Templates
43 free AI governance templates, generated from the law on record
Free · no account · links emailed to your work address
Summary
43 free AI governance templates in XLSX and DOCX, generated from the 129 recorded duties, 26 controls and 244 instruments on this site and rebuilt when the records change. Every row that cites a duty links to its record; each file carries its version, dataset hash, date and licence on a README page. Request any template with your work email and the files arrive by email.
Last built · CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
On this page 8 sections
Filter by type, topic or framework optional
Registers
-
Register XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI System Inventory
One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet.
-
Register XLSX NIST AI RMFISO/IEC 42001EU AI ActAI Risk Register (MIT AI Risk Repository taxonomy)
A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds.
-
Register XLSX and DOCX EU AI ActNIST AI RMFAI Agent Registry and Permission Matrix
A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001AI Data Governance Register
One row per dataset that trains, tests or feeds an AI system: provenance, personal data, lawful basis or licence, bias checks and retention, with a procedure and the data duties on record.
-
Register XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Audit Evidence Tracker
Every piece of evidence the recorded controls expect, one row each, with owner, status, location and review date, so an audit or certification starts from a complete list.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001AI Change Log and Substantial Modification Test
Every release of an AI system after it is in use, with a built-in test that flags a possible substantial modification, the decision and its approver, and the duties a change gate serves.
-
Register XLSX and DOCX EU AI ActAI Regulatory Horizon Scan
Twelve months of recorded AI policy changes with columns to rate relevance and assign actions, every upcoming deadline, and a quarterly briefing outline. Rebuilt whenever a change is recorded.
-
Register XLSX and DOCX Colorado ADMT law (SB 26-189)US State AI Law Applicability Matrix
Every US federal and state AI instrument on record in one sheet, with status, legal force, application date, recorded duties and verification state, plus columns to decide which apply to you.
-
Register XLSX and DOCX EU AI ActPublic-Sector AI Use-Case Inventory
For government agencies: an AI use-case inventory in the shape public-sector rules ask for, flagging rights- and safety-affecting uses, with a procedure and every recorded duty that names public authorities.
Checklists
-
Checklist XLSX EU AI ActEU AI Act Role and Risk Classifier
Answer six questions per system and the sheet returns the role, the risk tier and the date its duties apply, looked up from the dated milestones on the EU AI Act record.
-
Checklist XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Vendor Due-Diligence Questionnaire
Questions to put to an AI vendor, grouped by governance, data, model, security, transparency, incidents, and insurance and indemnity, scored automatically.
-
Checklist XLSX and DOCX EU AI ActEU AI Act High-Risk Deployer Compliance Pack
For organisations using a high-risk AI system: every recorded EU AI Act deployer duty as a per-system checklist, a log of notices to workers and affected people, notice templates and the dates that apply.
-
Checklist XLSX and DOCXSouth Korea AI Basic Act Compliance Checklist
Every recorded duty of the Korean Framework Act as a checklist per product: advance notice and labelling of generative and high-impact AI, compute-threshold safety measures, high-impact duties and the domestic representative.
-
Checklist XLSX and DOCXTexas TRAIGA Compliance Checklist
The Texas Responsible AI Governance Act duty by duty: the prohibitions on manipulation, unlawful discrimination and sexual-content misuse, and the AI disclosure duties for government agencies and health-care providers.
Assessments
-
Assessment DOCX and XLSX EU AI ActFundamental Rights Impact Assessment (FRIA)
The assessment Article 27 of the EU AI Act requires of deployers of high-risk AI: one section per element the article names, with placeholders, plus a register to track completed assessments.
-
Assessment DOCX and XLSX NIST AI RMFISO/IEC 42001Colorado ADMT law (SB 26-189)AI Impact Assessment
A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.
-
Assessment XLSX ISO/IEC 42001ISO/IEC 42001 Gap Assessment and Statement of Applicability
Every ISO/IEC 42001 clause and control the records map to, with the legal duties behind each, applicability, implementation status and evidence, in the form a Statement of Applicability takes.
