Free AI register

Get started with the free AI register

Aicura's free AI register lists every AI system and agent your organisation uses, each with a named owner, and discovery fills it from the systems you already run. Each step below says what happens and why, and the exact clicks are one link away.

Why start with a register

You cannot govern AI you do not know about. A register is the list of every AI system and agent your organisation uses, each with a named owner. It is the first thing a board, auditor, customer or regulator asks for, and every AI governance framework builds on it.

Asking teams what they use only finds part of the picture. Discovery reads the systems that already see your organisation's activity and finds the rest, so the register reflects what is running rather than what people remembered to mention.

The steps

  1. Create your free account

    The sign-up page opens on the free Register plan, so there is no plan to choose. You enter your name, work email and a few details about your organisation, then a card that is not charged.

  2. Set your password and log in

    An email from Aicura asks you to set a password. Once it is set, log in to Aicura and you land on your dashboard.

  3. Connect a discovery source

    Pick a system your organisation already uses. One is enough to start. Identity providers such as Okta, Microsoft Entra and Google Workspace are a good first choice, because they see the apps people sign into with their work accounts. Select a system to see what Aicura reads from it, what to ask your administrator for and the steps in Aicura. Each one has its own link, so you can send it to whoever has the details.

    Xero, QuickBooks Online, MYOB and AI Wizard start in Enterprise, so they are not listed here.

    Identity and access

    Connect Okta

    The apps in your Okta org that people sign in to, filtered to the ones that are AI. It reads the app list, not who uses each app.

    What you'll need

    Org URL
    Your Okta address, such as https://acme.okta.com.
    API token
    A password-like key your Okta administrator creates for Aicura. It is shown once when it is created.

    Who can get these. Your Okta administrator. A read-only administrator is enough.

    How to create an Okta API token, from Okta.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Okta and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Org URL and API token.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Identity and access

    Connect Microsoft Entra ID

    The enterprise applications in your Microsoft tenant, filtered to the ones that are AI. It reads the app list, not who uses each app.

    What you'll need

    Directory (tenant) ID
    The ID of your Microsoft tenant.
    Client ID
    The ID of an app registration your Microsoft administrator creates for Aicura.
    Client secret
    A password-like key for that app registration. It is shown once when it is created, so ask for it straight away.

    Who can get these. Your Microsoft administrator. The app registration needs read access to applications (Application.Read.All), which a Global Administrator or Privileged Role Administrator approves.

    How to register an app in Microsoft Entra, from Microsoft.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Microsoft Entra ID and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Directory (tenant) ID, Client ID and Client secret.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Identity and access

    Connect Google Workspace

    The third-party apps people have given access to their work Google accounts over the last 90 days. It counts the apps and never reads who granted them.

    What you'll need

    Admin email to impersonate
    The email of a Google Workspace administrator Aicura reads the report as.
    Service-account JSON key
    A key file from Google Cloud that lets Aicura read on that administrator's behalf. Paste the whole file.

    Who can get these. Your Google Workspace super administrator. The key needs read access to Workspace reports (admin.reports.audit.readonly).

    How to set up domain-wide delegation, from Google.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Google Workspace and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Admin email to impersonate and Service-account JSON key.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Devices and browsers

    Connect Microsoft Intune

    The software installed on your managed devices, with a count of devices for each app. It finds AI tools installed on laptops that never go through single sign-on.

    What you'll need

    Directory (tenant) ID
    The ID of your Microsoft tenant.
    Client ID
    The ID of an app registration your Microsoft administrator creates for Aicura.
    Client secret
    A password-like key for that app registration. It is shown once when it is created, so ask for it straight away.

    Who can get these. Your Microsoft administrator. The app registration needs read access to managed devices (DeviceManagementManagedDevices.Read.All). It can be the same registration as for Entra ID.

    Before you start. An active Intune licence.

    How to register an app in Microsoft Entra, from Microsoft.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Microsoft Intune and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Directory (tenant) ID, Client ID and Client secret.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Devices and browsers

    Connect Jamf Pro

    The applications installed on your Macs, grouped by product with a count of devices. It never reads device names or who uses them.

