Templates
NIST AI RMF templates
Summary
14 free NIST AI RMF templates in XLSX and DOCX (4 registers, 3 assessments, 1 policy, 1 checklist, 2 procedures, 1 crosswalk and 2 kits), generated from 107 recorded duties and rebuilt when those records change. Every row that cites a duty links to the record and its official source.
-
Register XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI System Inventory
One row per AI system: purpose, role under the law, jurisdictions, risk tier, data, owner and review dates, with the recorded duties for each role on a reference sheet.
-
Register XLSX NIST AI RMFISO/IEC 42001EU AI ActAI Risk Register (MIT AI Risk Repository taxonomy)
A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds.
-
Assessment DOCX and XLSX NIST AI RMFISO/IEC 42001Colorado ADMT law (SB 26-189)AI Impact Assessment
A general impact assessment for any AI system: purpose, affected people, harms by risk domain, mitigations and the decision, with the impact-assessment duties recorded across jurisdictions as the checklist.
-
Policy DOCX and XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Governance Policy and RACI
The governance policy an AI management system needs, built from the recorded governance duties, with a RACI matrix over every recorded control.
-
Checklist XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Vendor Due-Diligence Questionnaire
Questions to put to an AI vendor, grouped by governance, data, model, security, transparency, incidents, and insurance and indemnity, scored automatically.
-
Procedure DOCX and XLSX EU AI ActNIST AI RMFAI Incident Response Playbook and Log
Detect, contain, report and learn: a playbook built from the recorded incident-handling duties, with the reporting deadlines they set, and a log that computes them.
-
Register XLSX and DOCX EU AI ActNIST AI RMFAI Agent Registry and Permission Matrix
A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never.
-
Crosswalk XLSX NIST AI RMFEU AI ActISO/IEC 42001NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk
Every recorded legal duty against the NIST AI RMF and ISO/IEC 42001 references it maps to, with the confidence of each mapping, so what is done for one counts for the others.
-
Assessment DOCX and XLSX NIST AI RMFAI Workforce Impact Assessment
An assessment of what an AI deployment does to jobs: roles affected, tasks automated, timeline, consultation, reskilling and disclosure, with a role inventory sheet.
-
Kit DOCX and XLSX EU AI ActISO/IEC 42001NIST AI RMFAI Model Card
A model or system card: intended use, out-of-scope uses, data, evaluation results by group, risks, oversight and monitoring, with the documentation and transparency duties it helps evidence.
-
Register XLSX ISO/IEC 42001NIST AI RMFEU AI ActAI Audit Evidence Tracker
Every piece of evidence the recorded controls expect, one row each, with owner, status, location and review date, so an audit or certification starts from a complete list.
-
Assessment XLSX and DOCX EU AI ActNIST AI RMFAI Red-Team and Evaluation Test Plan
A test plan and case log for adversarial and evaluation testing: accuracy, robustness, prompt injection, bias, harmful content, privacy leakage and misuse, with severity and retest tracking.
-
Kit XLSX and DOCX ISO/IEC 42001NIST AI RMFAI Governance Board Reporting Pack
A quarterly board report on AI: a dashboard of eight measures, the regulatory deadlines ahead from the records, and a report outline ending in the decisions the board is asked to take.
-
Procedure XLSX and DOCX EU AI ActISO/IEC 42001NIST AI RMFAI Use-Case Intake and Triage Form
Register and screen every proposed AI use before work starts: an intake register, a screen against every prohibited practice on record, and routing to standard, enhanced or transparency review.
Frequently asked questions
Are these NIST AI RMF templates free?
Yes. Each template page has a short form: enter your name, company and work email and the download links arrive by email, valid for 7 days. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
Where should I start?
With AI System Inventory and AI Risk Register (MIT AI Risk Repository taxonomy). They establish which systems and duties are in scope; the other templates then cover individual duties.
Do they make us compliant?
No. They are informational resources, not legal advice. They help you produce the evidence a regulator, customer or auditor asks for; whether a duty applies is a judgement they cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.