AI governance documentation suite
Seven AI governance documents drafted against the EU AI Act, the NIST AI RMF 1.0 and ISO/IEC 42001:2023, reviewed by our legal team, first draft in 20 working days.
$3,000 to $5,000, fixed before we start. First draft in 20 working days.
Updated
PD-AIG; specimen page
AI governance suite
Contents
- 1AI governance policy
- 2AI risk management procedure
- 3AI use and acceptable use policy
- 4Model and system inventory template
- 5Human oversight procedure
- 6Incident and complaint procedure
- 7Technical documentation template
1Purpose
1.1An AI governance documentation suite is the set of policies, procedures and record templates that sets out how an organisation approves, risk-assesses, oversees and monitors the AI systems it builds or uses, and keeps the evidence of each step in the form the EU AI Act, the NIST AI RMF and ISO/IEC 42001 describe.
What it is
An AI governance documentation suite is the set of policies, procedures and record templates that sets out how an organisation approves, risk-assesses, oversees and monitors the AI systems it builds or uses, and keeps the evidence of each step in the form the EU AI Act, the NIST AI RMF and ISO/IEC 42001 describe.
Who it is for
A company deploying AI in hiring, credit, customer service or operations, asked by a customer, an investor or a regulator to show how those systems are governed; a vendor whose EU buyers send an AI Act questionnaire with the security questionnaire; a firm starting an ISO/IEC 42001 programme that needs the documents before the certification body arrives. The suite is drafted for the people who will run it: the owner of the system inventory, the person who signs off a new use, the one who answers a complaint.
What you get
7 deliverables, in Word (.docx) and PDF, with one round of revisions.
- AI governance policy
- AI risk management procedure
- AI use and acceptable use policy
- Model and system inventory template
- Human oversight procedure
- Incident and complaint procedure
- Technical documentation template (EU AI Act Annex IV)
How the documents map to the three frameworks
The three frameworks ask for much the same things in different words. The table shows, for each document, the EU AI Act article, the NIST AI RMF 1.0 function and the ISO/IEC 42001:2023 clause or Annex A control it is drafted against.
Scroll sideways for the other columns
| Document | EU AI Act (Regulation (EU) 2024/1689) | NIST AI RMF 1.0 | ISO/IEC 42001:2023 |
|---|---|---|---|
| AI governance policy | Article 4 AI literacy; Article 26 deployer obligations | Govern | Clause 5.2 AI policy; Clause 5.3 roles; Annex A.2 |
| AI risk management procedure | Article 9 risk management system | Map, Measure, Manage | Clauses 6.1.2 and 6.1.3 risk assessment and treatment; Clause 8.4 impact assessment; Annex A.5 assessing impacts of AI systems |
| AI use and acceptable use policy | Article 5 prohibited practices; Article 13 instructions for use and Article 26(1) use in line with them; Article 50 transparency obligations | Govern, Map | Annex A.2 policies for AI; Annex A.9 use of AI systems |
| Model and system inventory template | Article 10 data governance; Article 12 record-keeping | Map | Clause 7.5 documented information; Annex A.7 data |
| Human oversight procedure | Article 14 human oversight; Article 26(2) | Manage | Annex A.3 internal organisation; Annex A.9 |
| Incident and complaint procedure | Article 26(5) monitoring; Article 73 serious incidents | Measure, Manage | Clause 10.2 nonconformity and corrective action; Annex A.8 |
| Technical documentation template | Article 11 and Annex IV | Map, Measure | Clause 7.5; Annex A.6 AI system life cycle |
The suite does not decide whether a system is high-risk under Annex III; it records the classification you make and the reasons for it.
What it costs
$3,000to $5,000
The AI governance suite is $3,000 to $5,000. The quote is fixed before we start and does not change. Maintenance is a separate plan, $29 to $99 a month, that keeps the AI governance suite current when a rule it names changes.
How the document is made, from intake to delivery, is set out in how it works.