    What you'll need

    Instance URL
    Your Jamf Pro address, such as https://acme.jamfcloud.com.
    Client ID
    The ID of an API client your Jamf administrator creates for Aicura.
    Client secret
    A password-like key for that API client. It is shown once when it is created.

    Who can get these. Your Jamf Pro administrator. The API client needs the Read Computers privilege.

    How to create a Jamf Pro API client, from Jamf.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Jamf Pro and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Instance URL, Client ID and Client secret.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Devices and browsers

    Connect Fleet (osquery)

    The software across the computers Fleet manages, with a count for each title. Computer names and users never leave Fleet.

    What you'll need

    Fleet server URL
    Your Fleet address, such as https://fleet.acme.com.
    API-only user token
    A password-like key Fleet shows once when the API-only user is created.

    Who can get these. Your Fleet administrator. An API-only user with the read-only Observer role is enough.

    Fleet user roles, from Fleet.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Fleet (osquery) and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Fleet server URL and API-only user token.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Devices and browsers

    Connect Chrome Enterprise

    The browser extensions installed across your managed Chrome browsers, with install counts. It never reads individual devices or users.

    What you'll need

    Admin email to impersonate
    The email of a Google Workspace administrator Aicura reads the report as.
    Service-account JSON key
    A key file from Google Cloud that lets Aicura read on that administrator's behalf. Paste the whole file.

    Who can get these. Your Google Workspace super administrator. The key needs read access to Chrome reports (chrome.management.reports.readonly). It can be the same key as for Google Workspace.

    Before you start. Chrome browsers managed through Chrome Browser Cloud Management.

    Chrome Management reports, from Google.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Chrome Enterprise and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Admin email to impersonate and Service-account JSON key.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Cloud inventories

    Connect AWS Config

    AI services running in your AWS accounts, such as SageMaker, Bedrock and Lex. It reads what exists, not what the services hold. There is no key to hand over.

    What you'll need

    Aicura writes the two policies the role needs. Your AWS administrator creates a role named exactly aicura-discovery from them, then gives you its ARN, the aggregator's name and its home region.

    Who needs to help. Your AWS administrator, who creates a read-only role from the policies Aicura gives you.

    Before you start. AWS Config switched on, with an aggregator covering the accounts you want included.

    How to create an IAM role, from AWS.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick AWS Config and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Choose Connect and copy what Aicura shows. That is your ExternalId, a trust policy and a permissions policy. Send them to your AWS administrator.
    5. When they reply, enter Config aggregator name, Aggregator home region and IAM role ARN.
    6. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Cloud inventories

    Connect Azure Resource Graph

    AI resources in your Azure subscriptions, such as Azure OpenAI, Azure Machine Learning and AI Search. It reads what exists, not what the services hold.

    What you'll need

    Directory (tenant) ID
    The ID of your Microsoft tenant.
    Client ID
    The ID of an app registration your Microsoft administrator creates for Aicura.
    Client secret
    A password-like key for that app registration. It is shown once when it is created, so ask for it straight away.

    Who can get these. Your Azure administrator. The app registration needs the Reader role on each subscription. It can be the same registration as for Entra ID.

    How to assign an Azure role, from Microsoft.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Azure Resource Graph and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Directory (tenant) ID, Client ID and Client secret.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Cloud inventories

    Connect GCP Asset Inventory

    AI resources in your Google Cloud organisation, such as Vertex AI, Dialogflow and notebooks. It reads what exists, not what the services hold. There is no key to hand over.

    What you'll need

    Your Google Cloud administrator creates a viewer service account and a workload identity pool that trusts Aicura. They give you the scope to read, the provider's resource name and the service account's email.

    Who needs to help. Your Google Cloud administrator, who sets up a trust between Google Cloud and Aicura using the details Aicura gives you.

