Implementation Kit
AI Regulatory Readiness Checklist and 12-Month Plan
Getting ready for what lands in the next year: a 12-month calendar, a gap assessment against incoming obligations, a remediation roadmap with cost and dependencies, and a board briefing template.
Who this is for: The compliance lead planning the next year of AI regulatory work and reporting it upward.
1. 12-month AI regulatory calendar
SpreadsheetEverything with a date in the next 12 months, by jurisdiction.
Template
| Date | Jurisdiction | Obligation | Type | Systems affected | Readiness | Owner |
|---|---|---|---|---|---|---|
| YYYY-MM-DD | new rule / deadline / guidance / standard | not started / in progress / ready |
Worked example
| Date | Jurisdiction | Obligation | Type | Systems | Readiness | Owner |
|---|---|---|---|---|---|---|
| 2026-12-31 | US-NYC | LL144 annual bias audit | deadline | Resume Screener | ready | People Ops |
| 2027-02-15 | EU | expected AI Office guidance on Art. 6(3) | guidance | Resume Screener | monitoring | EU Compliance |
| 2027-06-30 | US-CA | ADMT rules compliance date | deadline | Fraud Scoring, Resume Screener | in progress | US Compliance |
Acceptance criteria
- ✓The calendar covers a rolling 12 months and is refreshed monthly.
- ✓Each entry has a readiness state and an owner.
- ✓Expected (not yet final) guidance is included as "monitoring", with the trigger to firm it up.
2. Compliance gap assessment
SpreadsheetEach incoming obligation against current state and the action required to close it.
Template
| Incoming obligation | Current state | Gap | Required action | Effort | Priority |
|---|---|---|---|---|---|
| <obligation> | S / M / L | H / M / L |
Worked example
| Incoming obligation | Current state | Gap | Required action | Effort | Priority |
|---|---|---|---|---|---|
| CA ADMT: pre-use risk assessment | risk assessments exist, not in the ADMT format | format + specific content | build an ADMT-format template; run for 2 systems | M | H |
| CA ADMT: consumer opt-out for our customers | no opt-out tooling shipped | product feature | ship opt-out API + notice templates | L | H |
| EU Art. 6(3) guidance (expected) | derogation not claimed | possibly none, depends on guidance | re-run classification when guidance lands | S | M |
Acceptance criteria
- ✓Every calendar item with an obligation has a gap assessment row.
- ✓Effort and priority are assigned so the roadmap can be sequenced.
- ✓"No gap" conclusions are stated explicitly with reasoning.
3. Remediation roadmap
SpreadsheetThe sequenced plan: action, owner, deadline, cost, and what it depends on.
Template
| Action | Owner | Deadline | Cost estimate | Dependencies | Status |
|---|---|---|---|---|---|
| <action> | YYYY-MM-DD | not started / in progress / done / blocked |
Worked example
| Action | Owner | Deadline | Cost estimate | Dependencies | Status |
|---|---|---|---|---|---|
| Ship consumer opt-out API + notice templates | Product | 2027-04-30 | ~1.5 eng-months | design sign-off | in progress |
| Build ADMT-format risk assessment template | Compliance | 2027-03-15 | ~0.5 FTE-month | legal review of format | not started |
| FRIA for Resume Screener | Legal | 2026-10-31 | external counsel ~$15k | oversight design final | in progress |
Acceptance criteria
- ✓Every gap has at least one roadmap action with an owner and a deadline.
- ✓Cost estimates and dependencies are recorded so trade-offs are visible.
- ✓Blocked items name the blocker and who owns clearing it.
4. Board and executive regulatory briefing
DocumentA short, recurring briefing so leadership is not surprised by an AI regulatory obligation.
Template
One to two pages. Delivered on a set cadence to the board or a committee.
- What is coming in the next 12 months: the 3-5 items that matter, in plain terms
- Where we stand: ready / on track / at risk for each
- Investment required: headcount, budget, product work, with the ask
- Key risks if we do nothing: enforcement exposure, deal impact, reputational
- Decisions requested: budget approval, prioritisation calls, risk acceptance
- What changed since last briefing
Worked example
- Coming: CA ADMT rules (Jun 2027); EU AI Act high-risk applicability (Dec 2027); expected EU Art. 6(3) guidance.
- Where we stand: ADMT at risk (product work not started); EU high-risk on track; guidance monitored.
- Investment: ~2 eng-months for ADMT opt-out tooling; ~$25k external counsel for FRIA and format review.
- Risks if we do nothing: ADMT non-compliance blocks CA enterprise renewals (~$1.2M ARR exposure); EU high-risk gap limits EU expansion.
- Decisions requested: approve the ADMT product work for Q1; approve external counsel spend.
- Since last time: CO SB205 amendment moved its date; reflected in the calendar.
Acceptance criteria
- ✓The briefing is delivered on a set cadence, not only when something breaks.
- ✓It states a clear readiness status and a specific ask.
- ✓It ties regulatory gaps to business impact leadership cares about.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The calendar and its monthly refresh are the regulatory and standards monitoring workflow.
The remediation roadmap is a governance-program milestone plan with owners and dates.
The gap assessment captures soft-law and expected-guidance obligations alongside binding ones.
The board briefing template is board reporting on regulatory risk with decisions requested.
Readiness status across obligations is an input to the governance maturity assessment.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →