ISO/IEC 42001:2023 on iso.org, published 18 December 2023, contains no templates: it states requirements and leaves the format of each record to you. Its definition of documented information (3.10) says records can be in any format and media, so a controlled spreadsheet works. What an auditor checks is whether each record has the fields the clause needs and whether the records link to each other.
This hub covers the 14 templates an AI management system (AIMS) normally runs on. For each one you get the clause that requires it, the minimum fields, one filled example row and a common mistake that turns into a finding. Every example row describes the same fictional company: a 200-person US SaaS business with four AI systems in scope, one of which, AIS-03, is a customer support chatbot built on a vendor’s large language model.
How the ISO 42001 Templates Chain Together
The templates form one chain, and an auditor tests the links between them as much as the templates themselves. Each step below names the clause that drives it.
How the ISO/IEC 42001 templates chain together: AIMS scope (4.3), AI system register, AI system impact assessment (6.1.4, 8.4), AI risk register (6.1.2, 8.2), risk treatment plan (6.1.3, 8.3), Statement of Applicability, monitoring records (9.1), internal audit (9.2), corrective action log (10.2) and management review (9.3), which feeds back into scope and policy
- AIMS scope (4.3) sets which AI systems count.
- AI system register (4.1, 4.3) lists every system in scope, with its purpose, your AI role and an owner.
- AI system impact assessment (6.1.4, 8.4) records what each system could do to people, and feeds harms into the risk register.
- AI risk register (6.1.2, 8.2) scores risks to the organization’s objectives using a written method.
- Risk treatment plan (6.1.3, 8.3) names the controls and owners for each risk.
- Statement of Applicability (6.1.3) records every control decision, applied or excluded, with justification and evidence location.
- Monitoring and measurement records (9.1) show the controls and AI objectives working.
- Internal audit program and report (9.2) test the chain from register to monitoring.
- Nonconformity and corrective action log (10.2) takes every finding to a fixed cause.
- Management review minutes (9.3) decide what changes, which loops back to the policy, objectives and scope.
The AI policy (5.2), roles (5.3), objectives (6.2), competence records (7.2) and supplier assessments sit beside the chain and are referenced from it. One shared ID per AI system, used in every template, is what makes the chain auditable. For the order in which to build them, follow the order to implement ISO 42001 clauses.
Which ISO 42001 Templates Are Required, and Which Are Good Practice
ISO/IEC 42001 names records, not templates. The IAPP’s June 2024 summary of the standard described it as “light on detail” and said it “does not impose prescriptive requirements”. The table shows which records are required, where that status comes from (the official preview, the harmonized structure text or published clause summaries), and which are good practice.
| Template | Clause | Status | Deep guide on our site |
| AI policy | 5.2 | Required: harmonized structure text, available as documented information | Yes |
| AIMS scope statement | 4.3 | Required: official preview, available as documented information | No |
| AI roles and responsibilities | 5.3 | Assignment required; the written matrix is good practice | No |
| AI system register | 4.1, 4.3 | Good practice; no clause names it, but it evidences both | Yes |
| AI risk assessment method and risk register | 6.1.1, 6.1.2, 8.2 | Required: published clause summaries | Yes |
| AI risk treatment plan | 6.1.3, 8.3 | Required: published clause summaries | Covered with the SoA |
| AI system impact assessment | 6.1.4, 8.4 | Process documented per definition 3.24 in the official preview; results required per published clause summaries | Yes |
| Statement of Applicability | 6.1.3 | Required: published clause summaries; definition 3.26 in the official preview sets its content | Yes |
| AI objectives | 6.2 | Required: harmonized structure text | No |
| Competence records | 7.2 | Required: harmonized structure text, evidence of competence | No |
| Internal audit program and report | 9.2.2 | Required: harmonized structure text | Yes |
| Management review minutes | 9.3.3 | Required: harmonized structure text | No |
| Nonconformity and corrective action log | 10.2 | Required: harmonized structure text | No |
| Supplier and third-party AI assessment | Annex A third-party controls, where your SoA applies them | Expected for every applied control | No |
Source: ISO/IEC 42001:2023 official preview (clauses 4.1 to 4.4, definitions 3.10, 3.24, 3.26 and the harmonized structure statement); harmonized structure core text in Annex SL of the ISO/IEC Directives; published clause summaries for 6.1.2 to 6.1.4 (including the Statement of Applicability) and 8.2 to 8.4. Status column and deep-guide mapping: AI Training Skool.
