Where can I buy ISO 42001 policy templates?

There are five routes to ISO/IEC 42001 and AI governance policy templates: free NIST material, free samples from template sellers, paid editable template sets, compliance software platforms and consultants. The NIST material (the AI RMF and its Playbook) is free but is not written to ISO/IEC 42001. ComplianceDocs sells the ISO 42001 AI Management System Toolkit for $99 one-time: 14 editable policies and procedures plus a Statement of Applicability, a Risk Register and an Audit Evidence Checklist in Excel.

Are there free ISO 42001 or AI governance policy templates?

Yes, with limits. NIST publishes the AI Risk Management Framework free of charge, and its Playbook (a PDF, CSV, Excel or JSON download) lists what AI risk-management policies should be designed to do, under GOVERN 1.2. Both are voluntary, and neither is organized around ISO/IEC 42001’s clauses or Annex A. Some template sellers offer a few free downloads, for example after you create an account. Our ISO 42001 Starter Checklist is free to read on the page.

What should an ISO 42001 template set include?

It should cover the standard’s clauses 4 to 10 and its Annex A controls. Look for an AI policy, roles and responsibilities, and procedures for AI risk assessment and treatment and for AI system impact assessment. Add policies for the AI life cycle, data, transparency, responsible use and third parties, procedures for internal audit and management review, and a Statement of Applicability. Our ISO 42001 AI Management System Toolkit has 14 documents and 3 workbooks. That is our product count, not an ISO requirement, and it has no AIMS scope template.

What is the difference between an AI governance policy template and an ISO 42001 toolkit?

An AI governance policy set states how your organization approves, uses and oversees AI; ours is aligned to the EU AI Act and the NIST AI RMF. An ISO/IEC 42001 toolkit should document a full AI management system, including the Annex A Statement of Applicability, internal audit and management review. Our AI Governance Policy Pack is $49 for 10 documents and has no Statement of Applicability. Our ISO 42001 AI Management System Toolkit is $99 and includes one.

Do ISO 42001 templates make you certified or compliant?

No. ISO does not certify anyone; certification bodies issue ISO/IEC 42001 certificates after auditing an AI management system in operation. Templates give you documents to tailor. You still define the scope, run the AI risk and impact assessments, operate the controls, and hold the internal audit and management review. ISO says accreditation of a certification body is not compulsory but provides independent confirmation of competence.

Do I need the ISO 42001 standard if I buy templates?

We recommend it. Our Statement of Applicability describes each Annex A control in our own words, not ISO’s, so the standard is where you check the exact requirements. The standard is a paid document, sold by ISO and by national standards bodies.

Where to Buy ISO 42001 and AI Governance Policy Templates (2026): Free and Paid Options

There are five routes to ISO/IEC 42001 and AI governance policy templates. Two are free: NIST’s AI Risk Management Framework with its Playbook, and free samples from template sellers. The other three are paid: editable template sets, compliance software platforms and consultants. The NIST material helps with an AI governance policy, but it is not written to ISO/IEC 42001 and has no Statement of Applicability.

Our ISO 42001 AI Management System Toolkit is $99 one-time for 14 policies and procedures plus 3 Excel workbooks. Our AI Governance Policy Pack is $49 for 10 documents plus 2 workbooks. Those are our product counts, not ISO requirements. No template, free or paid, makes an organization compliant or certified. ISO/IEC 42001 certification comes only from a certification body that audits an AI management system in operation.

Reviewed by Dor Israel, Founder · Updated October 18, 2026

Related toolkits: ISO 42001 AI Management System Toolkit ($99) · AI Governance Policy Pack ($49) · All-Access Compliance Library ($599)

Free: The ISO 42001 Starter Checklist for an AIMS (9 steps) →

What an ISO 42001 documentation set contains

A full set covers the standard’s clauses 4 to 10 and its Annex A controls. ISO/IEC 42001 sets requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) for the responsible development, provision or use of AI systems. ISO published it in December 2023. Clauses 4 to 10 follow the structure ISO uses for its management-system standards. Annex A lists reference controls in nine groups, A.2 to A.10. Our Statement of Applicability workbook lists 38 controls across those groups.

Four records sit at the center of an AIMS: the AI policy, the AI risk assessment and treatment, the AI system impact assessment, and the Statement of Applicability (SoA). The impact assessment looks at how an AI system can affect individuals, groups and society. ISO publishes separate guidance on it, ISO/IEC 42005:2025. The SoA records which Annex A controls you apply and why you exclude any.

