AI Business Core The system behind every document.

Base document to set up the AI committee at the organization's scale (no committee at the basic level, 3-5 members at standard, 5-7 at reinforced): mandate, quorum, sessions, minutes and escalation.

Policies and internal rulesR2 · Standard

Defines how AI policies and records are drafted, approved, versioned, published and retired, with owners and evidence. Keeps the documentation a client or auditor asks for traceable.

Procedures and protocolsR2 · Standard

Periodic report for management with indicators of use, risk, incidents, controls, risk appetite and value of AI initiatives, each with owner, frequency, source and threshold.

Assessments, matrices and reportsR2 · Standard

Base text, to adapt and publish on your website, explaining how your organization uses AI, its commitments and a contact channel. Helps you communicate your AI use to customers and users.

Policies and internal rulesR1 · Short

Questionnaire and scoring scale to measure maturity in AI strategy, data, governance, risk and talent, with a prioritized list of next steps.

Assessments, matrices and reportsR2 · Standard

Sets criteria for quality, provenance, minimization, access and retention of data used to train, fine-tune or feed AI systems.

Policies and internal rulesR2 · Standard

Defines when and how a person reviews, corrects or overrides AI outputs, with required skills, records and escalation.

Procedures and protocolsR2 · Standard

Structure to justify an AI initiative with a baseline, benefits, costs, risks and criteria to scale or retire it.

Assessments, matrices and reportsR2 · Standard

Template to define vision, goals, a phased roadmap, owners, budget and indicators for AI adoption over 12-18 months, starting with containment of unauthorized AI.

Plans and programsR2 · Standard

Governs how AI tools, including AI features inside software you already license, are requested, assessed, approved and retired, reducing shadow AI.

Policies and internal rulesR2 · Standard

Rules for using AI to recruit, screen and assess candidates: transparency, human oversight, bias testing and candidate rights.

Policies and internal rulesR2 · Standard

Policy that sets what people are told about the use of AI and the circuit for handling their explanation requests: channel, deadline, owner, response model and register of explanations delivered, with a pre-use notice that includes objection or opt-out and variants for the EU, Peru, Ecuador, Colombia, Brazil and the United States.

Policies and internal rulesR2 · Standard

Sets how AI vendors are selected, contracted, monitored and offboarded, with data, security, model-training and exit requirements.

Policies and internal rulesR2 · Standard

Defines controls to prevent and correct model bias, errors and harms across the lifecycle: testing, thresholds, monitoring and corrective action.

Policies and internal rulesR2 · Standard

Covers ownership of content created with generative AI, use of protected material in prompts and training, and review before publishing.

Policies and internal rulesR2 · Standard

Modular policy setting permitted and prohibited AI uses, rules for confidential and personal data, human review and responsibilities, with modules for API integration, hosted or open-weight models, training and agents, and a basic version for small organizations.

Policies and internal rulesR2 · Standard

Register of AI proposals, pilots and initiatives with their state, risk level, prioritization matrix score, owner and decision.

Registers, datasheets and recordsR2 · Standard

Short foundational document setting the principles for all AI use in the organization: benefit, fairness, transparency, safety, privacy, human oversight and accountability.

Policies and internal rulesR2 · Standard

Rules for using AI coding assistants (GitHub Copilot, Cursor and similar): secrets and data, licensing of generated code, human review and security.

Policies and internal rulesR2 · Standard

Defines what actions AI agents may take, with which permissions, autonomy limits, memory and logging, and when human approval is required.

Policies and internal rulesR2 · Standard

Record appointing the person responsible for AI or for an algorithm, with duties, independence, resources and reporting line.

Registers, datasheets and recordsR1 · Short

Defines who decides what about AI according to the organization's size: AI lead, light committee, RACI by decision, approval lanes and deadlines, and escalation thresholds by amount, data, scope and technology.

Policies and internal rulesR2 · Standard

Instrument to assess, before deployment, an AI system's effects on people and processes, with risks, controls, a go/no-go decision and a follow-up plan.

Assessments, matrices and reportsR3 · Extended

Reference matrix to classify each AI use case by risk level with traceable criteria and propose minimum controls for each level.

Assessments, matrices and reportsR3 · Extended

Plots business value against risk to decide which AI initiatives to pursue, condition or drop.

Assessments, matrices and reportsR2 · Standard

Process to identify, score (probability × impact), treat, accept and review AI risks, with the organization's single risk register, roles, deadlines and escalation.

Procedures and protocolsR2 · Standard

Annual plan for internal or external AI system audits: scope, criteria, sampling, evidence, findings and follow-up.

Plans and programsR2 · Standard

Checklist to help you review whether any of your AI uses could come close to prohibited practices: manipulation, social scoring, emotion recognition at work or school, improper biometrics, among others.

Assessments, matrices and reportsR1 · Short

Template to assess, before using a high-risk AI system, its impact on affected people's rights, with mitigation, oversight and complaint measures.

Assessments, matrices and reportsR3 · Extended

Report template with selection rates and impact ratios by sex, race or ethnicity and their intersection, a publishable summary and record retention, plus an optional credit and insurance annex (ECOA protected bases, approval rates and pricing differences). Where New York City requires an independent auditor, it is a reference for structuring the auditor's report; it does not replace the audit.

