Free AI Governance& Policy Templates

Track owners, data sources, risk tier, controls, and audit evidence.

• Single source of truth for AI usage
• Risk tiering (Low/Med/High/Critical)
• Data flow + subprocessor tracking
• Controls + evidence fields for audits
• Review cadence + last review date

Covers metrics, test design, documentation, and remediation - built for security, risk, and compliance teams.

• Fairness testing checklist
• Suggested metrics and reporting structure
• Audit-ready documentation guidance
• Remediation and regression monitoring

• Training-on-your-data restriction
• Retention/deletion SLAs
• Audit rights and evidence
• Incident notification window
• AI change management terms
• Liability/indemnity prompts

• Consistent model documentation
• Bias/fairness + security testing fields
• Monitoring + audit trail fields
• Change management + rollback plan

• 40+ pre-go-live checklist items
• Least-privilege permission scoping
• Prompt injection + guardrail controls
• Kill switch + incident response checks
• Sign-off table for accountable owners

• 4-level severity classification
• Containment + evidence preservation steps
• Internal, customer + regulator comms templates
• NDB / GDPR notification timing guidance
• Three worked AI incident scenarios

Includes a decision tree, a system register, and the obligations that apply to each tier.

• Four-tier classification decision tree
• System register for your AI portfolio
• Per-tier obligations + compliance actions
• Annex III high-risk use case reference
• Audit-ready classification rationale

Rate maturity, capture evidence, identify gaps, and build a remediation roadmap.

• Covers ISO 42001 Clauses 4-10
• Four-point maturity rating scale
• Evidence + gap action columns
• Remediation roadmap with owners + dates
• Audit-ready readiness assessment

Covers approved tools, data classification rules, prohibited activities, security requirements, IP considerations, and enforcement procedures.

• Data classification matrix (Public/Internal/Confidential/Restricted)
• Approved vs prohibited tools framework
• New tool approval request process
• Employee acknowledgment form
• Regulatory compliance mapping section
• Customizable for any industry

Score your compliance, identify gaps, and prioritize remediation with built-in risk scoring.

• 53 assessment items across 7 security domains
• Built-in scoring with risk level guide
• Data security & privacy evaluation
• Shadow AI discovery assessment
• Vendor risk management section
• Compliance & regulatory mapping

Covers detection through recovery with severity levels, communication plans, and post-incident review procedures.

• 4-level severity classification system
• 5-phase response process (Detect → Contain → Investigate → Recover → Review)
• Internal & external communication matrices
• Evidence preservation checklist
• Post-incident review framework
• Contact list template

Includes recommendation matrix and risk identification.

• 35 evaluation criteria across 5 security domains
• Weighted scoring system (customizable)
• Approval/rejection recommendation matrix
• AI-specific security evaluation section
• Risk identification and remediation tracking
• Suitable for procurement and vendor management teams

Includes 4-level classification system, decision flowchart, common scenarios, and file upload rules, the essential reference for every employee.

• 4-level data classification with AI-specific rules
• Visual decision flowchart for quick reference
• Prompt content rules table
• File upload classification guide
• 5 real-world scenarios with decisions
• Exception process template

• 7 required committee member roles defined
• 5 key responsibility areas with checklists
• Decision-making and escalation processes
• Monthly and quarterly reporting templates
• Success metrics and KPIs
• Meeting cadence and quorum requirements

Includes role-specific sections for managers, developers, customer-facing, and HR roles.

• Training completion tracking
• Key principles acknowledgment checklist
• Role-specific sections (Managers, Devs, Customer-facing, HR)
• Signature and manager confirmation
• Annual renewal tracking table
• Covers data protection, approved tools, security, compliance

Includes improvement roadmap template.

• 30 capabilities across 5 governance pillars
• 5-level maturity model (Initial → Optimized)
• Gap analysis and evidence tracking
• Improvement roadmap template (Quick wins → Long-term)
• Benchmarking against maturity levels
• Suitable for board-level reporting

Covers business justification, data assessment, security questions, integration requirements, and multi-level approval workflow.

• Structured business justification section
• Data classification impact assessment
• Security questionnaire for vendor evaluation
• Multi-level approval workflow (Manager → Security → Committee)
• Post-approval deployment checklist
• Priority levels with SLA timelines

Covers tool inventory, security incidents, compliance status, training metrics, risk dashboard, and executive recommendations.

• Executive summary with key metrics
• Shadow AI activity tracking table
• Security incident log and metrics
• Regulatory compliance status dashboard
• Training and awareness metrics
• Risk dashboard with trend indicators

Includes scoring guidance, risk rating framework, and documentation checklist, the essential tool for procurement and security teams assessing AI vendor risk.

• 68 questions across 8 security domains
• Built-in 0-5 scoring with risk rating framework
• AI model security section (prompt injection, bias, red-teaming)
• Subprocessor and third-party risk management
• Data retention and deletion assessment
• Reviewer recommendation matrix with remediation tracking

Covers stakeholder analysis, communication strategy, training rollout, resistance management, and success measurement.

• Stakeholder analysis and impact assessment
• Phased rollout timeline with milestones
• Communication plan with templates
• Training and enablement schedule
• Resistance management strategies
• Adoption metrics and success criteria

Covers data processing terms, sub-processors, cross-border transfers, breach notification, and GDPR/CCPA compliance clauses.

