AI Governance & Compliance Templates

These worksheets are free. Read each one on the page, or download the same worksheet as a .docx. They are working documents for people who already own the decision. They are not legal advice, and completing one does not certify an organization or assess a system.

EU AI Act

EU AI Act Risk Classification Template

A worksheet for one AI system under Regulation (EU) 2024/1689, as amended by the Digital Omnibus (Regulation (EU) 2026/1744). Work through scope, role, the Article 5 prohibitions, the two high-risk routes, the Article 6(3) derogation and Article 50 transparency. Tiers can stack. This is not a conformity assessment and it is not legal advice. Confirm the consolidated text on EUR-Lex before you rely on a date.

Audience. Providers, deployers and in-house counsel classifying one AI system

View template

NIST AI RMF

NIST AI RMF Gap Assessment Template

A category-level gap assessment against the NIST AI Risk Management Framework 1.0 (NIST AI 100-1, January 2023). The framework is voluntary. Its four functions are Govern, Map, Measure and Manage. For a generative system, NIST AI 600-1 (July 2024) is an overlay of risk themes, not a replacement for the four functions. Adopting the framework is not a general legal safe harbor. Colorado SB 26-189 was enacted May 14, 2026. Section 5 makes the repeal-and-reenactment, which removes SB 24-205's rebuttable presumption for following a recognized framework such as the NIST AI RMF, effective January 1, 2027. Plan as if the presumption will not be available after that date. Under Texas TRAIGA section 552.105(e)(2), each route requires actually discovering the violation: through feedback; through testing, including adversarial or red-team testing; by following applicable state agency guidelines; or through an internal review process while in substantial compliance with the NIST AI RMF Generative AI Profile or another recognized framework. Third-party misuse is a separate defense. The point of the worksheet is the evidence.

Audience. The team that owns AI risk, with the people who can produce the evidence

View template

ISO/IEC 42001

ISO 42001 Statement of Applicability Template

A Statement of Applicability worksheet for an AI management system built to ISO/IEC 42001:2023. Clause 6.1.3 asks for the necessary controls, a justification for including or excluding each one, and the implementation status. Annex A lists 38 reference controls across nine objectives, A.2 to A.10. Annex B gives implementation guidance, which this worksheet does not reproduce. The control names below are short paraphrases. Use your licensed copy of the standard for the exact titles and text. An accredited certification body is what certifies a management system. A consultancy does not, and neither does this template.

Audience. The person who maintains the AI management system, and the approver who signs the SoA

View template

Put a worksheet to work

The readiness assessment is where a completed template gets tested against the way the organization actually ships.

Schedule a Consultation (415) 644-8208