AI Compliance Kit · free sample
How to Use This Kit
| Field | Value |
|---|---|
| Document | 00 – How to use this kit |
| Version | 1.1 |
| Date | 2026-09-22 |
| Status | template, adapt before use |
| Company | [Company name] |
| Owner | [Owner] |
This template is operational guidance, not legal advice. Have your counsel review before relying on it.
What changed in version 1.1 (22 September 2026)
- New document 14, ISO/IEC 42001 Mapping: all 38 Annex A controls and the management-system clauses mapped to kit documents with honest coverage (covered, partial, not covered), plus a spreadsheet that doubles as a draft Statement of Applicability.
- New document 15, NIS2 Mapping: the ten Article 21(2) measures, Articles 20 and 23, mapped to the kit for entities in scope of NIS2, AI angle only.
- All documents re-dated; no changes to the legal content of documents 01 to 13.
How to use this document
Read this first. It lists what is in the kit, the order to use it in, a five-step quick start and the evidence each document produces. Keep it as the index page of your AI compliance file.
Who the kit is for
Companies with roughly 20 to 500 staff that use AI tools (chatbots, copilots, generative AI, HR screening tools, software with embedded AI features) and occasionally build or customise them. The person running it is usually a compliance lead, an operations or IT manager, or a founder who must show evidence to a regulator, a customer or an auditor.
The primary legal reference is the EU AI Act (Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744). Secondary references are Poland's national AI act, South Korea's AI Basic Act and US state laws. Document 12 maps them to the kit.
Context: the Vision Compliance 2026 report found that 78% of organisations had not taken meaningful AI Act compliance steps, and more than 60% of European SMEs had not started. The kit is designed to close that gap in 90 days.
What is in the kit
| No. | Document | Type | Formats |
|---|---|---|---|
| 00 | How to use this kit | Guide | DOCX, MD |
| 01 | AI Governance Policy | Policy | DOCX, MD |
| 02 | AI Acceptable Use Policy | Staff-facing policy with acknowledgment form | DOCX, MD |
| 03 | AI System Inventory | Specification and register | DOCX, MD, XLSX |
| 04 | Risk Classification Procedure | Procedure with classification record | DOCX, MD |
| 05 | Transparency Checklist and Disclosure Texts | Checklist and ready-to-use texts | DOCX, MD, XLSX |
| 06 | AI Literacy Programme | Programme, training register and quiz | DOCX, MD, XLSX |
| 07 | Vendor Due Diligence Questionnaire | Questionnaire with scoring | DOCX, MD, XLSX |
| 08 | AI Incident Response Procedure | Procedure with log template | DOCX, MD |
| 09 | AI Impact Assessment Template | Template | DOCX, MD |
| 10 | Inspection Readiness Protocol | Procedure with Poland worked example | DOCX, MD |
| 11 | Contract Clauses | Model clauses for counsel review | DOCX, MD |
| 12 | Jurisdiction Mapping | Reference table | DOCX, MD, XLSX |
| 13 | 90-Day Roadmap | Week-by-week plan | DOCX, MD |
The order to use it in
- Read this guide and Document 13 to plan the work.
- Adopt Document 01 to assign roles and an approval process.
- Build the inventory (Document 03). Nothing else works without it.
- Classify every inventory entry (Document 04).
- Publish Document 02 and collect staff acknowledgments.
- Run the literacy programme (Document 06) and fill the training register.
- Apply Document 05 to every system that talks to people or generates content.
- Send the vendor questionnaire (Document 07) and update contracts (Document 11).
- Put the incident procedure (Document 08) in place.
- Complete impact assessments (Document 09) for higher-risk uses.
- Prepare the inspection file (Document 10) and check coverage against Document 12.
Quick start in five steps
- Day 1. Appoint an AI owner and an executive sponsor. Sign Document 01.
- Week 1. Run the one-day inventory exercise in Document 03. Enter every AI tool in
AI-System-Inventory.xlsx. - Week 2. Classify each entry with Document 04. Flag every system that interacts with people or generates content: Article 50 transparency obligations have applied since 2 August 2026.
- Weeks 3 to 6. Publish Document 02, collect acknowledgments, deliver the all-staff literacy module from Document 06 and record it in
Training-Register.xlsx. The Article 4 AI literacy obligation has applied since 2 February 2025. - Weeks 7 to 13. Complete vendor questionnaires, contract updates, the incident procedure, impact assessments and the inspection file. Follow Document 13 week by week.
Evidence each document produces
| Document | Evidence an inspector, customer or auditor can be shown |
|---|---|
| 01 | Signed governance policy, role assignments, approval records |
| 02 | Published usage rules, signed acknowledgments, approved tools list |
| 03 | AI system register with suppliers, purposes, roles and risk class |
| 04 | Classification record per system, with reasoning and reviewer |
| 05 | Completed transparency checklist, screenshots of disclosures, label samples |
| 06 | Programme description, training register (who, when, what), quiz results |
| 07 | Completed vendor questionnaires with scores and evidence received |
| 08 | Incident log, notification decisions, post-incident reviews |
| 09 | Impact assessments with sign-off |
| 10 | Document index, named inspection contact, meeting logs |
| 11 | Contracts with role allocation, audit rights and incident notice terms |
| 12 | Coverage map showing which obligation is met by which document |
| 13 | Dated plan with milestones and owners |
Key dates
Already in force: Article 4 AI literacy (2 Feb 2025); Article 50 transparency (2 Aug 2026); Poland's national act (11 Aug 2026); Korea's AI Basic Act (22 Jan 2026, high-impact duties from 21 Jul 2026). Coming: KRiBSI inspections and fines in Poland (28 Oct 2026); EU machine-readable marking and the prohibition on generating non-consensual intimate imagery and child sexual abuse material (2 Dec 2026); Colorado and California ADMT duties (1 Jan 2027); EU Annex III high-risk (2 Dec 2027); EU Annex I embedded AI (2 Aug 2028). Document 12 has the full table.
Update policy
- Review the whole kit every quarter. The AI owner runs the review; the executive sponsor signs it off.
- Between reviews, watch for practical examples on AI literacy from the Commission and Member States, codes of practice on labelling synthetic content encouraged by the AI Office, KRiBSI guidance in Poland, Korean implementing rules and US state changes.
- Record every change in the version table of the affected document. Keep superseded versions for [retention period].
- This version reflects the legal facts as of 21 September 2026.
Disclaimer
The kit is operational guidance for practitioners. It is not legal advice and does not create a lawyer-client relationship. Laws change and their application depends on facts. Have your counsel review every document before you rely on it, in particular Document 11 (contract clauses) and any communication with a regulator.