EU AI Act Compliance Pack
349,00 €
- 31 editable files — 27 Word + 4 Excel: 25 documents + 6 guides for the EU AI Act
- Written from Regulation (EU) 2024/1689 as amended by the Digital Omnibus (Regulation (EU) 2026/1744)
- 10-minute route: most companies that use AI tools need six documents, seven with a chatbot or AI-generated content
- AI literacy programme and training record under the new Art. 4 wording; Art. 5 screening; Art. 50 notice and label texts
- Excel tools: AI system inventory, literacy training record, incident log with Art. 73 time limits, requirements map (277 rows)
- 34 open points in the law flagged, each with the pack’s default and where you decide
- Instant download · Secured by Stripe · needs Excel 2019 / Microsoft 365 or LibreOffice
📄 Look inside first: free sample (PDF) — the full file list plus the first pages of a real document from the pack. We email it to you.
Licence scope: single-entity licence: covers one legal entity. Each additional legal entity, including other companies in the same group, needs its own licence.
30-Day Update-or-Add Pledge: if a template doesn’t fit your environment, email info@nis-2-templates.com within 30 days and we’ll update it or add it. You keep everything either way.
Digital download — by accessing the files you waive the 14-day right of withdrawal in accordance with EU Directive 2011/83/EU, Art. 16(m). You’ll be asked to consent at checkout.
Description
AI Act documentation for companies that use AI tools and for small firms that build AI features, written from Regulation (EU) 2024/1689 as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744. 31 editable files, and a 10-minute route that tells you which six or seven of them you actually need.
✓ Updated for Regulation (EU) 2026/1744
✓ Instant download · fully editable
✓ Secured by Stripe
✓ Published by ZILIO
Most companies need six documents, not a library
If your company uses AI tools and uses none of them for a high-risk purpose, the AI Act asks two things of you today: take measures to support the AI literacy of your staff (Art. 4) and do not engage in a prohibited practice (Art. 5). Transparency duties (Art. 50) apply only where you trigger them, for example when you run a chatbot or publish AI-generated content.
The pack opens with a 10-minute route (G1, Section 2). Five questions place you in one or more of five profiles. Profile P1, the “deployer, no high-risk use” profile that fits most buyers, takes these documents:
- A01 AI Acceptable Use Policy: approved tools, data rules, prohibited uses, labelling, human review of output
- A02 AI System Inventory and Classification Register (Excel): one row per AI tool, its role, risk class, Art. 50 triggers and the date its duties start
- A03 Prohibited AI Practices Screening Record: the Art. 5 questions, system by system
- A04 AI Literacy Programme and Training Plan: role-based modules under the current Art. 4 wording
- A05 AI Literacy Training Record (Excel): who completed what, coverage and refreshers due
- A07 Management Approval and AI Decision Record: the decisions your management signs
- plus A06 Transparency Notices and AI Content Labelling Texts if you have an Art. 50 trigger, and A08/A09 when you buy AI
Each of the core documents A01 to A07 opens with a Quick start for most organisations box: what a P1 company does in that document, what it can skip, and the date that applies.
For small firms that build AI features
Built your own chatbot on a model API, or added a generative AI feature to your product? The AI Act may treat you as a provider (G4 asks the facts; the pack’s reading is labelled as such, G1 Section 8, point I-3). Providers add the chatbot disclosure and machine-readable marking rules of Art. 50(1) and (2) (A06, A21 Section 5.7), the General-Purpose AI Use Note (A10), and, where an AI system sits in an Annex III area without being high-risk, the Art. 6(3) assessment and registration record (A17).
If you provide a high-risk AI system, the provider starter set (A17–A25) covers risk management, data governance, technical documentation, logging and instructions for use, accuracy, robustness and cybersecurity, a quality management system outline, conformity assessment, the EU declaration of conformity and registration, and post-market monitoring. Each document opens with a “Do you need this document?” check and the simplifications the Act gives SMEs and small mid-caps.
For deployers of high-risk AI systems
CV screening, worker performance evaluation and credit scoring of individuals are Annex III uses. Deployers of such systems get a procedure for Art. 26 (A12), human oversight assignment (A13), a fundamental rights impact assessment with an applicability gate first, since only some deployers need one (A14), a serious incident procedure (A15) and an incident log with a deadline calculator (A16, Excel).
Four Excel tools, tested
| Workbook | What it does |
|---|---|
| G3 AI Act Requirements Master Map | 277 requirement rows with the text of the provision, the pack document that addresses it, profile filters and a coverage dashboard |
| A02 AI System Inventory | Role, risk class, Art. 50 triggers, applies-from date and the documents each AI system needs |
| A05 AI Literacy Training Record | People × modules, coverage, overdue refreshers |
| A16 AI Incident and Serious Incident Log | Classification, Art. 73 time limits, notification tracker |
Every formula was checked against written test vectors (153 in total) by recalculating the workbooks in LibreOffice. Dropdowns on every input column; formula cells shaded grey; the sheets are not protected, so you can add columns and adapt formulas freely; no macros. They work in Microsoft Excel 2019 / Microsoft 365 and LibreOffice Calc.
Written from the law, after the Digital Omnibus
Every article, paragraph, point and date in the pack is taken from the Official Journal texts of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, which changed the Act on 27 July 2026. Words in quotation marks are copied exactly. Where the text is unclear, the pack says so: G1 Section 8 lists 34 interpretation points, each with the pack’s default reading and the place where your company records its own decision.
