Ready-to-deploy AI governance templates, AI policy templates, risk assessment templates, and vendor evaluation templates. Built for CISOs, IT directors, and GRC leads who need a defensible AI governance programme without starting from scratch.
Get all 39 templates in one ZIP. Policies, registers, checklists and rollout plans.
Start here
Stand up the core of an AI governance programme first: an AI policy template, a governance structure, a risk assessment, and an inventory of what AI is actually running. Then add the vendor-risk layer that procurement and security teams need. Browse the full library of 39 templates below.
Define approved tools, data handling rules, employee responsibilities, and enforcement paths for enterprise AI use. The starting point for every AI governance programme.
Establish the committee that owns AI approvals, exceptions, audit evidence, and policy updates. Defines roles, decision-making authority, and reporting cadence.
Score AI tools, agents, and workflows across 7 domains: data privacy, model risk, security, compliance, operational, ethical, and vendor risk.
Build the inventory layer for AI tools, embedded AI features, custom models, automations, and agent workflows. The source of truth for any governance programme.
100-point weighted scorecard for evaluating AI vendors across data security, access control, compliance, AI-specific security, and operational security.
68 questions across 8 security domains with built-in scoring and risk rating. The essential tool for procurement and security teams assessing AI vendor risk.
Assess risks from third-party AI integrations and embedded AI features in SaaS tools. Covers data flow mapping, contractual gaps, and monitoring procedures.
Pre-drafted contract clauses covering training restrictions, data retention, audit rights, incident notification, and liability for AI vendor agreements.
Editions
Adapted versions of our most-used policies, rewritten for specific jurisdictions and professions rather than lightly find-and-replaced.
Privacy Act and APP alignment, OAIC guidance references, and notifiable data breach duties, written for Australian organizations.
View templateClient confidentiality, legal professional privilege, court disclosure duties, and matter-related AI use rules for legal practices.
View templateA practical template for cataloging AI tools, embedded AI features, custom models, automations, and AI agents. Track owners, data sources, risk tier, controls, and audit evidence.
A practical guide to testing AI systems for bias and fairness. Covers metrics, test design, documentation, and remediation - built for security, risk, and compliance teams.
Pre-drafted contract clauses for AI vendor agreements covering data usage, training restrictions, audit rights, incident notification, change management, and liability.
A structured template for documenting AI models: intended use, training data, evaluation, limitations, controls, monitoring, and change management.
A pre-deployment checklist for AI agents that take autonomous actions across your systems. 40+ items across security assessment, permissions scoping, guardrails, monitoring, and incident response.
A complete playbook for detecting, classifying, containing, and recovering from AI security incidents - data leakage, prompt injection, AI agent compromise, and model manipulation.
Classify every AI system you use or build against the EU AI Act's four risk tiers. Includes a decision tree, a system register, and the obligations that apply to each tier.
Assess your readiness for ISO 42001 AI Management System certification across all clauses (4-10). Rate maturity, capture evidence, identify gaps, and build a remediation roadmap.
A comprehensive template for establishing AI usage guidelines across your organization. Covers approved tools, data classification rules, prohibited activities, security requirements, IP considerations, and enforcement procedures.
A structured checklist for evaluating your organization's AI risk posture across 7 critical domains. Score your compliance, identify gaps, and prioritize remediation with built-in risk scoring.
A complete incident response plan template specifically designed for Shadow AI security incidents. Covers detection through recovery with severity levels, communication plans, and post-incident review procedures.
A weighted scoring framework for evaluating AI vendors across 5 security domains: data security, access control, compliance, AI-specific security, and operational security. Includes recommendation matrix and risk identification.
A practical guide defining what data can and cannot be used with AI tools. Includes 4-level classification system, decision flowchart, common scenarios, and file upload rules, the essential reference for every employee.
A complete charter template for establishing an AI governance committee with defined roles, responsibilities, decision-making processes, meeting cadence, and success metrics.
A structured acknowledgment form confirming employees have completed AI training and understand key policies. Includes role-specific sections for managers, developers, customer-facing, and HR roles.
Evaluate your organization's AI governance maturity across 5 pillars: Policy & Strategy, Risk Management, Security & Technology, Compliance & Legal, and People & Culture. Includes improvement roadmap template.
A structured request form for employees to submit new AI tool adoption requests. Covers business justification, data assessment, security questions, integration requirements, and multi-level approval workflow.