    Workload identity federation, from Google Cloud.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick GCP Asset Inventory and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Choose Connect and copy the binding subject and AWS account ID Aicura shows. Send them to your Google Cloud administrator.
    5. When they reply, enter Scope, Workload identity provider resource and Service-account email.
    6. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    IT service management

    Connect ServiceNow CMDB

    The business applications recorded in your CMDB, filtered to the ones that are AI, with their vendor, owner and status.

    What you'll need

    Instance URL
    Your ServiceNow address, such as https://acme.service-now.com.
    Client ID
    The ID of an OAuth client your ServiceNow administrator creates for Aicura.
    Client secret
    A password-like key for that OAuth client.

    Who can get these. Your ServiceNow administrator. The OAuth client runs as an integration user with read access to the CMDB.

    Inbound OAuth in ServiceNow, from ServiceNow.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick ServiceNow CMDB and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Instance URL, Client ID and Client secret.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    IT service management

    Connect Freshservice

    The software in your Freshservice inventory, filtered to the ones that are AI, with publisher and status.

    What you'll need

    Instance URL
    Your Freshservice address, such as https://acme.freshservice.com.
    API key
    The key shown in that agent's profile settings.

    Who can get these. Any Freshservice agent who can view software. Your administrator may need to turn on API access for them.

    Where to find your Freshservice API key, from Freshservice.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Freshservice and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Instance URL and API key.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Code

    Connect GitHub

    Copilot seat counts, AI apps installed in your GitHub organisation, and which repositories use AI libraries. It keeps names and counts only, never your code.

    What you'll need

    There is nothing to copy. Choosing Connect opens GitHub, where an organisation owner approves Aicura's app. It writes one organisation setting that marks the installation as Aicura's, and changes nothing else. The app asks to read repository contents so it can search for AI libraries, and only names are kept. Installing it on selected repositories limits what it can read.

    Who needs to help. A GitHub organisation owner, to approve the install.

    Managing installed GitHub Apps, from GitHub.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick GitHub and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Choose Connect. GitHub opens.
    5. Pick your organisation, choose which repositories to include and choose Install. If you are not an owner, GitHub sends the request to one.
    6. You come back to Aicura with the organisation connected.
    7. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

    Messaging

    Connect Slack

    The apps approved for your Slack organisation, with the access each one has. It never reads messages.

    What you'll need

    Org-admin user token
    A password-like key, starting with xoxp-, from a Slack app your Org Owner or Org Admin installs for Aicura.

    Who can get these. A Slack Org Owner or Org Admin. The token needs the admin.apps:read permission.

    Before you start. Slack Enterprise. Slack's Pro and Business+ plans do not offer the access this needs.

    Slack's admin.apps:read permission, from Slack.

    In Aicura

    1. Go to Settings, then Discovery, and choose Add connector.
    2. Tick Slack and choose Add connector. It is added switched off, ready for its details.
    3. Choose Edit on its row.
    4. Enter Org-admin user token.
    5. Tick Enabled and choose Save.

    The source is now on the Sources tab in Discovery, ready to run.

  4. Run discovery

    Open Discovery, pick your source on the Sources tab and run it. What it finds goes into a queue, waiting for you to decide on each item. Each run counts towards your 100 scans a month.

  5. Review what it found

    The queue in Discovery lists every AI tool and service your sources reported. Open an item to see what was seen and which known product it is likely to be, then find out who uses it and who should own it.

  6. Collect details with the helper PDF

    The person who knows a system best often is not the person building the register. Download the helper PDF from the AI Register, send it to them to fill in, and upload it when it comes back. They do not need an Aicura account.

  7. Add systems to the register

    Add what discovery found straight from the queue, with the form prefilled from the product it matched. Add anything else from the AI Register, from the product library, a helper PDF or a blank form. Every decision is kept with who made it and when.

Step 1

Create your free account

  1. Open the sign-up page. It opens on the free Register plan.
  2. Enter your organisation's name, its country, its organisation type and its primary jurisdiction.
  3. Enter your first name, last name and work email address.
  4. Select Continue to payment and enter a credit card. Nothing is charged on the free plan. You would only be charged if you choose a paid plan later.

The free plan includes 1 user, so sign up with the work email of whoever will look after the register.

