For DPOs, compliance, legal, IT and security leaders
The AI Governance Toolkit
Build a working AI governance programme with a register, risk classification method, conformity assessments and an audit-ready evidence trail — using tools already in your organisation.
- AI system register and fillable record template
- Risk classification and conformity assessment workflow
- Remediation tracker and supplier due-diligence template
- AI Bill of Materials and post-deployment monitoring
- A practical 90-day roadmap with 11 fillable checklists
An AI policy is not an AI governance programme
Most organisations already have an AI policy. Very few can show an auditor what it actually governs. Employees adopted generative and predictive AI faster than procurement or security teams could track, wiring tools into hiring, customer service, content moderation and code review before governance teams knew they existed.
A policy records intent, not inventory. Auditors need the owner, purpose, data, risk classification, assessment, approval conditions and evidence for each system. This toolkit gives you the practical records and workflow to answer those questions before EU AI Act obligations phase in through 2026 and 2027.
Inside the Toolkit
Ten building blocks for operational AI governance
Start with the register, then classify, assess, remediate and monitor. The included fillable templates give each system an owner, a decision trail and evidence that can withstand internal audit, customer due diligence and regulatory scrutiny.
Build your AI system register
Create one inventory covering ownership, purpose, data, decisions, suppliers and deployment status.
Classify risk consistently
Apply a documented method that separates prohibited, high, limited and minimal-risk systems.
Run conformity assessments
Test each system for lawful, fair and safe deployment, then record the decision and conditions.
Map regulatory overlays
Identify what the EU AI Act, GDPR and other applicable frameworks require for each use case.
Turn findings into guardrails
Assign actions, owners, deadlines, closure evidence and re-verification dates.
Govern AI suppliers
Use the due-diligence record to assess third-party models, tools and contractual controls.
Keep an evidence trail
Maintain versioned assessments, approvals, testing records and operational evidence.
Monitor after deployment
Set review triggers for drift, incidents, supplier changes and new regulatory duties.
Maintain an AI Bill of Materials
Record the models, data, components and dependencies behind each AI system.
Close the accountability loop
Establish governance meetings, reporting, escalation and a repeatable review rhythm.
Who this is for
Written for teams asked to establish AI governance using the people and tools already in the organisation.
- Data Protection Officers and compliance officers building the governance programme
- Legal teams interpreting AI, privacy and sector-specific obligations
- IT and security leads discovering and controlling shadow AI
- Business owners accountable for systems making consequential decisions
Frequently asked questions
About this toolkit
Which organisations is this toolkit for?
It is designed for organisations using or procuring AI that need a practical governance structure across privacy, legal, security, procurement and business teams.
Does it only cover the EU AI Act?
No. The toolkit provides a broader operational framework that can support AI, privacy and sector-specific obligations across multiple jurisdictions.
What practical resources are included?
It includes an AI register, classification approach, assessment workflow, supplier controls, roles, approvals and evidence requirements.
Can it help identify shadow AI?
Yes. The discovery and register process helps teams identify unapproved tools and bring them into a documented risk and governance workflow.
How is the toolkit delivered?
Complete the form with a business email address and the PDF download link will be provided immediately and sent by email.
Co-produced by Formiti and Privacy360
Advisory expertise, operationalised in a platform.
Formiti brings the advisory side: Legal Consultants who interpret the rules, Privacy Architects who convert them into a working governance programme, and Technical Operations engineers who implement the controls. Privacy360 is the platform that operationalises the same building blocks into an audit-ready system of record, connecting AI governance to DPIA, ROPA, DSAR and vendor management.
Next step
AI governance, implemented for you
Once you've reviewed the Toolkit, talk to us about building your AI register, classification method, assessment workflow, supplier controls and evidence trail as a practical managed programme.