The standard itself is a paid document. Our Statement of Applicability describes each control in our own words, not ISO’s, so keep the standard at hand to check the exact requirements. The table shows how our toolkit lines up with each part.

The parts of an ISO/IEC 42001 documentation set, and what our ISO 42001 toolkit includes for each

Part of ISO/IEC 42001	What it covers	In our ISO 42001 toolkit
Clause 4: context and scope	The organization and its context, interested parties, and the scope of the AI management system	No scope template. The Audit Evidence Checklist lists an AIMS scope statement and context analysis as evidence you prepare.
Clause 5.2 and Annex A group A.2: AI policy	Management’s intent and rules for developing and using AI	AI Management System Policy
Clause 5.3 and group A.3: roles	Who owns each AI duty, and how people raise concerns about an AI system	AI Roles, Responsibilities and Resources
Clauses 6.1, 8.2 and 8.3: AI risk	How you assess AI risks and choose treatments, and the results	AI Risk Assessment and Treatment Procedure, plus the Risk Register workbook
Clause 8.4 and group A.5: AI system impact assessment	How an AI system can affect individuals, groups and society	AI System Impact Assessment Procedure
Annex A groups A.4 and A.6 to A.10	Resources for AI systems, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships	Seven policies, standards and procedures, including the AI System Inventory and Documentation Standard and the AI Incident Response and Concern Procedure
Statement of Applicability (for the Annex A controls)	The controls you need, and why you include or exclude each Annex A control	Statement of Applicability workbook listing 38 controls, with columns for applicability, justification and implementation status
Clauses 6.2, 9 and 10: objectives, evaluation and improvement	AI objectives, internal audit, management review, nonconformity and corrective action	AI Objectives and Continual Improvement Procedure; AIMS Internal Audit Procedure; AIMS Management Review Procedure
Clause 7: support	Resources, competence, awareness, communication and documented information	No document cites clause 7. The Audit Evidence Checklist lists AI competence and awareness records as evidence you keep.

Clause and control-group names are paraphrased; ISO/IEC 42001:2023 holds the exact wording. The right-hand column is our mapping, based on the clause or Annex A references printed in each of our documents. No document cites Annex A controls A.4.4, A.4.5, A.4.6 or A.5.3 by number; the Statement of Applicability workbook lists all 38.

The five routes compared

The five routes differ in cost, in what you can edit, and in how much of the work is done for you. The table compares the documentation layer only. The certification audit is always separate and is priced by the certification body.

Route	What you get	Cost (documentation layer)
Free NIST material (AI RMF 1.0 and the AI RMF Playbook)	A voluntary framework and suggested actions you can turn into an AI governance policy. Not written to ISO/IEC 42001; no Statement of Applicability.	$0
Free samples from template sellers	A few individual templates, sometimes after you create an account	$0
Paid editable template sets	A structured set in Word and Excel that you tailor. Check whether it includes an Annex A Statement of Applicability.	ComplianceDocs: $49 (AI Governance Policy Pack) or $99 (ISO 42001 toolkit), one-time. Other sellers’ prices vary.
Compliance software platforms	Templates provided inside a software product, on the vendor’s terms	Set by the vendor; ask for a quote
Compliance consultant	Drafting plus hands-on program work and judgment	Quoted per scope

ComplianceDocs prices are our published one-time list prices. We did not collect platform or consultant prices for this page, so ask each for a quote. Free offerings change; confirm current terms at the source. Our comparisons with Governance Docs and ISO Docs, two other one-time ISO 42001 template sellers, show their prices on the dates we read them. Both are linked in the first FAQ below.

The free routes, honestly

Free is a real starting point. NIST publishes two free resources that help with an AI governance policy. The AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) was released on January 26, 2023. NIST says it is intended for voluntary use, and the publication is available free of charge. Its core has four functions: Govern, Map, Measure and Manage.

The companion NIST AI RMF Playbook gives suggested actions for each subcategory of those functions, and you can download it as a PDF, CSV, Excel or JSON file. For a policy, start with GOVERN 1.2, which lists what AI risk-management policies should be designed to do. Its examples include defining key terms and intended uses, connecting AI governance to existing governance and risk controls, detailing and testing incident response plans, and covering deployed and third-party AI systems.