-
Assessment DOCX and XLSX NIST AI RMFAI Workforce Impact Assessment
An assessment of what an AI deployment does to jobs: roles affected, tasks automated, timeline, consultation, reskilling and disclosure, with a role inventory sheet.
-
Assessment XLSX and DOCX EU AI ActNIST AI RMFAI Red-Team and Evaluation Test Plan
A test plan and case log for adversarial and evaluation testing: accuracy, robustness, prompt injection, bias, harmful content, privacy leakage and misuse, with severity and retest tracking.
-
Assessment DOCX and XLSX EU AI ActAI Supplement to a Data Protection Impact Assessment
Fifteen AI-specific questions to add to a DPIA (inferences, training on personal data, accuracy across groups, automated decisions, model attacks, suppliers), with the privacy and impact-assessment duties on record.
Policies
-
Policy DOCX EU AI ActISO/IEC 42001AI Acceptable Use Policy
A policy for staff use of AI tools: permitted and prohibited uses, data handling, disclosure and reporting, with the prohibited practices drawn from the law.
-
Policy DOCX and XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Governance Policy and RACI
The governance policy an AI management system needs, built from the recorded governance duties, with a RACI matrix over every recorded control.
-
Policy DOCX and XLSX EU AI ActAI Contract Clause Library
Nine contract clauses for buying or supplying AI: documentation, data use, testing, incidents, changes, oversight, audit and the allocation of regulatory roles, each tied to the duty it allocates.
Procedures
-
Procedure DOCX and XLSX EU AI ActColorado ADMT law (SB 26-189)Human Oversight Procedure
A procedure for the humans who oversee an AI system: what they must be able to do, when they intervene, how an override is recorded, drawn from every recorded oversight duty.
-
Procedure DOCX and XLSX EU AI ActNIST AI RMFAI Incident Response Playbook and Log
Detect, contain, report and learn: a playbook built from the recorded incident-handling duties, with the reporting deadlines they set, and a log that computes them.
-
Procedure XLSX and DOCX EU AI ActAI Literacy and Training Plan
A role-based AI literacy plan: who needs which level of training, in what format, by when, with a coverage formula and the literacy and oversight duties on record.
-
Procedure DOCX and XLSX EU AI ActISO/IEC 42001AI Post-Market Monitoring Plan
How a deployed AI system is watched after release: metrics, thresholds, frequency, owners and escalation to incident response, with the monitoring and incident duties on record.
-
Procedure XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Use-Case Intake and Triage Form
Register and screen every proposed AI use before work starts: an intake register, a screen against every prohibited practice on record, and routing to standard, enhanced or transparency review.
-
Procedure XLSX and DOCX EU AI ActSynthetic Content Labelling and Provenance Plan
One labelling design for AI-generated text, images, audio and video: per-feature visible labels and machine-readable marks, with every recorded duty to label, mark or disclose synthetic content.
Kits
-
Kit DOCX and XLSX EU AI ActEU AI Act Article 50 Transparency Kit
Notice texts and a checklist for the transparency duties of Article 50: chatbot disclosure, synthetic content marking, deepfake and emotion-recognition notices, with the application date from the record.
-
Kit DOCX and XLSX Colorado ADMT law (SB 26-189)Colorado ADMT Law (SB 26-189) Notices
The notices Colorado's SB 26-189 requires when automated decision-making technology influences a consequential decision: advance notice, adverse-decision disclosure, human review, record keeping and developer documentation, built from the recorded duties.
-
Kit DOCX and XLSXCalifornia ADMT and Risk Assessment Kit (CPPA)
For businesses using automated decision-making technology for significant decisions in California, under the CPPA rules that apply from 1 January 2027: Pre-use Notice, opt-out, access response and risk assessment texts, with a register of ADMT uses, an opt-out log that counts the 15 business days, and a risk assessment tracker with the review, update and submission dates.
-
Kit DOCX and XLSXAI Companion Chatbot Safety Kit
For AI companion chatbots under the US state laws on record: not-human notices, protections for minors, a crisis protocol for suicidal ideation and self-harm, and protocol publication, with a disclosure schedule, a crisis referral log and every recorded duty.
