Practical tools for compliance teams
Turn governance guidance into working documents. Browse 53 free implementation kits, each with blank templates, worked examples, acceptance criteria, and links to the controls it supports.
Download a complete kit as Markdown or copy its tables as CSV for your spreadsheet. No account or email required. Adapt the examples to your systems; templates do not establish regulatory compliance.
Everything needed to stand up a working AI inventory: the register itself, a scoring matrix that turns three inputs into a risk tier, a shadow-AI discovery survey, and a procurement checkpoint. Fill the register, score every system, assign an owner and a review date.
4 artifacts · Blank templates and worked examples
A standard assessment you can run on any AI system: a worksheet that covers every dimension, a scoring rubric that produces a tier, a matrix of what each tier requires, and a sign-off page. The output is one signed assessment per system with a rationale and a review date.
4 artifacts · Blank templates and worked examples
A repeatable due diligence pass for any material AI vendor: a questionnaire across four domains, a contract clause checklist, a weighted scorecard, and a model card request. The output is a documented DD record per vendor with gaps and contractual protections tracked.
4 artifacts · Blank templates and worked examples
The documents that make AI governance ownership explicit: a charter, a RACI across the core activities, an escalation and pause-authority table, and a one-page structure summary for the board. The output is a signed structure with a named owner for every activity.
4 artifacts · Blank templates and worked examples
What you need to report AI risk to the board on a schedule: a report template, a dashboard, an escalation threshold register, and a fiscal-year calendar. The output is a quarterly report delivered on time with escalation thresholds that have been tested at least once.
4 artifacts · Blank templates and worked examples
Governing an agent that takes actions: an autonomy boundary spec that says what it can do without a human, an identity and permissions register, an action log schema, and a sign-off checklist covering business, risk, and legal.
4 artifacts · Blank templates and worked examples
The controls that decide whether an agent has earned more autonomy and whether you can stop it. Autonomy expansion criteria, a multi-agent trust hierarchy, a non-human identity register, scope-drift monitoring, and logged kill-switch propagation tests.
5 artifacts · Blank templates and worked examples
What you would hand a regulator or plaintiff's attorney tomorrow, and how to find the gaps first. A gap analysis grid, a documentation package checklist by risk tier, a post-incident report template, and a tabletop scenario for a regulatory inquiry.
4 artifacts · Blank templates and worked examples
A run-it-yourself bias testing protocol: a disparate-impact analysis with a four-fifths calculator, a subgroup confusion-matrix template, a remediation decision tree keyed to the source of bias, and an audit trail that records before-and-after metrics.
4 artifacts · Blank templates and worked examples
Controls so AI-generated content meets your accuracy and liability bar before it leaves the building. A content risk-tiering matrix with a review standard per tier, an output log, and a training scenario library of real hallucination cases.
4 artifacts · Blank templates and worked examples
Who owns AI outputs, what infringement exposure the training data creates, and whether client agreements keep up. A vendor IP audit checklist, a training data IP assessment, client disclosure language, and an IP clause library.
4 artifacts · Blank templates and worked examples
Everything to reconstruct a single AI decision about a single person months later. A decision-log schema by decision type, a versioning and change policy, a retention schedule tied to the underlying legal regime, and an audit-readiness checklist.
4 artifacts · Blank templates and worked examples
Which AI coding tools are allowed, for whom, and under what conditions. An approved tool register, a data boundary review template, a developer access tier matrix, and a vendor policy-change log. Locally installed CLIs are the blind spot this kit is built around.
4 artifacts · Blank templates and worked examples
What documentation each system legally needs, and what you can skip. A requirements matrix by risk tier, plus the four templates that matter most: model card, data governance record, bias assessment, and human oversight arrangement.
4 artifacts · Blank templates and worked examples
Setting and delivering the right level of explanation per system. A requirements matrix, a customer-facing adverse-action explanation template, a regulator explanation document, and a validation checklist that asks whether an explanation is actually faithful to the model.
4 artifacts · Blank templates and worked examples
The step before testing: choosing the fairness definition that fits your use case, since you cannot satisfy all of them at once. A selection worksheet, an intersectional test plan, and a re-test schedule. Pair it with the Bias Testing Kit for the mechanics.