NIST calls the Playbook voluntary and says it is neither a checklist nor a set of steps to follow in full. NIST also says AI RMF 1.0 is being revised, and that the Playbook will be updated after the revision.

The NIST material has limits. It is not organized around ISO/IEC 42001’s clauses and has no Annex A Statement of Applicability. NIST’s AI Resource Center does list a crosswalk from the AI RMF to ISO/IEC 42001. Its listed provider is Microsoft, and it maps to the draft (FDIS) text of the standard. NIST says a listing does not imply that either resource fully covers the other.

Template sellers are the other free route. Some offer a few free downloads, for example after you create an account; these offers change. We also publish a free ISO 42001 Starter Checklist that you can read in full on the page.

What to look for when buying ISO 42001 templates

Whichever route you pick, the same checks apply. Use this as a buying checklist:

Check	Why it matters
Built to ISO/IEC 42001:2023	Edition 1, published in December 2023, is the edition ISO lists. A set aligned only to the NIST AI RMF or the EU AI Act is an AI governance set, not an ISO/IEC 42001 set.
An Annex A Statement of Applicability	It lists the controls you need and why you include or exclude each Annex A control. A policy-only pack leaves that record to you.
Both assessments: AI risk and AI system impact	ISO/IEC 42001 adds an AI system impact assessment (clause 8.4) to AI risk assessment and treatment. Check that the set has a procedure for each.
Editable Word and Excel files	Your documents must describe how your organization actually works, so you need to be able to edit every line.
A free preview of the real text	Read actual policy sections before you pay, not only a table of contents.
A clear license and a plain statement of limits	Know whether you get a perpetual license to the files (one-time) or rent access, and look for a plain statement that the set does not make you certified.

These checks apply to free and paid sources alike. No documentation set, however complete, makes an organization certified or compliant on its own.

What no template does

ISO does not certify anyone. In ISO’s words, it “does not perform certification or issue certificates.” Certification bodies do, after auditing an AI management system that is in operation. ISO/IEC 42006:2025 sets requirements for the bodies that audit and certify AI management systems. ISO says accreditation of a certification body “is not compulsory,” but it provides independent confirmation of competence. The ISO Survey counts only accredited certificates: 271 valid ISO/IEC 42001 certificates worldwide as of December 31, 2025. ISO notes that some certificates may not yet be in its data, so treat that figure as a floor.

A template set cannot do that work for you. It cannot define your scope, run your AI risk and impact assessments, operate the controls, or hold the internal audit and management review. It does not make an organization compliant with the EU AI Act or any other law, either. Those duties depend on how you build and use AI, not on the documents you hold.

Where ComplianceDocs fits

ComplianceDocs is one paid option among the five routes. Pick by the job you need done.

For an ISO/IEC 42001 AI management system, the ISO 42001 AI Management System Toolkit is $99 one-time. It has 14 editable policies and procedures in Word plus 3 Excel workbooks: a Statement of Applicability for the Annex A controls, a Risk Register and an Audit Evidence Checklist.

For AI governance policies without a management system, the AI Governance Policy Pack is $49 one-time. The pack is aligned to the EU AI Act and the NIST AI RMF. Its 10 documents include an AI Governance Policy, an AI Acceptable Use Policy and an EU AI Act Readiness Checklist. It adds a Risk Register and an Audit Evidence Checklist, but no Statement of Applicability. If you need only a staff AI policy, the AI Acceptable Use Policy Template is sold alone for $9.99.

The Startup Trust Pack ($89) pairs the AI Governance pack with the SOC 2 Core policies, and the All-Access Compliance Library ($599) includes both AI toolkits and every other standalone toolkit.

Each toolkit’s files are editable Word or Excel under a single-organization license, and each toolkit page shows a free preview of real policy text. The toolkit gives you a drafted structure, so you tailor documents instead of writing them from a blank page. It does not include the standard’s text, an AIMS scope template, an EU AI Act crosswalk, consulting or an audit. You still define your scope, run the assessments, operate the controls and keep the records. Certification still comes only from a certification body’s audit.

