The Registry: knowing what AI you have
A feature deep-dive into GRACE — designing the module where every AI use case, system and model is registered, connected and governed.
ROLE
Senior Product Designer, feature lead
TEAM
PM, engineering
TIMELINE
2024 — now
READ TIME
5 min read
CONSTRAINTS
Four lines of defence, one screen
Users are hard to recruit
Assessments still in progress
Regulated domain
CHALLENGE
You can’t govern AI you don’t know you have. Organisations had no single place to record their AI, and four lines of defence each need something different from it.
SOLUTION
A registry that links use cases, systems, models and datasets as a web, one set-up flow for every item, and an Actions view that leads with your own controls.
IMPACT
3 core flows designed, including a 7-step set-up that works for every item type, and tested with a UK insurer’s AI governance team. Assessments are in progress.
How it works
One model, three flows
THE MODEL
A web, not a chain
In AI governance the user is an organisation, split across four lines of defence. Whiteboarding with the PM and engineers showed the registry couldn’t be a straight line: one system runs several models, and models share datasets. So items link to each other, with the use case on top.
1ST LINE
Development & Business
Builds, owns and documents the AI
2ND LINE
Risk, Legal & Compliance
Sets up and reviews the controls
3RD LINE
Internal Audit
Independently checks it works
4TH LINE
External Audit
Certifies compliance (e.g. ISO)
Whiteboard sessions with the PM and engineers: how use cases, systems, models and datasets connect, and what happens when one changes.
FLOW 01
Setting up an item
One seven-step flow for use cases, systems and models. The preview step was the key addition: people see where an item sits, and what it’s linked to, before they save.
Impact
Tested with a UK insurer’s AI governance team
WE HEARD
🤨 They don’t trust other teams’ controls.
IN THE DESIGN
Every node in the registry tree shows its status, and your team’s controls sit right below your own. What’s been attested is visible to everyone.
WE HEARD
🎯 They mostly care about their own controls.
IN THE DESIGN
The Actions tab leads with “Your controls”, so people see what’s theirs to attest before anything else.
WE HEARD
📧 They want to stop chasing people over email.
IN THE DESIGN
Tasks let owners bundle controls, assign responsibles and set a deadline, straight from GRACE.
WE HEARD
🧭 They need guidance, and alerts when rules change.
NEXT
Not solved yet. Just-in-time guidance and change alerts feed into the assessments work that’s still in progress.
✅ DESIGNED
Set-up and action flows, walked through with a UK insurer in September 2025.
🔄 IN PROGRESS
Assessments against frameworks like the EU AI Act and ISO 42001.
🧭 NEXT
Just-in-time guidance and alerts when rules change.
Next project ↓