Free resource · ISO/IEC 42001:2023
The ISO/IEC 42001 Template Pack
30 editable templates and 7 working registers for building an AI management system, from the AI policy and risk register to the Statement of Applicability, impact assessments and internal audit.
- Word templates and an Excel workbook
- Blank field lists plus filled examples
- Mapped to clauses and Annex A controls
- Use and adapt within your organization
- editable templates
- 30
- Excel registers
- 7
- Annex A controls in the SoA
- 38
- gap-assessment questions
- 141
What's inside
Every record an AI management system needs, organized the way you will build it. References show the ISO/IEC 42001 clauses and Annex A controls each template supports.
Context, scope and leadership
Clauses 4 and 5, Annex A.2 and A.3- T-01
AI Context and Issues Register
Internal and external issues, including the climate-change determination, with their effect on the AIMS.
Supports 4.1
- T-02
Interested Parties and Requirements Register
Who has a stake in your AI, what they require, and which requirements the AIMS will address.
Supports 4.2
- T-03
AIMS Scope Statement
Boundaries, AI systems, roles, exclusions and the certificate wording, ready for approval.
Supports 4.3
- T-04
AI System Inventory
Every AI system with owner, build or buy, risk class, impact-assessment tier and scope status.
Supports 4.3, 4.4, A.4
- T-05
AI Governance Council Terms of Reference
Membership, decision rights, cadence and escalation for the body that steers AI.
Supports 5.1, 5.3, A.3.2
- T-06
AI Policy
A complete, approvable policy with principles, commitments, prohibited uses and review triggers.
Supports 5.2, A.2.2 to A.2.4
- T-07
AI Roles and Responsibilities (RACI) Matrix
One accountable owner per AI activity, from risk acceptance to incident response.
Supports 5.3, A.3.2
Risk, impact and planning
Clauses 6 and 8, Annex A.5- T-08
AI Risk Assessment Methodology
Likelihood and severity scales, rating bands and who may accept which level of risk.
Supports 6.1.1, 6.1.2
- T-09
AI Risk Register
Risks written as cause, event and consequence, with inherent and residual ratings.
Supports 6.1.2, 8.2
- T-10
AI Risk Treatment Plan
Treatment options, controls, owners, dates and formal acceptance of residual risk.
Supports 6.1.3, 8.3
- T-11
Statement of Applicability
All 38 Annex A controls with justification, status and evidence for each.
Supports 6.1.3
- T-12
AI System Impact Assessment Report
Impacts on individuals, groups and society, fairness results and the approval decision.
Supports 6.1.4, 8.4, A.5
- T-13
AI Objectives and Measurement Plan
Measurable AI objectives with targets, owners, methods and review dates.
Supports 6.2, A.6.1.2, A.9.3
- T-14
AIMS Change Request Record
Planned changes to the AIMS and AI systems, with impact checks and approvals.
Supports 6.3, 8.1
Support
Clause 7- T-15
Competence Matrix and Training Plan
Competence needed for every AI role, evidence held and the plan to close gaps.
Supports 7.2, A.4.6
- T-16
Awareness and AI Literacy Plan
Audiences, formats, core messages and how awareness is measured beyond completion rates.
Supports 7.3
- T-17
AIMS Communication Plan
What is communicated, when, to whom, by whom and through which channel.
Supports 7.4, A.8.5
- T-18
Documented Information Register
Required and chosen documents with owners, locations, versions and retention.
Supports 7.5
AI system life cycle and data
Annex A.6, A.7 and A.8- T-19
AI System Requirements and Design Record
Intended purpose, requirements, design choices and the trade-offs behind them.
Supports A.6.1.3, A.6.2.2, A.6.2.3
- T-20
Verification, Validation and Release Checklist
Acceptance criteria, test evidence, fairness and robustness checks, and the release decision.
Supports A.6.2.4, A.6.2.5
- T-21
AI System Technical Documentation Pack (Model Card)
Technical documentation tailored to users, partners and supervisory authorities.
Supports A.6.2.7, A.8.2
- T-22
Data Provenance and Quality Record
Data origin, license, quality requirements, preparation steps and lineage.
Supports A.4.3, A.7.2 to A.7.6
- T-23
AI Transparency Notice for Users
Plain-language disclosure for people who interact with or are affected by an AI system.
Supports A.8.2, A.9.4
Incidents, suppliers and responsible use
Annex A.8, A.9 and A.10- T-24
AI Incident Report and Communication Record
Detection, containment, who was told and when, root cause and lessons learned.
Supports A.8.3, A.8.4, 10.2
- T-25
AI Supplier Assessment Questionnaire
Questions for foundation-model and AI vendors on change notice, evaluation, data use and logs.
Supports A.10.2, A.10.3
- T-30
Generative AI Acceptable Use Standard
Rules for staff use of generative AI tools and agents, ready to publish internally.
Supports A.9.2, A.9.4, A.2.3
Evaluation and improvement
Clauses 9 and 10- T-26
Internal Audit Programme and Audit Checklist
A risk-based audit programme plus a checklist of evidence to sample.
Supports 9.2
- T-27
Management Review Agenda and Minutes
An agenda covering every required input, with a worked set of minutes and decisions.
Supports 9.3
- T-28
Nonconformity and Corrective Action Record
Containment, root cause, extent check, corrective action and effectiveness review.
Supports 10.2
- T-29
Continual Improvement Register
Improvement opportunities from audits, incidents and reviews, tracked to closure.
Supports 10.1
Excel workbook
7 working registers, ready to fill
The registers you will update every week live in a spreadsheet, with example rows to replace and blank columns for your own scores, evidence and owners.
AI System Inventory
Every AI system with owner, role, risk class and scope status.
AI Risk Register
Ratings before and after treatment, owners and linked controls.
Statement of Applicability
All 38 Annex A controls, with columns for status and evidence.
Audit Checklist
Clause and control checks with evidence sought and results.
KPI Catalog
54 indicators tied to Clause 9.1, with blank columns for current values.
Gap Assessment
141 evidence-based questions with a 0 to 4 maturity score dropdown.
Crosswalk
38 controls mapped to the EU AI Act, NIST AI RMF and ISO/IEC 27001.
Why teams start here
Start from a worked example
Every template opens with a blank field list, then shows a completed record from the playbook's running case, so you see what a good entry looks like before you write your own.
Trace every record to the standard
Each template names the clauses and Annex A controls it supports. Owners know why a record exists, and an auditor can follow the thread from requirement to evidence.
Built for today's AI estate
Fields cover foundation-model suppliers, generative and agentic AI, impact assessments and EU AI Act touchpoints, not just classic machine learning.
Download the pack
Tell us who you are and both files are yours in seconds.
Template pack (Word)
All 30 templates with a heading each, so Word's navigation pane lists them, plus fill-in tables.
Registers workbook (Excel)
Inventory, risk register, Statement of Applicability, audit checklist, KPI catalog, gap assessment and crosswalk.
Instant download
Links appear on this page and stay valid for 7 days.
From the playbook
These are the templates from Appendix A of ISO 42001 Implementation Playbook for AI Leaders, Second Edition, by Ramon Marrero Almonte. The book walks through every clause and all 38 Annex A controls, with more than 140 worked examples.
Get the template pack
Free. Your download starts on this page as soon as you submit.