-
Kit DOCX and XLSX EU AI ActISO/IEC 42001AI System Technical Documentation
The technical file a high-risk system needs: one section per element the recorded documentation duties name, with placeholders, plus a document register.
-
Kit DOCX and XLSX EU AI ActISO/IEC 42001NIST AI RMFAI Model Card
A model or system card: intended use, out-of-scope uses, data, evaluation results by group, risks, oversight and monitoring, with the documentation and transparency duties it helps evidence.
-
Kit XLSX and DOCX ISO/IEC 42001NIST AI RMFAI Governance Board Reporting Pack
A quarterly board report on AI: a dashboard of eight measures, the regulatory deadlines ahead from the records, and a report outline ending in the decisions the board is asked to take.
-
Kit XLSX and DOCX EU AI ActGeneral-Purpose AI Model Provider Compliance Kit
For providers of general-purpose AI models: every recorded GPAI provider duty as a checklist, the information pack for downstream providers, a training-content summary worksheet and the systemic-risk sections.
-
Kit XLSX and DOCX EU AI ActISO/IEC 42001EU AI Act Conformity Assessment and QMS Workbook
For providers of high-risk AI systems: each recorded requirement mapped to the evidence that meets it, the thirteen quality management elements, a re-assessment trigger log and a draft declaration of conformity.
-
Kit DOCX and XLSX EU AI ActColorado ADMT law (SB 26-189)AI Decision Explanation and Appeal Kit
When AI makes or supports a decision about a person: an adverse decision notice, an explanation reply, a human review procedure and a request log that counts days to answer, with every duty on record that asks for them.
-
Kit XLSX and DOCX Colorado ADMT law (SB 26-189)Employment AI Bias Audit Kit
For hiring and HR tools: a selection-rate and impact-ratio calculator, an audit and notice tracker, a candidate notice template and the employment AI duties on record for New York City, Illinois and Colorado.
-
Kit DOCX and XLSX EU AI ActFrontier AI Safety Framework and Transparency Report
For developers of the most capable models: an outline of a published safety framework and a model transparency report, a capability-threshold sheet, a safety incident log and the frontier-model duties on record.
Crosswalks
-
Crosswalk XLSX NIST AI RMFEU AI ActISO/IEC 42001NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Every recorded legal duty against the NIST AI RMF and ISO/IEC 42001 references it maps to, with the confidence of each mapping, so what is done for one counts for the others.
-
Crosswalk XLSX EU AI ActColorado ADMT law (SB 26-189)Global AI Regulatory Applicability Matrix
Every binding AI instrument on record, by jurisdiction, with status, application date, who it binds and the use cases it covers, as a matrix to mark which apply to you.
Not sure where to start? Score yourself first
All 31 free self-assessmentsA short questionnaire shows which areas are weakest; the template beside it is where that work gets written down. They run on Certifyi, a related product. A score is a self-check, not an audit.
-
Self-assessment28 questions · about 7 min
EU AI Act Readiness AssessmentWhether you could evidence what the EU AI Act sets out for your role as provider or deployer: roles, prohibited practices, high-risk requirements, conformity, deployer duties, transparency and general-purpose AI.
-
Self-assessment21 questions · about 6 min
AI Literacy Readiness AssessmentHow you support AI literacy among the people who build, run and use AI, as the EU AI Act asks of providers and deployers: scope, role-based training, content, delivery, records and behaviour change.
-
Self-assessment20 questions · about 5 min
AI Transparency & Disclosure AssessmentWhether people know when they are dealing with AI, when content is synthetic, and why an AI-informed decision went against them: disclosure, labelling, explanations and documentation.
-
Self-assessment23 questions · about 6 min
ISO/IEC 42001 Readiness AssessmentHow close your AI management system is to an ISO/IEC 42001:2023 certification audit: seven domains following clauses 4 to 10 and the Annex A controls, checked the way an auditor samples evidence.
Then: ISO/IEC 42001 Gap Assessment and Statement of Applicability
-
Self-assessment22 questions · about 6 min
AI Security Controls AssessmentSecuring AI end to end: threat modelling for machine learning, access to models and data, adversarial testing, secure deployment, monitoring and incident handling.
