Essentials — $149

A practical AI governance baseline for one organization.

Twenty editable documents that give you the policies, registers and assessments behind the answers you give when a customer, a procurement team or your own board asks how you govern AI.

$149USD · one payment · perpetual licence · 24 months of updates · 30-day refund

Get Essentials — $149 See a complete document free

Who this is for

Two situations, both common:

A B2B SaaS or AI vendor whose enterprise customers have started sending an AI section with the security questionnaire, and who has nothing to attach when the reviewer asks for the underlying document.
A company using AI internally — models in products, AI features inside SaaS tools, staff using assistants — with no consistent rules, no list of what is running and no named owner.

If a formal ISO/IEC 42001 management system, an internal audit programme or a Statement of Applicability is in play, you want Professional instead. If you deliver this work to clients, you want Consultant.

The job it does

An AI governance answer is only as good as the artifact behind it. "Yes, we maintain an inventory" becomes "please attach it" one email later. Essentials exists so that the artifact exists before the question arrives — and so that the answer and the document behind it were designed as one thing rather than assembled in a panic.

What is in it

Set the rulesAI Governance Policy, AI Acceptable Use Policy, Generative AI Usage Standard, Human Oversight Procedure, Transparency & Disclosure Standard with 10 notice templates, and a roles and RACI document so accountability has a name on it.

Know what you are runningAI System Inventory Register — five tabs with a live dashboard, carrying owner, purpose, data classes, risk tier and review date for every system, including third-party models and AI features inside SaaS tools.

Understand the riskAI Risk Register pre-seeded with 41 AI-specific risks scored to a 5×5 residual heat map, an AI Impact Assessment template, a Vendor Due Diligence Questionnaire and a Vendor Scoring Workbook.

Answer and respondEnterprise AI Questionnaire Answer Bank, AI Incident Response Procedure with six tabletop scenarios and an incident log, a Data Governance for AI procedure, an AI literacy training deck with a quiz, a regulatory applicability checklist with an obligations calendar, and a customization prompt pack.

Word, Excel and PowerPoint. Fully editable, no watermarks, no locked cells, no PDF-only files. Every file is named on the homepage.

One real row from the answer bank

This is AW-E17 as it ships, not a mock-up:

AW-E17 · Enterprise AI Questionnaire Answer Bank · §1 Governance

QuestionDo you maintain an inventory of AI systems?

Starting answerYes. Every AI system, including third-party models and AI features in SaaS tools, is registered in our AI System Inventory with an owner, purpose, data classes, risk tier and review date. The inventory is reviewed monthly.

What it rests onAW-E06 AI System Inventory Register

The document's own instruction is blunt about the limit: replace bracketed facts with your reality — never claim a control you do not operate. More on why the artifact matters more than the wording.

What you still do. Annexwright supplies the documentation architecture. You decide which systems are in scope, who owns them, what your risk appetite is and what you will actually do; you fill the registers, adapt the wording, operate the controls and keep the records. Buying documentation does not make an organization compliant or certified.

Take a complete document first

The four-way crosswalk is a whole file from the paid set — ISO/IEC 42001 mapped to NIST AI RMF, the EU AI Act and ISO/IEC 27001, clause by clause, as an Excel workbook. No signup, no email gate.

Read the crosswalk Download the workbook

Common questions

Is twenty documents too much for a 15-person company?

The Start Here guide's first job is to tell you what to skip. A company using AI tools internally typically needs a handful of them, not all twenty. A company using AI in hiring or lending needs more, and needs a lawyer as well.

Why not just ask an AI model to write these?

You can, and for a single policy you will get something readable quickly. These documents were drafted with AI assistance too — the difference is not human versus machine. It is generated prose versus a structured system: documents that reference each other, controls mapped to clauses you can cite, answers that point at the artifact behind them, registers that calculate rather than describe, and a sequence of work. A general-purpose model asked for "an AI governance policy" produces text, not that architecture, and clause references it produces should be checked against the standard before anyone relies on them.

Can I use it with clients?

No — Essentials and Professional are licensed for one organization's internal use. Consultant is the tier that permits white-label client delivery.

What if it is not right for us?

Email hello@annexwright.com within 30 days for a full refund. You keep the files.

Get Essentials — $149 Compare with Professional

How this page was checked. Regulatory dates on this page were taken from the official texts and from the European Commission, the Illinois General Assembly, Texas Legislature Online, the Colorado General Assembly, the California Privacy Protection Agency, the New York State Senate and NYC DCWP, and were last reviewed on 2026-09-23. Where a date is an applicability or compliance deadline rather than an entry-into-force date, the page says so. Regulation changes; check the primary text before relying on any date for a decision. Nothing here is legal advice.