- Band
- Bespoke manual
- First draft
- 20 working days
- Revisions
- One round included
- Review
- Our legal team, before delivery
- Format
- Word (.docx) and PDF
- Maintenance
- $29 to $99 a month
What we need from you
The intake asks which AI systems you build, buy or deploy and what each one decides or produces, who is affected by its output, whether you are a provider or a deployer, what data trains or feeds it, who can override an output, what has gone wrong so far, and which of your existing policies the suite must sit beside. Once we reply, send your current AI policy, system list and any customer questionnaire you have received.
How it is drafted and reviewed
We draft from the intake against Regulation (EU) 2024/1689, the NIST AI Risk Management Framework 1.0 and ISO/IEC 42001:2023, so you keep one set of documents rather than three. The policy sets the rules, the procedures carry them out, and the templates capture the records each framework expects. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. You then read it, mark what you want changed, and we revise once. The suite arrives in Word and PDF with a document ID and revision code, and the final version is filed with us for the maintenance plan.
Drafted against
- EU AI Act, Regulation (EU) 2024/1689: Articles 4, 5, 9 to 14, 26, 50 and 73; Annex IV
- NIST AI 100-1, AI Risk Management Framework (AI RMF 1.0), January 2023: Govern, Map, Measure, Manage
- ISO/IEC 42001:2023 AI management system: clauses 5.2, 5.3, 6.1.2, 6.1.3, 7.5, 8.4 and 10.2; Annex A.2, A.3 and A.5 to A.9
What maintenance covers
When the rule changes, your document changes. Under the maintenance plan we track the Act, the NIST framework and the standard your suite was drafted against, issue a revised suite with the changes marked, and keep the document ID and revision history current. Without the plan, the suite is still yours to use and to edit; it simply stops being tracked.
$29to $99a month, optional
Questions about the AI governance suite
- Are we a provider or a deployer under the EU AI Act?
- A company that develops an AI system, or has one developed, and puts it on the market or into service under its own name is a provider under Article 3(3) of the EU AI Act, Regulation (EU) 2024/1689. A company that uses an AI system under its own authority in its business is a deployer under Article 3(4). A deployer becomes a provider under Article 25(1) if it puts its own name on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk. The intake records the role you give for each system, the suite is drafted against the obligations of that role, and we do not advise on your legal position.
- Do we need all three frameworks for the AI governance suite?
- No, one AI governance suite serves whichever of the three frameworks you are asked about, because each document is mapped to all three: the EU AI Act, Regulation (EU) 2024/1689, through the articles for the role you record in the intake; the NIST AI RMF 1.0, a voluntary framework, through its Govern, Map, Measure and Manage functions; and ISO/IEC 42001:2023 through its clauses and Annex A controls, which matter if you plan certification.
- Does the AI governance suite cover ISO/IEC 42001 certification?
- The AI governance suite supplies documented information for the ISO/IEC 42001:2023 clauses it is mapped to: the AI policy (clause 5.2), roles (5.3), risk assessment and treatment (6.1.2 and 6.1.3), documented information (7.5), AI system impact assessment (8.4) and nonconformity and corrective action (10.2), with the matching Annex A controls. Certification is a separate audit by an accredited certification body that looks at how you run the management system, not only at the documents. The suite is structured the way auditors expect to read it.
- How long does the AI governance suite take to draft?
- The first draft of the AI governance suite arrives 20 working days after a complete intake. Your review and the one included revision round add whatever time you need.
Guides that go deeper
What documents does the EU AI Act require from a deployer of AI?
What the EU AI Act, Regulation (EU) 2024/1689, asks a deployer to document: Article 26 duties, Article 27 impact assessment, Article 4 literacy and Article 50 notices.
Updated
NIST AI RMF vs ISO 42001: which one should a small company document against?
Document against the framework your customers name: NIST AI RMF 1.0 for alignment, ISO/IEC 42001:2023 for certification. If nobody asks, start with the shared documents.
Updated
Which policies does a SaaS startup need before its first enterprise deal?
The eight policies a SaaS startup's first security questionnaire asks for, mapped to ISO 27001, SOC 2, the CAIQ and VSAQ, with a ninth where the product uses AI.
Updated