AI Questionnaire Rescue
Your customer's AI security questionnaire is due.
Send up to 10 AI questions from it. Within 24 hours you get an honest answer for each one, the governance document it rests on, and the evidence a reviewer is likely to ask for next.
$149 fixedup to 10 AI questionswritten mapping within 24 hours20 editable governance documents includedno call needed
$149 total · $74.50 upfront · $74.50 upon completion
Editable governance documentation, mapped to your actual answers. Not legal advice or certification.
THE GOVERNANCE BLUEPRINT
How it works
Question → answer → artifact → evidence.
01 · You sendUp to 10 AI questions from the questionnaire, plus one line on your product and how it uses AI. Email them to hello@annexwright.com after checkout.
02 · The answerA suggested answer written to be true for you. If you don't do something yet, it says so and shows what an honest "not yet" looks like.
03 · The artifactThe policy, register or procedure a reviewer expects behind that answer.
04 · The evidenceWhat "please attach it" will turn into, so the follow-up isn't a surprise.
You supply your company's real facts, decisions and records. Annexwright never writes "yes" for a control you don't operate.
See the real thing
One real question, mapped properly
Sample format. Not a customer case study.
| Question | If yes | If not yet | Artifact | Evidence a reviewer may ask for |
|---|---|---|---|---|
| Do you maintain an inventory of AI systems? | "Every AI system we use, including third-party models and AI features inside SaaS tools, is recorded in our AI System Inventory with an owner, purpose, data categories, risk tier and review date. It is reviewed [monthly]." | "We are establishing an AI System Inventory covering built and third-party AI. Target completion: [date]. Current AI use: [list]." | AI System Inventory Register, referenced from the AI Governance Policy | Redacted inventory extract · last review date · named owner · evidence that third-party AI (e.g. an AI feature enabled in a SaaS tool) is included, not only in-house models |
Note: the trap is "every". Reviewers test it with AI you bought, not just AI you built. A short, true list beats a long, claimed one. Bracketed items are placeholders for your own facts.
What Rescue delivers
A fixed scope, a fixed price.
You get
- A written mapping for up to 10 AI questions, delivered by email
- Within 24 hours of receiving your questions
- One round of clarification by email if an answer needs adjusting to your facts
- The 20-file Annexwright Essentials documentation set at checkout (Word, Excel, PowerPoint), with 24 months of updates
It is not
- A call or a consulting engagement
- Completion of your whole questionnaire: AI questions only, 10 maximum
- Legal advice
- A compliance or certification opinion
- Answers that claim controls you don't operate
Start with Rescue — $149
30-day money-back guarantee · your questions are never published or shared
Why not just ask an AI?
An AI assistant writes a fluent answer in seconds, and you can use one. What it won't do on its own is tie that answer to the document a reviewer will ask to see, or tell you when the honest answer is "not yet". Rescue maps each answer to the artifact and evidence behind it, then gives you the editable documents to build those artifacts.
The company facts, the controls and the records behind them stay yours to supply and maintain.
Different job?
Choose by situation.
| You need | Choose | Price |
|---|---|---|
| An urgent questionnaire answered | Rescue | $149 |
| A governance foundation for one company | Essentials | $149 |
| A formal ISO/IEC 42001 management system | Professional | $397 |
| Reusable delivery materials for multiple clients | Consultant | $897 |
| Documentation written for one AI system | Readiness Sprint | $2,450 |
Full tier details and what each set contains are further down.
Free resources
Prefer to inspect the work first?
Free, complete — the four-way crosswalkISO/IEC 42001 mapped to NIST AI RMF, the EU AI Act and ISO/IEC 27001. A whole file from the paid set. Read it or download the workbook.
Free, complete — the applicability checklist24 screening questions and an obligations calendar to 2028, covering the EU AI Act and the US state laws. Take it.
Free reference — the twenty questionsThe AI questions that now appear in enterprise questionnaires, and the artifact each answer has to rest on. See them.
Why this exists
Four situations that send people looking.
What the buyer is actually facing, what Annexwright supplies, and which document does it.
A customer sends an AI or security questionnaire.