Step 2

Set your password and log in

  1. Look for an email from Aicura asking you to set a password. If it has not arrived after a few minutes, check your spam or junk folder.
  2. Open the link in the email and set a password.
  3. Go to app.aicura.app/login and log in with your work email and the new password.

You land on the Dashboard. On a new account its Discovery card points you to connect your first source, and once discovery has run it shows how many found items are waiting for a decision.

Step 4

Run discovery

  1. Open Discovery and go to the Sources tab.
  2. Open the source you connected.
  3. Choose Run.
  4. When it finishes, the result shows under Last outcome. Everything it found is on the source's Items tab and in the Discovery Queue.

Run a source again whenever you want a fresh picture. Anything you have ignored stays ignored.

Step 5

Review what it found

  1. Open Discovery. The Queue tab lists each item with its name, category, the source that reported it and when it was first seen.
  2. Use the source filters to work through one source at a time.
  3. Open an item. It shows how many times it has been seen, what the source reported, such as how many devices run it, and a Possible matches panel of the known products it may be.
  4. For anything worth keeping, find out who uses it, what for and who should own it. What the source reported usually tells you which team to ask.

Items wait in the queue until someone decides, so there is no need to finish in one go.

Step 6

Collect details with the helper PDF

  1. Open the AI Register and choose Download helper.
  2. Send the PDF to the person who knows the system, such as its owner, the team that uses it or whoever manages the vendor.
  3. They fill it in and send it back.
  4. Choose Add AI system or Add agent, then Upload helper. The details from the PDF fill in the form for you to check.

The helper PDF works for any system, including ones discovery did not find, such as a tool a team mentioned or one still being planned.

Step 7

Add systems to the register

From the discovery queue

  1. Open an item in the Discovery queue.
  2. Choose Add as AI system or Add as agent. The form opens, prefilled from the product you matched. Or choose Link to existing if it is already on the register, or Ignore to dismiss it for good.
  3. Check the details, choose where it is in its life (Proposed, In Development, Testing or Live) and choose Register.

Anything else

  1. Open the AI Register and choose Add AI system or Add agent.
  2. Type the product's name in the search box, pick it and choose Use selected to prefill from a known product. Or choose Upload helper for a completed helper PDF, or Start blank.
  3. Check the details, choose where it is in its life and choose Register.

Every decision on a discovered item is kept on the Discovery History tab with who made it and when.

Keeping it current

Run your sources again from time to time, and connect more of them when you are ready. New finds join the queue, anything you ignored stays ignored, and each system keeps a version history as its details change. When you want risk assessments, policies or guardrails on top of the register, the paid plans build on the same register, so nothing has to be entered twice.

Questions

Is the AI register really free?

Yes. The Register plan costs nothing and does not expire. It includes the AI register, discovery with 100 scans a month, a library of known products that fills in the details for you, the helper PDF and reports, for up to 10 AI systems.

Why do I need a credit card for a free plan?

Sign-up asks for a card, but the Register plan is not charged. You are only charged if you choose a paid plan later.

Do I need to be an administrator to connect discovery?

Not in Aicura, but you need a few details from whoever administers the system you are connecting, such as your Okta, Microsoft or Google administrator. Each connector on this page lists exactly what to ask them for, and opens on its own link you can send them.

Does discovery change anything in our systems?

No. Each connector reads what a source reports, such as the apps in your identity provider, installed software or the AI services in your cloud accounts, and proposes what it finds. The one thing written anywhere is a single organisation setting the GitHub app uses to mark its installation as Aicura's. Nothing joins your register until a person adds it.

Does discovery read our source code or documents?

No. GitHub connects as a GitHub App that reads Copilot seat counts, AI-related installed apps and the dependency files that show which repositories use AI libraries. It keeps names and counts, never source code. The other connectors read inventory, not content.

What happens when we have more than 10 AI systems?

Move to a larger size or a paid plan when you need to. Your register, discovery history and decisions come with you, so nothing has to be redone.

Start your register today

Create a free account, connect one source and run your first scan.