence of anything. It is a list.