Pre-written answers to the AI module, each one pointing at the document that evidences it.
AW-E17 Answer Bank
Procurement asks about ISO 42001 or AI governance.
A management system structure, a Statement of Applicability across all 38 Annex A controls, and an evidence binder.
AW-P01 · AW-P02 · AW-P11
The company is using AI with no consistent internal rules.
A governance policy, an acceptable use policy and a generative AI standard, plus the RACI that says who decides.
AW-E02 · AW-E03 · AW-E04 · AW-E05
Leadership asks who owns AI, what is running, and how risk is managed.
A system inventory with owners and review dates, and a risk register scored to a residual heat map.
AW-E06 · AW-E07 · AW-E08
Illustrative situations, not customer quotes.
Ask an AI to write itProse in minutes. What you do not get is a system: documents that reference each other, a clause map, evidence pointers, registers that calculate, and an order of work.
Collect free templatesFree templates solve one document at a time. Nothing connects the policy to the inventory, the inventory to the risk register, or any of it to an answer.
Hire a consultantJudgement tailored to you, and the right call when the question is genuinely hard — at professional day rates, and you wait for the first draft.
Build it from scratchFull control of every word. You also do the reading, the clause mapping and the architecture before you write a line.
How it works
You don't buy a folder of templates.
You buy the documentation architecture already designed, so the work you do is your own facts and decisions rather than the structure around them.
Starting point — the architecture is designedDocuments that reference each other, a clause and article map, registers with working formulas, and an order of work.
Your work — you supply the companyYour systems, owners, decisions, risk appetite and processes. Bracketed placeholders mark every fact only you can provide.
Result — a baseline you operateA customized governance documentation baseline your team runs and maintains. Not a compliance outcome, and not a finished programme.
What happens after you buy
01DownloadInstant. Word, Excel and PowerPoint source files.
02Open Start HereAW-E01 gives the order of work and a 30-day plan.
03Decide what appliesThe guide names which documents you need and which to skip.
04Enter your informationSystems, owners, vendors, risks, decisions.
05CustomizeAdapt the wording; a prompt pack speeds this up.
06Implement and maintainOperate the controls, keep the records, review on schedule.
Steps 4 to 6 are yours. Annexwright does not perform the implementation, and no document set makes an organization compliant or certified.
What you get
Organized by the job, not by the file count.
Every document carries the ISO/IEC 42001 clause or regulatory article it satisfies, so you can point an auditor or a reviewer straight at it.
Answer customer questionsEnterprise AI Questionnaire Answer Bank, with the evidence pointer behind each answer.
Know what AI you haveAI System Inventory with owners, data classes, risk tier and review dates.
Understand AI riskRisk register pre-seeded with 41 risks, impact assessment, vendor due diligence and scoring workbook.
Set the rulesGovernance policy, acceptable use, generative AI standard, human oversight, transparency notices, RACI.
Respond and improveIncident response procedure and log, AI literacy training deck and quiz, data governance procedure.
Build the ISO 42001 systemProfessional adds the AIMS Manual, Statement of Applicability, 65-point gap assessment, internal audit, management review, 16 KPIs, 90-day roadmap and evidence binder.