• GDPR and CCPA-aligned clauses
• AI-specific data processing terms
• Sub-processor management framework
• Cross-border transfer mechanisms (SCCs)
• Data breach notification procedures
• Audit rights and compliance verification

Includes quick-start guides, do's and don'ts, and a first-week checklist.

• Tool-by-tool setup and access instructions
• Security do's and don'ts quick reference
• Day 1-30 AI onboarding checklist
• Common use case scenarios with examples
• Policy acknowledgment integration
• Manager verification checkpoints

Defines mission, membership criteria, review processes, ethical principles, escalation procedures, and reporting requirements.

• Mission and scope definition
• Board membership and selection criteria
• Ethical review submission process
• Decision-making framework with principles
• Escalation and appeal procedures
• Annual ethics report template

Designed for quarterly board presentations.

• One-page executive summary format
• AI risk heatmap visualization guide
• Compliance and regulatory scorecard
• Budget and investment recommendations
• Strategic roadmap with quarterly milestones
• Board-ready presentation structure

Covers bias testing, performance benchmarks, security validation, explainability checks, and ongoing monitoring requirements.

• Model performance benchmarking criteria
• Bias and fairness testing checklist
• Security and adversarial robustness checks
• Explainability and interpretability assessment
• Data quality validation steps
• Production deployment readiness gate

Covers safe prompting practices, data leakage prevention, prompt injection awareness, output validation, and approved prompt patterns for common business tasks.

• 15+ approved prompt templates by use case
• Data leakage prevention rules
• Prompt injection awareness section
• Output validation and review checklist
• Department-specific prompt guides
• Banned patterns and common mistakes

Includes requirement mapping, gap analysis, and remediation tracking.

• EU AI Act requirement mapping with post-omnibus deadlines
• NIST AI RMF alignment tracker
• ISO 42001 controls checklist
• US state AI law tracking (TX, CO, IL, CA, UT, NYC)
• Gap analysis with remediation priorities
• Evidence documentation framework

Covers access controls, data protection, model security, API security, logging, and incident response readiness.

• 60+ audit items across 6 security domains
• Evidence requirement for each item
• Access control and authentication checks
• Data protection and encryption validation
• API security and rate limiting assessment
• Logging, monitoring, and alerting review

Covers shadow AI discovery, data flow mapping, contractual requirements, and ongoing monitoring procedures.

• Third-party AI feature discovery checklist
• Data flow mapping for AI integrations
• Contractual AI clause requirements
• Risk scoring and prioritization matrix
• Continuous monitoring procedures
• Remediation and opt-out tracking

Includes a screening questionnaire, rated risk register, and approval sign-off.

• Screening: when an assessment is required
• EU AI Act Article 27 FRIA coverage
• Rated risk register with worked examples
• Human oversight and mitigation tracking
• Consultation record and approval sign-off

Rate maturity, capture evidence, and build a prioritized remediation roadmap.

• Covers all 4 functions and 19 categories
• Four-point maturity rating scale
• Evidence, gaps, actions, and owner columns
• Generative AI Profile (NIST AI 600-1) overlay
• One-page scoring summary
• Prioritized remediation roadmap

• 30 pre-loaded AI risks in 8 categories
• 5x5 likelihood and impact scoring
• Automatic inherent + residual scores
• Dropdowns for category and status
• Color-coded risk thresholds
• XLSX primary, DOCX also included

• Ready-to-send amnesty introduction message
• 30 questions across 8 sections, types marked
• Multi-select lists of common AI tools
• Data-classification and account-type questions
• Red-flag patterns and exposure score guide
• Worked example with filled summary table

Screen whether a DPIA is required, document training and inference data flows, and assess risks to data subjects with pre-seeded AI risks, mitigations, and sign-off records.

• Article 35(3) and EDPB nine-criteria screening
• AI triggers: training, automated decisions, monitoring, RAG
• Training vs inference data flow mapping
• Ten pre-seeded risks to data subjects
• Mitigation and residual risk tracking
• DPO consultation and sign-off records

• 57 checklist items with why-it-matters and evidence columns
• Permission sprawl and sharing-link cleanup workflow
• Purview DLP, sensitivity label, and audit logging steps
• Go/no-go gate tables before pilot and broad rollout
• Pilot metrics worksheet with baselines and targets
• Exception register and post-deployment review

Built for teams shipping LLM features and teams assessing vendor AI products.

• All ten OWASP LLM risks (2025 edition) in plain English
• 66 review items tagged Build, Buy, or Both
• Evidence-to-collect list for every risk
• Scoping register for built, bought, and embedded AI
• Summary scorecard with severity, status, and owner
• Beyond-the-top-10 notes on agentic risks and monitoring

Includes consent and disclosure rules, prohibited meeting types, data retention, and ready-to-use disclosure scripts.

• Approved vs prohibited tools register
• All-party consent rules by jurisdiction
• Prohibited meeting types (legal, HR, M&A, board)
• Copy-paste disclosure scripts
• Uninvited bot response steps
• Retention, sharing, and deletion rules

Includes worked justification examples and a version-control and approval block.

• All 38 Annex A controls (A.2 to A.10)
• Justification guidance with worked examples
• Implementation status and evidence columns
• Coverage summary across nine control areas
• Version-control and approval block
• Common audit findings to avoid

Full speaker notes and a knowledge check included.

• 28 slides with full speaker notes
• Traffic-light data classification rules
• Safe prompting do's and don'ts
• AI phishing and deepfake awareness
• Four-question knowledge check
• PPTX deck plus DOCX handout