Procedures that sit behind these records, such as how to run an impact assessment, work like any standard operating procedure: a documented, step-by-step way of doing a recurring task. Write the procedure once, then let the template hold the results.
Leadership, Scope and People Templates
AI Policy Template (Clause 5.2)
The AI policy sets top management’s direction for AI and the framework for AI objectives. It must be appropriate to the organization, commit to meeting applicable requirements and to continual improvement, and be communicated and available as documented information.
| Version and approver | Scope and AI covered | Principles that drive objectives | Applicable requirements commitment | Approval before use rule | Review date |
| Example: v2.1, CEO, 3 Aug 2026 | All AI developed, provided or used in the AIMS scope; see register | Human review of every customer-facing AI answer that changes an account | Identify legal and contract duties per system in the register | No AI tool used until registered and approved by its owner | 3 Aug 2027 |
Example row for a fictional company. Not ISO wording.
Common mistake: principles nobody can measure, such as “all our AI is fair”. The section-by-section method is in drafting the top-level AI policy.
AIMS Scope Statement Template (Clause 4.3)
The scope statement sets the boundaries and applicability of the AIMS, built from the issues in 4.1 and interested party requirements in 4.2. It must be available as documented information.
| Organizational units and sites | AI systems in scope | AI role per system | Exclusions and reasons | Issues and requirements considered | Approved by and date |
| Example: product and support teams, US offices and cloud regions | AIS-01 to AIS-04 | AIS-03: AI customer (vendor model) and provider (chatbot offered to clients) | Internal HR pilot excluded until it leaves pilot | Context record v3; interested parties register v2 | COO, 10 Jul 2026 |
Example row for a fictional company.
Common mistake: a scope that names business units but not the AI systems, so nobody can tell which systems the certificate covers.
AI Roles and Responsibilities Template (Clause 5.3)
Clause 5.3 requires top management to assign and communicate responsibilities and authorities, including who ensures the AIMS conforms to the standard and who reports on its performance.
| Role | Named person | Responsibilities | Authority | Reports to | Date assigned |
| Example: AIMS owner | Head of Risk | Maintains register, risk and impact processes; reports AIMS performance | Can stop a deployment that skipped approval | COO | 1 Jun 2026 |
Example row for a fictional company.
Common mistake: listing committees instead of people, so no single person owns a decision.
AI Objectives Template (Clause 6.2)
AI objectives must be consistent with the AI policy, measurable where practicable, monitored, communicated, updated and available as documented information, with a plan for what, who, when and how results are evaluated.
| Objective | Policy link | Measure and target | Owner | Resources | Due date | How evaluated |
| Example: every in-scope AI system has a current impact assessment | Principle 3 | 4 of 4 systems, reviewed after each significant change | AIMS owner | Two days a month of analyst time | 31 Dec 2026 | Monthly count reported at management review |
Example row for a fictional company.
Common mistake: objectives with no measure, which leaves clause 9.1 nothing to monitor.
Competence Record Template (Clause 7.2)
Competence records show that each person in an AIMS role is competent on the basis of education, training or experience, and that actions to close gaps were evaluated.
| Person and role | Competence required | Evidence held | Gap and action | Effectiveness check | Next review |
| Example: support lead, AIS-03 owner | Run and approve an impact assessment | Training certificate, Mar 2026; two assessments co-signed | Never led a reassessment; shadowing in Q3 | Led IA-03 v2 alone, Sep 2026 | Sep 2027 |
Example row for a fictional company.
Common mistake: keeping training attendance only, with no link between the course and the role’s required competence.
AI System, Risk and Control Templates
AI System Register Template (Clauses 4.1 and 4.3)
The register lists every AI system you develop, provide or use, and gives each a single ID that every other template reuses. Full field guidance, with discovery sources for shadow and vendor AI, is in an AI use case register built for auditors.
| System ID | Name and version | Intended purpose and limits | Your AI role | Owner | In scope | Risk and impact refs | Next review |
| Example: AIS-03 | Support chatbot, vendor model v4 | Answers product questions; cannot change billing | Customer of the vendor model; provider to clients | Support lead | Yes | R-05, R-06; IA-03 | 1 Feb 2027 |
Example row for a fictional company.
Common mistake: a register built once from a survey, which misses vendor AI features switched on later.