See every file, named — 20 in Essentials, 32 in Professional, 35 in Consultant
Essentials — the foundation20 files
- AW-E01Start Here — Implementation Guide & 30-Day PlanDOCX
- AW-E02AI Governance PolicyDOCX
- AW-E03AI Acceptable Use PolicyDOCX
- AW-E04Generative AI Usage StandardDOCX
- AW-E05AI Roles, Responsibilities & RACIDOCX
- AW-E06AI System Inventory Register — 5 tabs, live dashboardXLSX
- AW-E07AI Risk Register — 41 pre-seeded risks, heat mapXLSX
- AW-E08AI Impact Assessment TemplateDOCX
- AW-E09AI Vendor Due Diligence QuestionnaireDOCX
- AW-E09bAI Vendor Scoring WorkbookXLSX
- AW-E10AI Incident Response Procedure — 6 tabletop scenariosDOCX
- AW-E10bAI Incident LogXLSX
- AW-E11Transparency & Disclosure Standard — 10 notice templatesDOCX
- AW-E12Human Oversight ProcedureDOCX
- AW-E13AI Literacy Training Deck — 23 slides, speaker notesPPTX
- AW-E13bAI Literacy Quiz & Facilitator NotesDOCX
- AW-E14Regulatory Applicability Checklist + obligations calendarXLSX
- AW-E15Data Governance for AI ProcedureDOCX
- AW-E16AI Customization Prompt PackDOCX
- AW-E17Enterprise AI Questionnaire Answer BankDOCX
Professional — the ISO/IEC 42001 certification set+12 files
- AW-P01AI Management System Manual — full clause-to-evidence mapDOCX
- AW-P02Statement of Applicability — all 38 Annex A controlsXLSX
- AW-P03AI System Lifecycle Procedure — gates G0–G7DOCX
- AW-P04Gap Assessment Workbook — 65 requirements, readiness scoreXLSX
- AW-P05Internal Audit Programme, Checklist & ReportDOCX
- AW-P05bNonconformity & Corrective Action LogXLSX
- AW-P06Management Review Pack & Minutes TemplateDOCX
- AW-P07AIMS KPI & Reporting Pack — 16 KPIs, board reportXLSX
- AW-P08Resource, Competence & Communication PlanDOCX
- AW-P09Four-Way Crosswalk — 42001 × NIST × EU AI Act × 27001XLSX
- AW-P1090-Day ISO 42001 Certification RoadmapDOCX
- AW-P11Audit Evidence Binder & Auditor Briefing PackDOCX
Consultant — white-label & client delivery kit+3 files
- AW-C01White-Label Licence & Rebranding Guide — 6 delivery modelsDOCX
- AW-C02Client Onboarding Questionnaire & Scoping ToolDOCX
- AW-C03Proposal & Statement of Work TemplatesDOCX
Inside the documentation set
What the Essentials answer bank looks like, exactly as it ships.
Judge the work directly: this is the format exactly as it ships.
AW-E17 · Enterprise AI Questionnaire Answer Bank · §1 GovernanceEssentials
QuestionDo you have an AI governance policy approved by senior management?
Starting answerYes. Our AI Governance Policy is approved by [CEO] and reviewed annually. It defines principles, roles, a risk-tiering model and mandatory controls for all AI systems we build, buy or use, and is aligned with ISO/IEC 42001:2023.
What it rests onAW-E02 AI Governance Policy (signed)
QuestionDo you maintain an inventory of AI systems?
Starting answerYes. Every AI system, including third-party models and AI features in SaaS tools, is registered in our AI System Inventory with an owner, purpose, data classes, risk tier and review date. The inventory is reviewed monthly.
What it rests onAW-E06 AI System Inventory Register
That second answer is only true if the register exists and carries those fields — owner, purpose, data classes, risk tier, review date. That is the point: the answer and the artifact behind it are built as one thing. Square brackets are the facts only you can supply. The document's own instruction is blunt about it: replace bracketed facts with your reality — never claim a control you do not operate.
Why it holds up, and the dates driving it
Every document names its clauseThe Statement of Applicability lists all 38 Annex A controls with a justification column — the document an auditor reads line by line.
Formulas, dashboards, validationThe risk register scores 41 risks into a 5×5 residual heat map. The gap assessment scores 65 requirements and returns a readiness percentage.
Edition 2026.1 — built September 2026Written after Regulation (EU) 2026/1744 moved the EU deadlines on 27 July 2026, each regulatory position checked against the primary text.
The US state laws, not just the AI ActIllinois HB 3773 and Texas TRAIGA took effect on 1 January 2026. Colorado SB 26-189 applies to consequential decisions made on or after 1 January 2027, and California's ADMT compliance deadline is the same date.
The dates driving this — as at 7 September 2026
2 Aug 2026Article 50 transparency applies to generative and interactive AI.
2 Dec 2026Article 50(2) marking grace period ends for systems placed on the market before 2 August 2026.
1 Jan 2027Colorado SB 26-189 applies to consequential decisions from this date; California ADMT compliance deadline; New York's RAISE Act applies.
