Free, expert-built templates and checklists to help CISOs and security leaders build board-ready AI governance programmes in hours, not months.
Each template is built by AI governance practitioners and mapped to major compliance frameworks including HIPAA, SOC 2, GDPR, and the EU AI Act.
A comprehensive 47-point checklist across 9 security domains to help CISOs build a board-ready AI governance policy. Covers acceptable use, data classification, shadow AI, vendor assessment, compliance mapping, incident response, and more.
78% - of enterprises use AI without formal governance policies in place
A ready-to-customise 52-provision AI acceptable use policy template covering 8 policy domains. Built for CISOs and compliance teams who need a professional, board-ready policy document that employees actually understand and follow. Maps to HIPAA, SOC 2, GDPR, EU AI Act, ISO 42001, and NIST AI RMF.
95% - of organisations lack a formal AI acceptable use policy despite active employee AI adoption
A structured 62-question vendor assessment questionnaire across 8 security domains that CISOs and procurement teams use to evaluate AI vendors before onboarding. Covers data privacy, security architecture, model transparency, compliance certifications, incident response, contractual protections, business continuity, and audit rights.
73% - of organisations experienced a security incident originating from a third-party vendor in 2025
An 18-page operational playbook with 56 action items across 8 discovery phases for finding, assessing, and remediating unsanctioned AI usage across your organisation. Covers network-level detection, browser extension monitoring, SaaS auditing, department surveys, risk scoring, migration pathways, and ongoing safe harbour programmes.
60% - of employees use unsanctioned AI tools at work, with most organisations unaware of the full scope of shadow AI across their workforce
A structured 48-item risk register across 8 risk domains with a 5x5 scoring matrix to help CISOs identify, assess, treat, and track AI-specific risks. Covers data privacy, model reliability, bias, security, compliance, operational, and reputational risk categories with board-ready reporting dashboards.
$4.88M - average cost of a data breach in 2024 - organisations without AI-specific security controls pay $1.76M more per incident (IBM)
A comprehensive 58-control checklist across 9 compliance domains to help organisations achieve full conformity with the EU AI Act (Regulation (EU) 2024/1689). Covers AI system classification, prohibited practice screening, high-risk requirements, transparency obligations, data governance, human oversight, GPAI model compliance, risk management, and documentation requirements - mapped to specific Articles and Annexes of the regulation.
35M EUR - maximum fine under the EU AI Act for deploying prohibited AI practices - or 7% of global annual turnover, whichever is higher
A comprehensive 45-control checklist across 10 compliance domains to help organisations comply with Australia's Privacy Act automated decision-making transparency obligations under APP 1.7, 1.8, and 1.9. Covers system inventory, materiality assessment, privacy policy updates, DLP deployment, sensitive data controls, audit logging, alerting, kill switch implementation, and documentation - mapped to specific APP provisions and the Explanatory Memorandum.
$50M - maximum penalty under the Australian Privacy Act for serious privacy interference - or 30% of adjusted annual turnover, whichever is greater
A 54-control implementation checklist for the NIST AI Risk Management Framework (AI RMF 1.0) across 9 structured sections covering all four core functions - Govern, Map, Measure, and Manage. Maps each control to specific NIST AI RMF subcategories with actionable enterprise implementation guidance for federal contractors, regulated industries, and organisations building mature AI risk management programmes.
4 Functions - Govern, Map, Measure, and Manage - the complete NIST AI RMF core covered in 54 actionable controls
A comprehensive data classification framework with 50 controls across 8 domains for governing data flows through AI systems. Defines 5 classification tiers (Public, Internal, Confidential, Restricted, Prohibited), DLP rule templates, workspace isolation patterns, and lifecycle management procedures to prevent data leakage, ensure regulatory compliance, and maintain auditability across every stage of the AI data pipeline.
$4.88M - average cost of a data breach in 2024 - organisations without AI-specific data classification controls face significantly higher exposure from uncontrolled data flows through AI systems (IBM)
A 20-page AI incident response plan template with 56 controls across 9 response phases - from detection through post-incident review. Covers severity classification for prompt injection, data leakage, model poisoning, hallucination harm, and bias incidents. Includes regulatory notification timelines for GDPR (72h), EU AI Act Art. 73 (72h), and HIPAA (60 days), plus a complete RACI matrix and communication protocols for AI-specific security incidents.
72 hours - Maximum notification window under both EU AI Act Article 73 and GDPR Article 33 for serious AI incidents and personal data breaches
A structured board reporting template with 48 items across 8 sections for presenting AI risk posture to directors and executives. Includes executive dashboard structure, risk scoring visualisation, compliance status tracking, incident reporting cadence, ROI metrics, peer benchmarking, and quarterly workflow guidance aligned to NIST AI RMF, EU AI Act, ISO/IEC 42001, and SOX requirements.
82% - of enterprise boards now expect quarterly AI risk reports, yet only 34% of CISOs currently deliver structured AI-specific board reporting (Gartner 2025 Board of Directors Survey)
A 56-control gap analysis checklist for ISO/IEC 42001:2023 AI Management Systems covering all normative clauses (4-10) plus Annex A controls. Designed for organisations preparing for AIMS certification, this checklist provides clause-by-clause conformity assessment, certification readiness scoring, remediation priority planning, and Stage 1/Stage 2 audit preparation guidance - mapped to specific sub-clauses and Annex A control objectives throughout.
312% - year-over-year increase in ISO 42001 certification enquiries reported by major certification bodies, as enterprises seek independently audited assurance of AI governance maturity
These templates are the foundation. See how Areebi automates policy enforcement, real-time DLP, and compliance reporting across your entire organisation.