3 artifacts · Blank templates and worked examples
A baseline of practices that hold up under scrutiny, each mapped to a control domain and playbook, plus a way to verify they are real: an enforcement verification log and a ranked gap list.
3 artifacts · Blank templates and worked examples
Deciding whether to hire an AI governance consultant or build in-house, and running the engagement so the program survives the handoff. A build-vs-buy matrix, an RFP template, a scope-of-work with handoff milestones, and reference-check questions focused on what happens after the consultant leaves.
4 artifacts · Blank templates and worked examples
Turning an internal maturity picture into something you can say to investors and regulators without overclaiming. An investor-facing disclosure template, a regulatory examination evidence package structure, an ESG metrics sheet, and an internal-to-external translation guide.
4 artifacts · Blank templates and worked examples
A structured way to face the recurring hard problems: an obstacle assessment mapping each common challenge to your current state, a control enforcement audit comparing documented to verified, and an ownership gap log.
3 artifacts · Blank templates and worked examples
Auditing the governance program itself, not just individual systems. A maturity model with concrete criteria per cell, a sampling plan that does not rely on self-report, a three-state finding classification, and a domain scorecard for the board.
4 artifacts · Blank templates and worked examples
The starting set for standing up an AI governance program: a program charter, a maturity self-assessment to find your starting point, a policy library checklist in build order, a 90-day launch plan, and a quarterly board dashboard.
4 artifacts · Blank templates and worked examples
Designing oversight that is real: a workflow design checklist, a reviewer decision template that captures reasoning on agreement as well as override, a reviewer qualification standard by decision type, and a spec for override-rate monitoring.
4 artifacts · Blank templates and worked examples
Auditing a review process you already have for whether it is substantive or a formality. A workflow audit template, an override-rate audit by reviewer, and second-reviewer escalation criteria for cases where the AI and the first reviewer diverge.
3 artifacts · Blank templates and worked examples
What to do when an AI system causes harm or fails: a classification matrix, a runbook per incident type, a regulatory notification checklist across jurisdictions, a post-incident report template, and an incident register that also captures near-misses.
5 artifacts · Blank templates and worked examples
For the second pass, when the question is whether the inventory is actually complete. A master template, an amnesty disclosure survey, a reconciliation log that proves every discovery method was run, and a standing quarterly review agenda.
4 artifacts · Blank templates and worked examples
A monitoring setup that catches a model degrading before users do. A metrics specification by model type, an alert threshold worksheet, an ownership register, and a drift response protocol with yellow and red actions.
4 artifacts · Blank templates and worked examples
Stage gates from preview to retirement. Stage definitions with promotion criteria, a register of events that force re-assessment, a promotion gate checklist, and a retirement checklist.
4 artifacts · Blank templates and worked examples
The registry as a governed source of truth, not a spreadsheet nobody updates. A field schema, a pre-deployment entry gate, a versioning policy that says what triggers a new record, and a retirement process.
4 artifacts · Blank templates and worked examples
Confirming a lawful basis for personal data at every stage of an AI system and that data subject rights still work. A data processing inventory by stage, a GDPR Article 22 checklist, a data subject rights process that reaches training data, and a transfer mechanism verification log.
4 artifacts · Blank templates and worked examples
Making red-teaming rigorous instead of a checklist review. A scope and pass/fail template, an attack scenario library for generative and decision systems, a findings log with re-test status, and a report template.
4 artifacts · Blank templates and worked examples
Engaging regulators and standards bodies before rules are final. An engagement map, a comment process from flagging to filing, a position-paper template, and an engagement log.
4 artifacts · Blank templates and worked examples
The base layer for tracking what applies to you: an applicability matrix of systems against jurisdictions and regulations, a deadline calendar, and a monitoring subscription list so a new rule does not arrive as a surprise.
3 artifacts · Blank templates and worked examples
One structure for obligations across every jurisdiction you operate in: a regulatory inventory, a unified control mapping showing which internal control satisfies which obligation where, a conflict register for genuine incompatibilities, and monitoring assignments.
4 artifacts · Blank templates and worked examples
Getting ready for what lands in the next year: a 12-month calendar, a gap assessment against incoming obligations, a remediation roadmap with cost and dependencies, and a board briefing template.
