Someone on your leadership team will soon ask how many AI agents the company is running. The honest answer at most companies is a guess. The agents exist: a weekly pipeline summary that emails itself to sales leadership, a routine that triages inbound support tickets, a Copilot Studio bot a manager built for onboarding, a scheduled job that drafts the Monday metrics note. Each one was a good idea. Nobody wrote them down in one place.
An AI agent register is that place. It is a list of every agent or scheduled workflow that runs against company systems without a person pressing the button each time, with an owner and an end date on every line. It fits on one page, and it is the document that lets you answer the board’s question with a number instead of a reassurance.
The register lists jobs, not tools
The usual inventory lists software: which AI tools are approved, who has seats, what the contract costs. That list belongs to the spend audit and answers a budget question. It cannot tell you what happens when one of those tools acts on its own at 2 a.m.
The register lists jobs. “Claude Team” is a tool. “Every Friday, a routine reads the CRM and posts a forecast summary to the sales leadership channel” is a job. The job is what carries risk, because it touches real data, produces output people rely on, and keeps running after the person who set it up changes roles. The risk guide calls this the second workforce that is not on any org chart. The register is its org chart.
The gap is real. In an EY survey of senior AI leaders at US public companies with more than $1 billion in revenue, 26% of those whose organizations use agentic AI said they cannot detect unauthorized agents, and 41% of all respondents said senior leaders lack visibility into every AI tool operating in the company.1 Those are self-reported numbers from people with every reason to look good, so read them as a floor.
Seven columns make an agent governable
Each row is one agent. If a column cannot be filled in, the agent is not ready to run, and the conversation about filling it in is the review.
| Column | What it records |
|---|---|
| Agent | A plain name and the job in one sentence: what it produces, for whom, how often |
| Business purpose | The decision or output it supports, in business terms |
| Business owner | One named person who answers for the output, outside IT |
| Authority | Read only, drafts for a human, or acts on its own (sends, writes, approves, pays) |
| Systems and data | What it reads and writes, including any restricted data |
| Review path | Who checks its output, how often, and where exceptions go |
| Shutdown or renewal date | The date it stops unless the owner renews it on purpose |
Three of these columns carry most of the weight: the owner, the authority, and the end date.
The business owner is a named person in the business, not “IT” and not the vendor. The technical builder can be listed elsewhere. The owner is whoever would be in the room if the output went wrong. Ownerless agents are common enough that Microsoft’s Agent 365 registry has a view for agents missing an owner, and lets an admin assign a new one or block the agent outright.2 That a vendor built a screen for the problem tells you how often it happens.
The authority column sorts the register by risk better than any score. An agent that reads and summarizes is a reporting problem if it is wrong. An agent that drafts for a human is caught by the human. An agent that acts on its own, sending to customers, updating records, approving spend, is where the incidents live. Most rows should sit in the first two levels. Every row in the third needs a verifier who can mechanically confirm the output is right.
An agent with no end date runs until something breaks. A renewal date forces the owner to look at it once a quarter and say whether it still earns its place. Ninety days is a good default, matching the cadence of an AI policy exception, because a running agent is a standing exception to the idea that a person decides.
Build it from three sources, then keep it alive at intake
The first version is a sweep. Ask three places.
The admin consoles. Microsoft, Anthropic, Google, and OpenAI each show some view of the agents, routines, or scheduled tasks running in your tenant. None of them shows the others, and none of them shows what the business depends on. Export what they have.
The managers. Ask every director one question: what runs automatically for your team that someone would notice if it stopped? This finds the agents the consoles miss, including the ones on personal accounts. Treat those findings the way the shadow AI article recommends: move the useful ones onto a governed plan with an owner, and thank the person who built them.
The invoices. Metered API spend with no named workflow behind it is usually an agent nobody listed. The spending dashboard already lines spend up by workflow, so an unmatched line points straight at a missing row.
After the sweep, the register stays current only if new agents enter it on the way in. Make a register row the last step of use-case intake: a workflow that clears intake and will run unattended gets its row before it gets credentials. That one rule does more than any quarterly audit, because the register is never more than one approval behind.
The register answers four board questions
Boards do not ask for a register. They ask questions that only a register answers.
How many agents do we run, and how many can act on their own? Count the rows, then count the third authority level.
Who answers for them? Every row has a name. A row without one is the finding.
What do they touch? The systems-and-data column, filtered for restricted data, is the exposure.
Can we stop them? This is the question that catches companies out. The register should record, for each agent, what actually stops it: disabling the routine, revoking the connector, removing the user’s license. On some products, signing a user out does not stop work that is already scheduled or running in the cloud. Write down the real off switch per agent, and test one each quarter.
The steering committee is the natural home for the quarterly read. It already owns the portfolio and the risk register; the agent register is the operational layer underneath both. Bring three numbers to the board briefing: agents running, agents with authority to act, and agents past their renewal date. The third should be zero.
The sentence for the board
The sentence for your directors is short: if something runs for your team without a person starting it, I need its name, its owner, what it can do, and the date it ends. The sentence for the board is shorter: we keep a register of every AI agent running in the company, each one has a named owner and an end date, and we review it every quarter. A company that can say that is in a position to approve more agents, because it can see the ones it already has.
Footnotes
-
EY, “Autonomous AI implementation outpaces oversight,” September 15, 2026. Survey of 202 US senior AI decision-makers at public companies with at least $1 billion in annual revenue, fielded May 28 to June 15, 2026. Reported by Cybersecurity Dive. ↩
-
Microsoft, “What’s new in Agent 365, May 2026”, Agent 365 blog. Admins can block, unblock, delete, and assign a new owner to agents from the registry. ↩