A comprehensive monthly reporting template for AI governance teams. Covers tool inventory, security incidents, compliance status, training metrics, risk dashboard, and executive recommendations.
A comprehensive security questionnaire with 68 questions across 8 domains for evaluating AI vendors. Includes scoring guidance, risk rating framework, and documentation checklist, the essential tool for procurement and security teams assessing AI vendor risk.
A structured change management plan for rolling out AI tools and policies across your organization. Covers stakeholder analysis, communication strategy, training rollout, resistance management, and success measurement.
A ready-to-use data processing agreement template tailored for AI and machine learning vendors. Covers data processing terms, sub-processors, cross-border transfers, breach notification, and GDPR/CCPA compliance clauses.
A step-by-step onboarding guide for new employees on approved AI tools, security practices, and company AI policies. Includes quick-start guides, do's and don'ts, and a first-week checklist.
Establish an AI Ethics Review Board with this comprehensive charter template. Defines mission, membership criteria, review processes, ethical principles, escalation procedures, and reporting requirements.
A concise executive briefing template for presenting AI governance status, risks, and recommendations to C-suite leadership and board members. Designed for quarterly board presentations.
A thorough validation checklist for AI and ML models before production deployment. Covers bias testing, performance benchmarks, security validation, explainability checks, and ongoing monitoring requirements.
Security-focused prompt engineering guidelines for enterprise teams. Covers safe prompting practices, data leakage prevention, prompt injection awareness, output validation, and approved prompt patterns for common business tasks.
Track compliance across major AI regulations including the EU AI Act, NIST AI RMF, ISO 42001, and US state AI laws such as Texas TRAIGA and Colorado SB 26-189. Includes requirement mapping, gap analysis, and remediation tracking.
A comprehensive security audit checklist for assessing AI systems and tools across your organization. Covers access controls, data protection, model security, API security, logging, and incident response readiness.
Assess and manage risks from third-party AI integrations and embedded AI features in SaaS tools. Covers shadow AI discovery, data flow mapping, contractual requirements, and ongoing monitoring procedures.
Assess the impact of an AI system on the people it affects, covering EU AI Act Article 27 FRIAs, algorithmic impact assessments, and voluntary reviews. Includes a screening questionnaire, rated risk register, and approval sign-off.
Assess your AI risk management against all 19 categories of NIST AI RMF 1.0 (GOVERN, MAP, MEASURE, MANAGE). Rate maturity, capture evidence, and build a prioritized remediation roadmap.
A working Excel register for AI risk: 30 pre-loaded risks across data leakage, shadow AI, vendors, model behavior, and agentic AI, with 5x5 scoring and automatic color-coded ratings.
Survey your workforce about real AI usage with a no-blame amnesty framing. 30 ready-to-use questions plus an analysis guide and a simple shadow AI exposure score.
A GDPR Article 35 DPIA built for AI systems. Screen whether a DPIA is required, document training and inference data flows, and assess risks to data subjects with pre-seeded AI risks, mitigations, and sign-off records.
A seven-phase readiness checklist for deploying Microsoft 365 Copilot safely. 57 evidence-backed items covering licensing prerequisites, oversharing cleanup, Purview controls, pilot design, and go/no-go gates before rollout.
A practical security review checklist covering all ten OWASP Top 10 risks for LLM applications, from prompt injection to unbounded consumption. Built for teams shipping LLM features and teams assessing vendor AI products.
Set the rules for AI notetakers, meeting bots, and built-in meeting AI like Zoom AI Companion and Teams Copilot. Includes consent and disclosure rules, prohibited meeting types, data retention, and ready-to-use disclosure scripts.
Document all 38 ISO 42001 Annex A controls: applicability, justification, implementation status, evidence, and owner. Includes worked justification examples and a version-control and approval block.
A 28-slide PowerPoint training that teaches employees to use AI safely: shadow AI, data rules, safe prompting, AI phishing, and deepfakes. Full speaker notes and a knowledge check included.
Policies, registers, checklists and rollout plans, ready to customise.
Work email only. From Aona AI, the SOC 2 Type II certified Workforce AI Security platform.
Templates give you the paperwork. Aona gives you the enforcement. Discover every AI tool your team is already using, block policy violations before they become incidents, and produce continuous audit evidence across your workforce. A Word document won't catch the prompt that just left your browser.