Frequently asked questions

Where can I buy ISO 42001 policy templates?: There are five routes to ISO/IEC 42001 and AI governance policy templates: free NIST material, free samples from template sellers, paid editable template sets, compliance software platforms and consultants. The NIST material (the AI RMF and its Playbook) is free but is not written to ISO/IEC 42001. ComplianceDocs sells the ISO 42001 AI Management System Toolkit for $99 one-time: 14 editable policies and procedures plus a Statement of Applicability, a Risk Register and an Audit Evidence Checklist in Excel.Related: ISO 42001 AI Management System Toolkit · Preview the ISO 42001 toolkit · Comparison: ComplianceDocs vs Governance Docs · Comparison: ComplianceDocs vs ISO Docs
Are there free ISO 42001 or AI governance policy templates?: Yes, with limits. NIST publishes the AI Risk Management Framework free of charge, and its Playbook (a PDF, CSV, Excel or JSON download) lists what AI risk-management policies should be designed to do, under GOVERN 1.2. Both are voluntary, and neither is organized around ISO/IEC 42001’s clauses or Annex A. Some template sellers offer a few free downloads, for example after you create an account. Our ISO 42001 Starter Checklist is free to read on the page.Related: NIST AI Risk Management Framework · NIST AI RMF Playbook · Free ISO 42001 Starter Checklist
What should an ISO 42001 template set include?: It should cover the standard’s clauses 4 to 10 and its Annex A controls. Look for an AI policy, roles and responsibilities, and procedures for AI risk assessment and treatment and for AI system impact assessment. Add policies for the AI life cycle, data, transparency, responsible use and third parties, procedures for internal audit and management review, and a Statement of Applicability. Our ISO 42001 AI Management System Toolkit has 14 documents and 3 workbooks. That is our product count, not an ISO requirement, and it has no AIMS scope template.Related: ISO 42001 guide · Documents per compliance framework · ISO 42001 AI Management System Toolkit
What is the difference between an AI governance policy template and an ISO 42001 toolkit?: An AI governance policy set states how your organization approves, uses and oversees AI; ours is aligned to the EU AI Act and the NIST AI RMF. An ISO/IEC 42001 toolkit should document a full AI management system, including the Annex A Statement of Applicability, internal audit and management review. Our AI Governance Policy Pack is $49 for 10 documents and has no Statement of Applicability. Our ISO 42001 AI Management System Toolkit is $99 and includes one.Related: AI Governance Policy Pack · AI Acceptable Use Policy Template · AI governance guide · ISO 42001 vs the EU AI Act
Do ISO 42001 templates make you certified or compliant?: No. ISO does not certify anyone; certification bodies issue ISO/IEC 42001 certificates after auditing an AI management system in operation. Templates give you documents to tailor. You still define the scope, run the AI risk and impact assessments, operate the controls, and hold the internal audit and management review. ISO says accreditation of a certification body is not compulsory but provides independent confirmation of competence.Related: ISO: certification and accreditation · ISO 42001 certification statistics · ISO 42001 guide
Do I need the ISO 42001 standard if I buy templates?: We recommend it. Our Statement of Applicability describes each Annex A control in our own words, not ISO’s, so the standard is where you check the exact requirements. The standard is a paid document, sold by ISO and by national standards bodies.Related: ISO/IEC 42001:2023 on iso.org · Preview the ISO 42001 toolkit

Related guides: ISO 42001 · AI Governance (EU AI Act & NIST AI RMF)

Toolkits that help

ISO/IEC 42001:2023 AI Management System

ISO 42001 AI Management System Toolkit

14 editable ISO/IEC 42001:2023 policies and procedures — impact assessments, AI lifecycle, data governance, third-party AI — plus the Annex A Statement of Applicability, an AI risk register, and an audit evidence checklist.

$99View toolkit

AI Governance (EU AI Act + NIST AI RMF)

AI Governance Policy Pack

10 editable AI policies — including an employee AI use policy and an AI risk register — aligned to the EU AI Act and NIST AI RMF. Govern workplace AI before regulators and clients ask.

$49View toolkit

Multi-Framework Compliance

All-Access Compliance Library

Every ComplianceDocs standalone toolkit in one purchase — 17 toolkits across ISO 27001:2022, SOC 2, HIPAA, GDPR, NIST CSF 2.0, ISO 42001, AI governance and WISP. 124 distinct policy templates and 8 workbook types, delivered as 279 Word files and 40 Excel workbooks. Buying the 17 toolkits individually costs $1,553 at current list prices.

$599View toolkit

Get new templates and guides by email

An occasional email when we publish a new free template, guide, or dataset. Unsubscribe any time.

← All articles