AI Risk Assessment Method and Risk Register Template (Clauses 6.1.1, 6.1.2 and 8.2)
The method sets risk criteria and scales so that repeated assessments give consistent, valid and comparable results; the register holds the results. Scales, criteria and a ten-row worked register are in an AI risk assessment method for ISO 42001.
| Risk ID | System | Risk (cause, event, consequence) | Likelihood x consequence | Owner | Treatment option | Residual score and acceptance | Review trigger |
| Example: R-05 | AIS-03 | Prompt injection makes the chatbot reveal internal data | 3 x 5 = 15 | Security lead | Modify | 2 x 4 = 8, accepted by CISO | New tool or plugin connected |
Example row for a fictional company, using an example 1 to 5 scale.
Common mistake: scores with no written criteria, so two assessors give the same risk different numbers.
AI Risk Treatment Plan Template (Clauses 6.1.3 and 8.3)
The treatment plan turns each risk decision into controls, owners and dates, and records management approval and acceptance of residual risk.
| Risk ID | Controls chosen | SoA reference | Action owner | Due date | Status | Approved by |
| Example: R-05 | Input filtering; tool access limits; release test for injection | Two applied rows in the SoA | Security lead | 30 Sep 2026 | Implemented, tested 22 Sep 2026 | AIMS owner, 15 Aug 2026 |
Example row for a fictional company.
Common mistake: a plan that lists controls but no dates or owners, so nothing shows the treatment was carried out under 8.3.
Statement of Applicability Template (Clause 6.1.3)
The SoA is the documentation of all necessary controls and the justification for including or excluding each one (definition 3.26). It has one row per Annex A control plus any controls you add. Column design and justification patterns are in building the Statement of Applicability.
| Control | Decision | Justification | Linked risks and impact assessments | Implementation status | Evidence location | Owner |
| Example: A.6.2.4 AI system verification and validation | Applied | Every release of AIS-03 must pass defined tests, including injection tests | R-05, R-06; IA-03 | Implemented | Release test reports in the CI system | Engineering manager |
Example row for a fictional company.
Common mistake: “not applicable” exclusions with no reason, or an excluded control that a live risk still points at.
Impact Assessment and Supplier Templates
AI System Impact Assessment Template (Clauses 6.1.4 and 8.4)
The impact assessment is a formal, documented process for identifying, evaluating and addressing impacts on individuals, groups of individuals and societies (definition 3.24). ISO/IEC 42005:2025, published in May 2025, gives guidance on carrying out and documenting these assessments. The full question set is in the ISO 42001 AI system impact assessment, step by step.
| Assessment ID and version | System | Affected people | Impact found | Severity and likelihood | Measure and owner | Risk register link | Approved by and date | Next review trigger |
| Example: IA-03 v2 | AIS-03 | Client end users | Chatbot states a refund policy that does not exist | 3 and 4 | Answers grounded in approved content; support lead | R-06 | Support director, 9 Sep 2026 | Vendor model upgrade |
Example row for a fictional company.
Common mistake: an assessment approved before the current model version went live, so it no longer covers the system in use.
Supplier and Third-Party AI Assessment Template (Annex A Third-Party Controls)
Supplier assessments show how you evaluate AI systems, models and data that third parties provide. The IAPP summary lists third-party and customer relationships among the standard’s control areas, and you need this evidence for every such control your SoA marks applied.
| Supplier and product | System IDs affected | What the supplier provides | Contract terms checked | Change notice terms | Assessment result | Reviewed by and date | Next review |
| Example: LLM vendor, API tier | AIS-03 | Base model and hosting | No training on our prompts; US data residency | 30 days’ notice of model changes | Approved with conditions | Procurement and security, 12 Jun 2026 | Contract renewal, Jun 2027 |
Example row for a fictional company.
Common mistake: reusing a security questionnaire that never asks how the vendor changes, retrains or retires the model.
Evaluation and Improvement Templates
Internal Audit Program and Report Templates (Clause 9.2)
The program sets frequency, methods, responsibilities, planning requirements and reporting; each report records objectives, criteria, scope, sample and findings. How to run the audit itself is in ISO 42001 internal audit, step by step.
| Audit ID | Clauses and systems | Criteria | Auditor and independence check | Sample taken | Findings by grade | Reported to and date |
| Example: IA-2026-02 | 6.1.4, 8.2, 8.4; AIS-03 | Impact and risk procedures v2; SoA | Finance analyst; did not build the process | AIS-03 records, Jun to Sep 2026 | 1 nonconformity, 1 observation | AIMS owner and support director, 30 Sep 2026 |
Example row for a fictional company.
Common mistake: a program that is only a calendar, with no criteria or record of who was independent of what.
