Templates
ISO/IEC 42001 templates
Summary
17 free ISO/IEC 42001 templates in XLSX and DOCX (5 registers, 2 assessments, 2 policies, 1 checklist, 1 crosswalk, 4 kits and 2 procedures), generated from 107 recorded duties and rebuilt when those records change. Every row that cites a duty links to the record and its official source.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI System Inventory
One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet.
-
Register XLSX NIST AI RMFISO/IEC 42001EU AI ActAI Risk Register (MIT AI Risk Repository taxonomy)
A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds.
-
Assessment DOCX and XLSX NIST AI RMFISO/IEC 42001Colorado ADMT law (SB 26-189)AI Impact Assessment
A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.
-
Policy DOCX EU AI ActISO/IEC 42001AI Acceptable Use Policy
A policy for staff use of AI tools: permitted and prohibited uses, data handling, disclosure and reporting, with the prohibited practices drawn from the law.
-
Policy DOCX and XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Governance Policy and RACI
The governance policy an AI management system needs, built from the recorded governance duties, with a RACI matrix over every recorded control.
-
Checklist XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Vendor Due-Diligence Questionnaire
Questions to put to an AI vendor, grouped by governance, data, model, security, transparency, incidents, and insurance and indemnity, scored automatically.
-
Assessment XLSX ISO/IEC 42001ISO/IEC 42001 Gap Assessment and Statement of Applicability
Every ISO/IEC 42001 clause and control the records map to, with the legal duties behind each, applicability, implementation status and evidence, in the form a Statement of Applicability takes.
-
Crosswalk XLSX NIST AI RMFEU AI ActISO/IEC 42001NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Every recorded legal duty against the NIST AI RMF and ISO/IEC 42001 references it maps to, with the confidence of each mapping, so what is done for one counts for the others.
-
Kit DOCX and XLSX EU AI ActISO/IEC 42001AI System Technical Documentation
The technical file a high-risk system needs: one section per element the recorded documentation duties name, with placeholders, plus a document register.
-
Kit DOCX and XLSX EU AI ActISO/IEC 42001NIST AI RMFAI Model Card
A model or system card: intended use, out-of-scope uses, data, evaluation results by group, risks, oversight and monitoring, with the documentation and transparency duties it helps evidence.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001AI Data Governance Register
One row per dataset that trains, tests or feeds an AI system: provenance, personal data, lawful basis or licence, bias checks and retention, with a procedure and the data duties on record.
-
Register XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Audit Evidence Tracker
Every piece of evidence the recorded controls expect, one row each, with owner, status, location and review date, so an audit or certification starts from a complete list.
-
Procedure DOCX and XLSX EU AI ActISO/IEC 42001AI Post-Market Monitoring Plan
How a deployed AI system is watched after release: metrics, thresholds, frequency, owners and escalation to incident response, with the monitoring and incident duties on record.
-
Kit XLSX and DOCX ISO/IEC 42001NIST AI RMFAI Governance Board Reporting Pack
A quarterly board report on AI: a dashboard of eight measures, the regulatory deadlines ahead from the records, and a report outline ending in the decisions the board is asked to take.
-
Procedure XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Use-Case Intake and Triage Form
Register and screen every proposed AI use before work starts: an intake register, a screen against every prohibited practice on record, and routing to standard, enhanced or transparency review.
-
Kit XLSX and DOCX EU AI ActISO/IEC 42001EU AI Act Conformity Assessment and QMS Workbook
For providers of high-risk AI systems: each recorded requirement mapped to the evidence that meets it, the thirteen quality management elements, a re-assessment trigger log and a draft declaration of conformity.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001AI Change Log and Substantial Modification Test
Every release of an AI system after it is in use, with a built-in test that flags a possible substantial modification, the decision and its approver, and the duties a change gate serves.
Frequently asked questions
Are these ISO/IEC 42001 templates free?
Yes. Each template page has a short form: enter your name, company and work email and the download links arrive by email, valid for 7 days. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
Where should I start?
With AI System Inventory and AI Risk Register (MIT AI Risk Repository taxonomy). They establish which systems and duties are in scope; the other templates then cover individual duties.
Do they make us compliant?
No. They are informational resources, not legal advice. They help you produce the evidence a regulator, customer or auditor asks for; whether a duty applies is a judgement they cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.