Assessments, matrices and reportsR3 · Extended

Policy to manage model risk, including AI models, in financial institutions: inventory with materiality tiers, independent validation, monitoring and accountable owners.

Policies and internal rulesR3 · Extended

Checklist that walks through EU AI Act Art. 26(1)-(12) for organizations using a vendor's high-risk system: what to do, what evidence to keep and which base document each paragraph is worked in, with the FRIA trigger (Art. 27) and the explanation to affected people (Art. 86).

Assessments, matrices and reportsR2 · Standard

Statement setting how much AI risk the organization accepts, who may accept it and under which conditions: common Low/Medium/High/Unacceptable scale, approval lanes, stances by category, limits, tolerance indicators and mapping to legal categories.

Policies and internal rulesR2 · Standard

Minimum security controls for AI workloads: identity and access, data and prompt protection, prompt injection, model supply chain and logging.

Policies and internal rulesR2 · Standard

Annex for contracts, terms or privacy notices informing people of their rights regarding AI: information, explanation, objection, human review and complaint.

Notices, letters and formsR2 · Standard

Contract addendum between a customer and an AI vendor on personal data processing: purposes, no training on customer data, sub-processors, security, transfers and audits.

Contracts and clausesR3 · Extended

Reference table to organize, by country, the AI and data laws your organization identifies, with each obligation, effective date, supporting document, owner and status.

Assessments, matrices and reportsR3 · Extended

Process to handle requests for human review, explanation and challenge of decisions made fully or partly by AI, with deadlines and records.

Procedures and protocolsR2 · Standard

Three-step test (purpose, necessity and balancing) to document legitimate interest as the legal basis for training or using AI with personal data.

Assessments, matrices and reportsR2 · Standard

Clause for engagement letters or professional-services contracts that informs clients and obtains their consent to use generative AI, while protecting confidentiality.

Contracts and clausesR1 · Short

Algorithmic management policy and written notice templates informing workers, candidates and their representatives about the AI and algorithms that decide on their work or application: parameters, rules, effects and how to request an alternative or accommodation.

Policies and internal rulesR2 · Standard

Authorization form to clone, synthesize or alter a person's voice or likeness with AI, with scope, duration, revocation and compensation.

Notices, letters and formsR1 · Short

Record appointing the data protection officer (DPO, data officer or Brazil's encarregado), with duties, independence, resources and notice to the authority.

Registers, datasheets and recordsR1 · Short

DPIA tailored to AI processing: description, necessity and proportionality, risks to individuals, safeguards and prior consultation, with country variants.

Assessments, matrices and reportsR3 · Extended

Documents personal data sent to AI vendors abroad: data-flow inventory, transfer mechanism, clauses, destination-country assessment and supplementary measures.

Assessments, matrices and reportsR3 · Extended

Full and short privacy notice and processing policy that disclose AI use, automated decisions, processors and transfers.

Notices, letters and formsR2 · Standard

Criteria for the use of digital devices and prior notices for video surveillance and geolocation, agreed with worker representatives.

Policies and internal rulesR2 · Standard

Online notice and direct parental notice, separate consent for third-party disclosure, written retention policy and security program.

Policies and internal rulesR2 · Standard

Written, public retention and destruction policy for biometric identifiers, with consent and notices, and an optional module with the FTC Rite Aid order measures as reference practices for facial recognition.

Policies and internal rulesR2 · Standard

Criteria and scoring to compare AI tools on functionality, security, privacy, cost, support and risk before buying.

GuidesR2 · Standard

Template to document AI APIs and connections: data flows, credentials, vendors, limits, dependencies and owners.

Registers, datasheets and recordsR1 · Short

Channel and process to receive, investigate and resolve complaints from people affected by AI, with deadlines, responses and remedies.

Procedures and protocolsR2 · Standard

Defines which explainability techniques to use by model type and audience, how to document them and how to turn them into plain-language explanations.

Procedures and protocolsR2 · Standard

Metrics, thresholds, frequency and owners to track performance, drift, bias, incidents and complaints of an AI system in production.

Plans and programsR2 · Standard

Classification, roles, containment, investigation, communication and lessons-learned steps for incidents caused by AI systems.

Procedures and protocolsR2 · Standard

Rules to design, run and evaluate AI pilots: hypothesis, scope, data, controls, success criteria and the decision to scale or stop.

Procedures and protocolsR2 · Standard

Defines when and how to disable, roll back or degrade an AI system to a safe state, with triggers, owners and communication.

Procedures and protocolsR2 · Standard

Architecture patterns to integrate AI securely and governably: layers, environments, logging, model management, data and controls.

GuidesR2 · Standard

Operational steps for vendor outages, model degradation, harmful outputs or data loss, with manual fallbacks and recovery times.

Procedures and protocolsR2 · Standard

Notice wording for chatbots, voice and forms, plus a short procedure to label AI-generated or manipulated content: deepfakes, images, audio and published text.

Notices, letters and formsR1 · Short

Letter template explaining to a person why an automated decision went against them, with the key reasons, the data used and how to request human review.

