Free policy
€0
Start today with the template every organisation needs first. See what's in it.
- AI Acceptable Use Policy (template 01)
- One-page staff summary
- Staff acknowledgement form
AI governance in 90 days, not nine months.
The AI Governance Starter Kit: twelve editable templates that take you from "people are using ChatGPT and nobody owns it" to a working governance programme. Policy, inventory, risk method, impact assessments, vendor checks and incident response, aligned with ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
Templates12
FormatEditable Word
DeliveryInstant download
Refund14 days
Your organisation already runs on AI. Who governs it?
Most organisations skipped the paperwork and went straight to the tools. That gap is now a risk you can name.
- Your people are already using it
Staff paste contracts, customer data and code into chat assistants every day, often on personal accounts. Without a policy, nobody knows what is allowed or who is accountable.
- The law has started
The EU AI Act's prohibitions and AI-literacy duty apply now, transparency rules since August 2026, and high-risk obligations from December 2027. ISO/IEC 42001 has made AI governance something auditors ask about.
- Customers ask before they buy
Enterprise buyers and procurement teams now send AI questionnaires. "We're working on it" loses deals. A documented programme wins them.
What's inside.
Every document your first year of AI governance needs, in the order you'll use them.
- 01AI Acceptable Use Policy
Approved tools in three tiers, the data that never goes into a prompt, disclosure and personal accounts.
- 02AI Governance Policy
Principles, roles, the risk-based approach and how exceptions are handled.
- 03Committee Charter and RACI
Who decides what, how often the committee meets, and decision rights by risk tier.
- 04AI System Inventory and Register
The fields to capture for every AI system, with worked example rows.
- 05Risk Classification and Assessment
EU AI Act screening, a seven-factor tiering score and a likelihood × impact matrix.
- 06AI Impact Assessment
Full and short forms, including fundamental-rights questions and affected groups.
- 07Vendor Due-Diligence Questionnaire
Scored questions for buying AI, with GenAI-specific checks and contract clauses.
- 08Data and Privacy Standard for AI
Training data, prompts, personal data, retention and when a DPIA is triggered.
- 09Lifecycle and Human Oversight Procedure
Intake to retirement, with approval gates and monitoring by tier.
- 10AI Incident Response Playbook
Severity levels, roles, timelines, communications and serious-incident reporting.
- 11AI Literacy and Training Plan
A role-based curriculum, from all staff to developers and the board.
- 1290-Day Roadmap and Framework Crosswalk
A week-by-week plan, and a map of ISO/IEC 42001 ↔ NIST AI RMF ↔ EU AI Act to each template.
Every template includes how-to-use notes, a document-control block, example rows, adjustable thresholds, a sign-off table, and a framework-alignment table you can hand to an auditor.
How the 90 days go.
Three stages of thirty days. The roadmap in template 12 breaks them down week by week.
Set the rules
Days 1–30Publish the acceptable use policy, appoint an owner, stand up the committee and start the inventory.
Know your risk
Days 31–60Tier every system, run impact assessments on the ones that matter, and put vendors and data under control.
Make it run
Days 61–90Oversight and monitoring live, incident playbook tested, training delivered, and your first report to leadership.
Choose your kit.
One payment, instant download, yours to edit. Checkout handles tax for your country.
12 Templates
€49
The full set of documents, ready to adapt.
- All 12 editable Word templates
- Framework-alignment table in each
- 90-day roadmap and crosswalk
Complete
€149
The templates plus the guide that shows you how to use them.
- Everything in 12 Templates
- The AI Governance Playbook, a 60-page guide
- 30-question readiness checklist and maturity model
- Walkthrough video (free update)
14-day full refund · licensed for internal use by the purchasing organisation · not legal advice
Written by a practitioner.
Nader Alkhatib is the founder of Khatib Designs and advises organisations on AI governance and digital transformation. He has more than 13 years in engineering and technology leadership, and has written AI governance frameworks for large organisations.
The kit is what he wished existed the first time: documents a risk or IT lead can adopt in an afternoon, not a 200-page framework nobody reads.
Rather have it done with you?
The AI readiness and governance sprint puts the kit in place for your organisation in three weeks: governance model, ranked roadmap, and one AI use case deployed safely.
Read before you adopt.
The templates assume a few decisions are already made. These articles walk through them: readiness, privacy, training and the reasons programmes stall.
AIIs your business ready for AI? A GCC checklistThe data, process and team signals that decide whether an AI project pays off.
AIAI readiness assessment: a 2-week planWhat to check in two weeks, the blockers that kill projects, and how to decide go or no-go.
AIAI data privacy for business: a GCC field guideWhat the law expects, where your prompts go, and seven questions to ask first. The groundwork for template 08.
AIAI training for employees: a 4-week playbookWhat to teach by role, a four-week plan, and what to measure after.
AIWhy AI projects fail, and what worksThe four patterns that stall pilots, and the fixes that get one into production.
AIAI adoption in the GCC: a practical guideThe real drivers, the common pitfalls, and a step-by-step path.
Questions.
Anything else, email nader@khatibdesigns.com.
Which frameworks are the templates aligned with?
ISO/IEC 42001:2023, the NIST AI Risk Management Framework (with its Generative AI Profile) and the EU AI Act as amended in 2026, with GDPR touchpoints. Every template ends with a table mapping each section to the relevant clause, function or article. Aligned with does not mean certified: certification is an audit of how you run the system, not of your documents.
What format are the files?
Editable Microsoft Word documents (.docx) that also open in Google Docs, Pages and LibreOffice. The playbook is a PDF.
We are not in the EU. Is this still useful?
Yes. ISO/IEC 42001 and the NIST AI RMF are international and voluntary, and the templates are written for any organisation. The EU AI Act sections tell you when it applies to you, for example if you sell AI-enabled products or services into the EU.
Can I use the kit for my clients?
The licence covers internal use by the purchasing organisation. Consultants who want to adapt the kit for clients should get in touch for a practitioner licence.
Is this legal advice?
No. The templates are a practical starting point. Have qualified counsel review them against the laws that apply to you before adoption.
What if it is not right for us?
Email within 14 days of purchase and you get a full refund, no questions asked.
Start with the free policy.
Or talk it through with Nader in 30 minutes. You leave knowing what your first 90 days should cover.