Management Review Minutes Template (Clause 9.3)
Minutes show that top management reviewed the AIMS at planned intervals, considered each required input and made decisions on improvement and changes.
| Date and attendees | Inputs covered | Audit and nonconformity trends | Objective status | Decisions | Changes to the AIMS | Actions, owners, dates |
| Example: 6 Oct 2026, CEO, COO, AIMS owner | All 9.3.2 inputs, listed | 1 open nonconformity on reassessment after change | 3 of 4 systems with current impact assessment | Link the change process to reassessment | Change procedure v3 | AIMS owner, 15 Nov 2026 |
Example row for a fictional company.
Common mistake: minutes that list topics but no decisions, so nothing shows the clause 9.3.3 results.
Nonconformity and Corrective Action Log Template (Clause 10.2)
The log records the nature of each nonconformity, the actions taken, the cause found and the result of the corrective action, as clause 10.2 requires evidence of all three.
| NC ID | Source | Nonconformity and requirement | Correction | Root cause | Corrective action and owner | Similar cases checked | Effectiveness check and date |
| Example: NC-07 | Internal audit IA-2026-02 | AIS-03 vendor upgrade had no impact reassessment (8.4) | IA-03 v3 completed | Change tickets did not trigger the AIMS procedure | Reassessment field added to change workflow; AIMS owner | AIS-01, AIS-02, AIS-04 checked | Planned: next two changes reviewed, due Dec 2026 |
Example row for a fictional company.
Common mistake: closing the item when the correction is done, before anyone checks that the cause is gone.
Why Templates Alone Do Not Pass a Certification Audit
A template is an empty structure; an auditor tests the filled records and whether they agree with each other and with what the people named in them say. A pack of perfect templates with no operating history fails, because Stage 2 samples what happened over time.
Three checks before you rely on your template set. Every record carries the AI system ID from the register. Every row has a date, an owner and an approver. And every link in the chain resolves: a harm in an impact assessment appears in the risk register, its control appears as applied in the SoA, and the SoA points at evidence that exists. The records an auditor pulls at each stage are listed in the Stage 1 and Stage 2 evidence an AIMS auditor samples.
If you want to practice filling these records on a realistic case first, AI Training Skool teaches it in an ISO 42001 Lead Implementer course with templates you can adapt. It ships implementation templates and checklists, plus a case study workbook that works an AI register, impact assessment, risk register and SoA end to end.
Frequently Asked Questions
Does ISO 42001 Provide Official Templates?
No. ISO/IEC 42001:2023 states requirements and defines records such as the Statement of Applicability (definition 3.26), but it includes no templates and leaves format to the organization. Definition 3.10 says documented information can be in any format and media. Any template you use, including a spreadsheet, is your own design.
What Is an ISO 42001 Statement of Applicability Template?
A Statement of Applicability template is a table with one row per Annex A control of ISO/IEC 42001:2023, plus any controls you add. Minimum columns are control reference, decision (applied or excluded), justification, linked risks and impact assessments, implementation status, evidence location and owner, with version and approval details for document control.
What Should an AI Risk Register Template Include for ISO 42001?
An AI risk register for ISO/IEC 42001 needs a risk ID, the AI system ID and the risk written as cause, event and consequence. Add likelihood and consequence scores against written criteria, an owner, the treatment option, the residual score with who accepted it, and the reassessment trigger. The scores mean nothing without the written method under clause 6.1.2.
Can I Use an Excel Spreadsheet for ISO 42001 Documentation?
Yes. ISO/IEC 42001:2023 definition 3.10 says documented information can be in any format and media. A spreadsheet is fine if it is controlled: each record shows version, owner, approver and date, changes are tracked, and old versions are kept. Auditors check the control and the content, not the software.
What Is the Difference Between an AI Policy Template and an AI Acceptable Use Policy?
An ISO/IEC 42001 AI policy (clause 5.2) is top management’s direction for all AI in the AIMS scope and the framework for AI objectives. An acceptable use policy tells staff which AI tools they may use and how. Many organizations keep the acceptable use rules as a separate document referenced from the AI policy.
Is an ISO 27001 Template Set Enough for ISO 42001?
Partly. ISO/IEC 42001 and ISO/IEC 27001 share the harmonized structure, so templates for document control, internal audit, management review and corrective action carry over. You still need AI-specific templates: the AI system register, AI policy, AI risk criteria, AI system impact assessment and an ISO/IEC 42001 Statement of Applicability.