Key dates
| Date | What applies |
|---|---|
| 2 February 2025 | Art. 4 (AI literacy) and Art. 5 (prohibited practices). Art. 4 has applied in its new wording since 27 July 2026 |
| 2 August 2026 | Art. 50 transparency duties for providers and deployers |
| 2 December 2026 | Machine-readable marking (Art. 50(2)) for generative AI systems placed on the market before 2 August 2026; two new prohibitions, Art. 5(1)(ba) and (bb) |
| 2 December 2027 | High-risk rules for Annex III systems (for example CV screening, credit scoring) |
| 2 August 2028 | High-risk rules for AI in products under Annex I |
What is in the pack
31 files: 6 guides and 25 documents, 27 Word documents and 4 Excel workbooks, in five folders.
| Folder | Files |
|---|---|
| 01 Guides (6) | G1 Welcome and Which Documents You Need · G2 AI Act Explainer and Timeline after the Digital Omnibus · G3 AI Act Requirements Master Map (Excel) · G4 Role and Risk-Class Assessment · G5 AI Governance Role Matrix (RACI) · G6 90-Day Plan and Readiness Checklist |
| 02 Core documents (7) | A01 AI Acceptable Use Policy · A02 AI System Inventory and Classification Register (Excel) · A03 Prohibited AI Practices Screening Record · A04 AI Literacy Programme and Training Plan · A05 AI Literacy Training Record (Excel) · A06 Transparency Notices and AI Content Labelling Texts · A07 Management Approval and AI Decision Record |
| 03 Buying AI (4) | A08 AI Vendor Due-Diligence Questionnaire · A09 AI Procurement Contract Clause Bank · A10 General-Purpose AI Use Note · A11 AI Act, GDPR, NIS2 and CRA Overlap Map |
| 04 High-risk deployers (5) | A12 High-Risk AI Deployer Procedure · A13 Human Oversight Procedure and Assignment Record · A14 Fundamental Rights Impact Assessment · A15 Serious Incident and Risk Escalation Procedure · A16 AI Incident and Serious Incident Log (Excel) |
| 05 Provider starter set (9) | A17 Art. 6(3) “Not High-Risk” Assessment and Registration Record · A18 Risk Management System · A19 Data and Data Governance · A20 Technical Documentation Index · A21 Record-Keeping, Instructions for Use and Human Oversight Design · A22 Accuracy, Robustness and Cybersecurity · A23 Quality Management System Manual Outline · A24 Conformity Assessment, EU Declaration of Conformity, CE Marking and Registration · A25 Post-Market Monitoring Plan |
Every document has placeholders in red ({{COMPANY_NAME}}, [INSERT …]) and follows one structure: purpose with the provisions quoted, scope, roles (RACI), requirements, proportionate application for small companies, exceptions, review, and an implementation checklist.
Already using our NIS2, ISO 27001 or CRA templates?
A11 maps the AI Act against GDPR, NIS2 and the Cyber Resilience Act: where a DPIA can feed a fundamental rights impact assessment (Art. 27(4)), where NIS2 incident reporting sits next to Art. 26(5) and Art. 73, and where the CRA presumption of Art. 42(3) covers the Art. 15 cybersecurity requirement.
Not legal advice
These are templates: working documents your company adapts, approves and keeps up to date. They are not legal advice and do not guarantee compliance with Regulation (EU) 2024/1689 or any national law. Have them reviewed by a qualified adviser before use; Member States set the penalty rules (Art. 99(1)).
30-day update-or-add pledge: if a template doesn’t fit your situation, email us within 30 days and we’ll update it or add what is missing. You keep everything either way.
Frequently asked questions
We only use ChatGPT and Copilot. Do we need all 31 files?
No. Profile P1 needs A01, A02, A03, A04, A05 and A07, plus A06 if you have an Art. 50 trigger. G1 Section 2 gets you there in about 10 minutes; the guides help everyone.
Is there an AI literacy deadline?
Art. 4 has applied since 2 February 2025. Since 27 July 2026 it requires providers and deployers to “take measures to support the development of AI literacy” of their staff and others dealing with AI systems on their behalf, and it states that this “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. A04 sets out a role-based programme; A05 records what was done.
Does Art. 50 apply to us?
It has applied since 2 August 2026. A deployer is caught by Art. 50(3) (emotion recognition, biometric categorisation) and Art. 50(4) (deep fakes; AI-generated or manipulated text published to inform the public on matters of public interest). A provider is caught by Art. 50(1) (systems that interact with people) and Art. 50(2) (marking of synthetic content). A02 asks the trigger questions; A06 holds the notice and label texts.
We are a UK company.
The Act also reaches providers and deployers outside the EU where the AI system’s output is used in the Union (Art. 2(1)(c)). G1 and G4 show how to record that.
Is the pack up to date with the Digital Omnibus?
Yes: it was written from Regulation (EU) 2026/1744 (in force 27 July 2026) and Implementing Decision (EU) 2026/2274 (EN 18286:2026). No English-language corrigendum to either regulation existed when it was written.
Which software do I need?
Word or LibreOffice Writer for the documents; Excel 2019 / Microsoft 365 or LibreOffice Calc for the workbooks (Excel 2016 lacks MAXIFS).