2 Dec 2027EU high-risk obligations for Annex III — deferred, not cancelled.
2 Aug 2028Annex I product-embedded AI obligations.
Live nowArticle 4 AI literacy, and the enterprise questionnaires already landing in your inbox.
Pricing
One payment. Perpetual licence. 24 months of updates.
Each tier includes everything in the tier before it.
Essentials
Choose this when you need a practical AI governance baseline for one company.
$149USD · one payment
What's included
- All 20 Essentials files
- Policies, acceptable use, generative AI standard
- Inventory and 41-risk register with dashboards
- Impact assessment, vendor due diligence, incident response
- 10 transparency notice templates
- Training deck, quiz and training register
- Regulatory applicability checklist
- Customer questionnaire answer bank
Most complete for one company
Get Professional
Professional
Choose this when procurement, ISO/IEC 42001 preparation or a formal management system is in play.
$397USD · one payment
What's included
- Everything in Essentials, plus:
- AI Management System Manual with clause-to-evidence map
- Statement of Applicability — all 38 Annex A controls
- Gap assessment scoring 65 requirements
- Internal audit programme, checklist and report
- Management review pack and minutes
- 16-KPI reporting pack and board report
- Four-way framework crosswalk
- 90-day certification roadmap and audit evidence binder
Consultant
Choose this when you deliver AI governance work to multiple clients and need a reusable delivery system.
$897USD · one payment
What's included
- Everything in Professional, plus:
- White-label licence — unlimited clients
- Rebranding guide and six delivery models
- Client onboarding questionnaire
- Scoping worksheet with effort multipliers
- Proposal, full SOW and short engagement letter
- Follow-on offer playbook for retainers
Instant downloadEditable source filesPerpetual licence24 months of updates30-day refund
Start from a structured system instead of building the documentation architecture from scratch.
Would you rather not do it yourself? The Annex III Readiness Sprint is a five-day service: send one intake form describing one AI system and get the Professional set plus the core artifacts written around that system.
Readiness Sprint — $2,450 · enquire by emailStraight answers
What this is, and what it isn't.
The honest version, before you buy
Buying documentation does not make an organization compliant. Compliance comes from what you actually do — the systems you register, the risks you assess, the controls you operate, the people you train, the records you keep. This removes the blank page, the research and the structure, which is genuinely most of the drafting work. It does not remove the implementation, and it is not legal advice.
What if I have more than 10 AI questions?
Order Rescue again, or email hello@annexwright.com for a quote.
Who prepares the mapping?
Annexwright's founder prepares it from the questions and facts you send, using AI-assisted drafting. Each answer is mapped to a named artifact in the documentation set, and it never claims a control you don't operate.
What if the honest answer is "not yet"?
Then the mapping says so. It shows what a credible "not yet" answer looks like, which document to put in place and what a reviewer is likely to ask for once it exists.
Will this get us certified to ISO/IEC 42001?
It gives you the documentation an auditor expects and the structure to produce the evidence. It cannot give you the records only elapsed time produces — a completed internal audit and a management review. The gap assessment and the 90-day roadmap in Professional plan exactly that, and is candid about why first attempts usually fail.
Is this just ChatGPT output?
The file list and the sample above are the test. The Statement of Applicability carries 38 controls with correct identifiers from A.2.2 to A.10.4, each with a purpose, a suggested implementation and an evidence pointer. The risk register holds 41 risks with inherent and residual scoring and a working heat map. The chain from answer to artifact to record is set out here. Generic AI output does not survive that specificity — which is why the manifest is published rather than hidden behind a form.
Why not just ask ChatGPT or Claude to write these?
You can, and for a single policy it will produce something readable in minutes. The difference is not human versus AI — these documents were drafted with AI assistance too. The difference is generated text versus a structured system. A governance system needs documents that reference each other, controls mapped to clauses you can cite, answers that point at the artifact behind them, registers that calculate rather than describe, and an order of work that tells you what to do first. A model asked for "an AI governance policy" gives you prose; it does not give you the architecture, and clause references it produces should be checked against the standard before anyone relies on them. What you would be buying here is the design of the system, already done and already checked against the primary texts.