4 artifacts · Blank templates and worked examples
One risk register that serves EU AI Act, NIST AI RMF, ISO 42001, and GDPR at once, without duplicating work. A register template with cross-reference notation, a framework cross-reference map, and a committee reporting format.
3 artifacts · Blank templates and worked examples
Tracing what your production AI actually depends on: foundation models, training and fine-tuning data, inference infrastructure, and the AI tools in your build pipeline. A supply chain map, a risk assessment for the critical links, and an incident runbook for supply-chain events.
3 artifacts · Blank templates and worked examples
How to audit one AI system against its obligations: a scope and methodology template, a document review checklist by tier, a bias-testing verification worksheet, a human oversight interview guide, and a findings template.
5 artifacts · Blank templates and worked examples
Applying the three-lines model to AI risk without the second line rubber-stamping what it cannot evaluate. A RACI across the lines, a second-line technical literacy assessment, a risk committee reporting template, and a third-line audit program.
4 artifacts · Blank templates and worked examples
Whether you may use a dataset for this training purpose, and what you owe the people in it. A provenance record, a PII assessment method, a minimization checklist, and a data subject rights response template for training data.
4 artifacts · Blank templates and worked examples
Managing an AI vendor from map to requalification. A vendor map with risk classification, the five contract clauses that matter with negotiation notes, and a risk-based monitoring schedule with requalification triggers.
3 artifacts · Blank templates and worked examples
Tracking the voluntary safety commitments that shaped a procurement decision, and reacting when they change. A commitment register, a monitoring configuration, a materiality threshold definition, and a re-assessment template.
4 artifacts · Blank templates and worked examples
Building enough AI literacy at board level for real oversight. A curriculum outline tied to the company's own AI risks, an annual board briefing template that is context, not operations, a director self-assessment, and criteria for choosing an external educator.
4 artifacts · Blank templates and worked examples
What board and executive leadership of AI governance looks like in practice. A board oversight charter, an executive sponsor role description distinct from product leadership, and a plan to integrate AI risk into enterprise risk management.
3 artifacts · Blank templates and worked examples
The compliance set for offering AI services in China: an applicability matrix across the CAC instruments, a security assessment checklist, a content labeling specification, and an algorithm filing tracker.
4 artifacts · Blank templates and worked examples
The materials to make AI training stick: a one-page acceptable use policy, a role segmentation matrix that scales training to exposure, a scenario library of right and wrong handling, and a tool request form so people have a legitimate path.
4 artifacts · Blank templates and worked examples
The working set for EU AI Act compliance: a risk-tier classification worksheet against Annex III, an Annex IV technical documentation template, a conformity self-assessment checklist, and an EU database registration checklist.
4 artifacts · Blank templates and worked examples
The strategic question for a non-EU company: apply EU AI Act standards everywhere, or only to EU-facing systems. A global-vs-tiered decision framework, a vendor EU AI Act questionnaire, and a high-risk compliance roadmap.
3 artifacts · Blank templates and worked examples
Which MCP servers agents may connect to, what each exposes, and what contains a compromised one. An inventory and allowlist, an intake review template, a credential scoping standard, and a re-review trigger log.
4 artifacts · Blank templates and worked examples
The controls that only apply when you download and self-host: license review, weight integrity verification, deployment configuration capture, and the pre-deployment testing no vendor did for you. An intake checklist, a config template, an integrity log, and an update policy.
4 artifacts · Blank templates and worked examples
The lightweight set for a company under 50 people: a simple AI inventory, a one-page acceptable use policy, a three-clause vendor check, a data flow summary, and a template for answering a customer's AI governance questionnaire.
5 artifacts · Blank templates and worked examples
The estate-wide view of external AI: every API and embedded model in use, the state of each contract against the clauses that matter, and whether the training-data opt-out is actually confirmed. Complements the per-vendor due diligence kit.
3 artifacts · Blank templates and worked examples
The regulatory picture for a US-based SaaS company: a landscape map of federal and key state law, a sector-specific rule checklist, and a matrix mapping product features to the rules they trigger.
3 artifacts · Blank templates and worked examples
Take the maturity assessment to prioritize controls, assign owners, and set target dates. Save your plan to return to it from any device.
Start your assessment →