Notices, letters and formsR1 · Short

Steps, deadlines, recipients and notification templates for reporting security breaches to authorities and affected people in each country, including AI-related breaches.

Procedures and protocolsR3 · Extended

Rules for chatbots that may interact with minors or at-risk people: age assurance, recurring reminders, self-harm detection, referral to help and reporting.

Procedures and protocolsR2 · Standard

Defines when and how a customer served by a chatbot or automated phone system is transferred to a person: the right to request it, timing, logging and handoff quality.

Procedures and protocolsR2 · Standard

Protocol to validate clinical AI tools before and during use: performance, target population, bias, clinician oversight, records and surveillance.

Procedures and protocolsR3 · Extended

Guide to rolling out AI assistants and copilots: enterprise accounts, licences by segment, data and permission readiness, waves, metrics, idle licences and costs.

GuidesR2 · Standard

Procedure to discover unauthorized AI, open a regularization window, decide each case and publish a catalog of authorized tools by data type.

Procedures and protocolsR2 · Standard

Plan and messaging for an internal campaign promoting AI principles and usage rules: audiences, channels, calendar, assets and metrics.

GuidesR2 · Standard

Criteria for talking about AI use in public, marketing and press without overstating capabilities: messaging, approvals, disclosures and crisis handling.

GuidesR2 · Standard

AI training plan with one module per usage profile (purchased tools, APIs, hosted models, training and agents), role pathways, assessment and the single training record, plus a basic version for small organizations.

Plans and programsR2 · Standard

Structure to build a network of AI champions across teams: selection, duties, training, incentives and adoption metrics.

Plans and programsR2 · Standard

Process to back every advertising claim about AI capabilities with evidence before publication, with a substantiation file, legal sign-off and periodic review.

Procedures and protocolsR2 · Standard

90-day start-up plan for AI governance and adoption, with the minimum set of documents by usage profile and level, and the dependency map of the whole catalog: what comes first, what it depends on and what it feeds.

Plans and programsR2 · Standard

One-page form for anyone to propose a new AI use, with AI lead triage: usage profile, data, effects on people, preliminary level and lane. It feeds the portfolio and the inventory.

Registers, datasheets and recordsR1 · Short

Plan for the human side of AI adoption: impact by role, commitments on jobs, communication, training, champions, handling of concerns and adoption indicators.

Plans and programsR2 · Standard

Datasheet to document a dataset used in AI: origin, license, contents, personal data, quality, known biases and permitted uses.

Registers, datasheets and recordsR1 · Short

Sets which AI models, datasets and APIs must be inventoried, with minimum metadata, update owners and retirement steps.

Policies and internal rulesR2 · Standard

Standard and template to log significant decisions made fully or partly by AI: inputs, outcome, human involvement and explanation.

Registers, datasheets and recordsR2 · Standard

Register of AI vendors with contracts, data processed, certifications, assessments performed, findings and review dates.

Registers, datasheets and recordsR2 · Standard

Single register of AI tools, systems, agents and models: purpose, provenance (developer, country, licence, hosting), deployment profile, data, risk level and approval lane, owner, version and status.

Registers, datasheets and recordsR3 · Extended

Periodic report template with performance, drift, bias, incident and action metrics for a production model.

Assessments, matrices and reportsR1 · Short

Short format to summarize each impact assessment performed (AIA, DPIA or FRIA): system, date, risks, decision, conditions and next review.

Registers, datasheets and recordsR1 · Short

Standard sheet for an AI model: purpose, data, metrics, limitations, evaluated biases, out-of-scope uses and owners.

Registers, datasheets and recordsR1 · Short

Additional fields for the record of processing activities when AI is involved: purpose, logic, vendors, transfers, automated decisions and retention.

Registers, datasheets and recordsR2 · Standard

Per-model record for third-party and open-weight models: provenance and supply chain, licence and acceptable use, restrictions by origin and residency matrix, weights integrity, alignment, censorship and bias evaluation, hidden-behavior testing and the use decision.

Registers, datasheets and recordsR2 · Standard

Scored questionnaire to assess AI vendors at Basic, Standard or Reinforced depth by risk, including model provenance and a self-assessment for open-weight models with no vendor.

Assessments, matrices and reportsR2 · Standard

Checklist of robustness and adversarial tests for AI models and apps: prompt injection, data leakage, jailbreaks, poisoning and evasion.

Assessments, matrices and reportsR1 · Short

Questionnaire to measure staff knowledge, current use, attitudes and training needs, and the organization's readiness (sponsorship, policy, inventory, data, security, budget), with guidance to analyze the results.

Assessments, matrices and reportsR1 · Short

SLA and operational agreement template for AI vendors: availability, latency, output quality, support, incidents, model changes and service credits.

Contracts and clausesR2 · Standard

Reference structure to prepare the AI Act Annex IV technical file, quality management system, EU declaration of conformity and registration.

Registers, datasheets and recordsR3 · Extended

Reference structure for the technical documentation, downstream-provider information, copyright policy and public training-data summary under AI Act arts. 53-55.

Registers, datasheets and recordsR3 · Extended