-
Self-assessment21 questions · about 6 min
AI System Risk Classification AssessmentWhich EU AI Act tier each AI system sits in, and whether you could defend the call: inventory, prohibited-practice screening, the high-risk routes, transparency-only systems and how decisions are revisited.
How the templates are made
Each template is described as data: which duties it covers, which sheets and sections it has, and how the records fill them. A daily job turns the obligations, controls, deadlines, framework crosswalks and the MIT AI Risk Repository taxonomy into the files. Every row that cites a duty links to its record, and the record links to the official source and states its verification status. The methodology page explains the trust model behind every record.
When the records change, a template that is affected gets the next version with a changelog; the old address keeps working and the page lists every version. Rebuilds appear in the AI policy updates hub and in the templates feed.
Frequently asked questions
Which template do I need for the EU AI Act?
Start with the AI system inventory and the EU AI Act role and risk classifier: they tell you which systems are in scope and in what role. Providers of high-risk systems then need the conformity assessment and QMS workbook and the technical documentation template; deployers the high-risk deployer pack and the FRIA; anyone with a chatbot or generated content the Article 50 transparency kit. Templates by framework: EU AI Act (32), ISO/IEC 42001 (17), NIST AI RMF (14) and Colorado ADMT law (SB 26-189) (7).
What should an AI acceptable use policy include?
Our AI Acceptable Use Policy template has 9 sections: purpose and scope, definitions, permitted uses, prohibited uses, data and confidentiality, disclosure, competence and training, reporting and enforcement and review. It cites the 6 recorded duties it helps meet, each with its source reference. It is free on https://aipolicytracker.org/templates/acceptable-use-policy.
What should an AI risk register include?
Our AI Risk Register (MIT AI Risk Repository taxonomy) template records risk ID, system, risk domain (MIT), subdomain (MIT), risk description, cause or trigger, likelihood (1–5), impact (1–5), inherent score and control applied. It is free on https://aipolicytracker.org/templates/ai-risk-register.
What goes into an AI impact assessment?
Our AI Impact Assessment template has 5 sections: scope, affected people, harm analysis, mitigations and residual risk and decision. Its Harm areas sheet records domain, harm area, definition (MIT AI Risk Repository), relevant to this system, analysis and mitigation. It cites the 7 recorded duties it helps meet, each with its source reference. It is free on https://aipolicytracker.org/templates/ai-impact-assessment.
What should an AI system inventory record?
Our AI System Inventory template has 2 sections: why an inventory and fields and what to record. Its Inventory sheet records system ID, system name, business owner, intended purpose, lifecycle stage, your role under the law, primary jurisdiction, EU AI Act tier, personal data and automated decisions about people. It cites the 12 recorded duties it helps meet, each with its source reference. It is free on https://aipolicytracker.org/templates/ai-system-inventory.
Are the templates free?
Yes. There is no charge and no account: enter your name, company and work email on the template page and the download links arrive by email, valid for 7 days. The files are licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
Where does the content come from?
From the records on this site: obligations, controls, deadlines, framework mappings and the MIT AI Risk Repository taxonomy. Nothing in a file is written by hand; the catalogue says what each template is, and the builder turns the records into sheets and pages.
What happens when a law changes?
The library is rebuilt daily. A template whose content changed gets the next version number, a changelog on its page, an entry in the updates hub and in the templates feed, and a line in the weekly digest for subscribers who chose the templates topic.
Does completing a template make us compliant?
No. A template is an informational resource, not legal advice. It helps produce the evidence a regulator, customer or auditor asks for; whether a duty applies, and whether it is met, is a judgement the template cannot make.
Is there a self-assessment to go with the templates?
Yes. 31 free self-assessments are listed on this site, and each of those shown beside the templates names the template it goes with: for example the EU AI Act Readiness Assessment (28 questions, about 7 minutes) with the EU AI Act High-Risk Deployer Compliance Pack. They run on Certifyi, a related product. A score is a self-check, not an audit.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.