Free templates exist. Why pay?
Free templates solve one document at a time, which is genuinely useful if one document is what you need. What they do not do is connect: the policy to the inventory, the inventory to the risk register, the register to the impact assessment, and all of it to the answer you give a customer. Assembling that yourself is the work. If you want to test the quality before spending anything, one complete file from the paid set is free on this site with no email required.
Why $149? It's twenty files.
Not because there are twenty files — another vendor will always claim more. Because the documentation architecture has already been designed: what each document contains, how they reference each other, which ISO/IEC 42001 clause or regulatory article each one satisfies, which registers calculate what, and the sequence you work through them in. The file count is evidence that the system is substantial, not the reason for the price.
We already have ISO/IEC 27001. Is this redundant?
No, and you are the easiest case. Clauses 4–10 are structurally identical, so most of your management system carries over — the free crosswalk shows exactly what transfers, and this page sets out the comparison. What is genuinely new is AI-specific: impact assessment, data provenance, human oversight, transparency, intended-use control.
We're a 15-person startup. Is this over-engineered for us?
The Start Here guide's first job is to tell you what to skip. A company using AI tools internally needs eight documents, not thirty-five. A company using AI in hiring or lending needs more, and needs a lawyer as well.
How much work is left for us?
All of the company-specific work. You decide which systems are in scope, who owns them, what your risk appetite is, and what you will actually do; you fill the registers, adapt the wording, operate the controls and keep the records. What you do not do is design the document architecture, research the clause mapping or write the first draft.
Can I use this for my clients?
Not on Essentials or Professional — those are licensed for one organization's internal use. The Consultant tier exists for that: rebrand everything and deliver adapted materials to unlimited clients. The one line you cannot cross in any tier is redistributing the templates as templates.
The EU delayed the high-risk rules. Why buy now?
Two obligations are live regardless: Article 4 AI literacy since February 2025, and Article 50 transparency since 2 August 2026, with the marking grace period ending 2 December 2026. The deferral moved Annex III duties to December 2027; it did not cancel them. Meanwhile the thing actually costing companies money today is not a regulator — it is an enterprise buyer's security questionnaire.
There are other ISO 42001 toolkits. Why this one?
There are, and some are good — compare them. Three things separate this one, and all three are checkable rather than claimed. It was built after the Digital Omnibus changed the EU deadlines on 27 July 2026. Its spreadsheets are working models rather than tables printed into a document. And it covers the US state laws that are, for most companies, the nearer deadline. If a competing toolkit does all three, buy theirs.
What format are the files?
Word, Excel and PowerPoint. Fully editable, no watermarks, no locked cells, no PDF-only files. The spreadsheets use standard formulas that work in Excel, Google Sheets and LibreOffice.
Who is behind this?
Annexwright is an independent product studio and launched in September 2026. The documents were drafted with AI assistance against the published standards and legislation, and every regulatory position was checked against primary sources. It is not legal advice, it is not a certification body, nobody has audited or endorsed it, and it will not make anyone compliant on its own — it is a drafting foundation you adapt. That is why a complete document is free: judge the work before you buy.
What if it isn't right for us?
Email hello@annexwright.com within 30 days and you get a full refund. You keep the files.
For consultants, trainers and newsletter authors
Refer it. 30% on every sale — $44.70 on Essentials, $119.10 on Professional, $269.10 on the Consultant licence, tracked and paid by Gumroad. Sign up here.
Deliver with it. The Consultant licence at $897 lets you rebrand every document as your own and use it with unlimited clients, perpetually. It does not permit reselling the toolkit as a template product. Ask and I will send you the full set free to evaluate first — hello@annexwright.com.
Who is behind this
An independent, one-person product studio.
Annexwright launched in September 2026. It builds editable document systems for work governed by an external rulebook, starting with AI governance: ISO/IEC 42001, the EU AI Act and US state AI law. The documents are drafted with AI assistance and checked against the published standards and legislation.
Nothing here is certified or endorsed by anyone, and it is not legal advice. The full picture is in the FAQ.