Someone has just asked you to put an AI management system in place. Maybe a client asked for your AI governance posture in a tender. Maybe your insurer did. Maybe the board heard "ISO 42001" and wants a date.
WHAT YOU GET – THE FULL MANIFEST
• 172-slide ISO 42001 implementation guide
• 18-slide quarterly board briefing deck
• 16-slide staff awareness deck
• 42-tab AIMS workbook
• 22 Word documents
• 20 printable forms
• 4 PDFs including the 29-page implementation manual and three one-page quick-reference cards
• README.
51 files in one ZIP. One connected system, not a folder of templates that contradict each other.
WHAT THIS SHELF DID NOT HAVE WHEN IT WAS COUNTED
Counted across this category in October 2026: the longest deck on the shelf is 96 slides, priced at $79, with zero spreadsheet tabs. Its 6 "deliverables" are slide titles, not files.
This listing ships the deck AND the operating system behind it: 42 workbook tabs holding 1,295 rows of working illustrative data, 1,037 live formulas and 98 validation rules, so the register, the risk scores, the applicability decisions and the dashboard recalculate as you type.
THE STATEMENT OF APPLICABILITY – THE FLAGSHIP
The SoA is the first document an auditor asks for and the one no other listing on this shelf provided as a working file when the category was counted in October 2026.
All 38 Annex A controls are present with their verified IDs and titles across the nine objectives A.2 to A.10, each carrying an applicable Yes/No decision, a written justification for inclusion or exclusion, implementation status, the artifact that satisfies it, the owner, the evidence reference and a target date.
The summary block and the roll-up by objective are live formulas. Excluding a control is legitimate; leaving the justification blank is not, and the sheet says so.
CLAUSES 4 TO 10, ANSWERED ONE AT A TIME
24 normative sub-clauses are mapped, each with what conformance looks like, the artifact in this pack that provides it, the owner, the evidence an auditor will request and a review cadence. The guide walks the same order. Buyers consistently confuse clause 6.1, which sets the risk and impact method, with clauses 8.2 to 8.4, which execute it – there is a dedicated slide on that pair, because getting it wrong is the most common finding in a first audit.
ALL 38 ANNEX A CONTROLS, FAMILY BY FAMILY
A.2 policies related to AI (3 controls). A.3 internal organization (2). A.4 resources for AI systems (5). A.5 assessing impacts of AI systems (4). A.6 AI system life cycle (9). A.7 data for AI systems (5). A.8 information for interested parties (4). A.9 use of AI systems (3). A.10 third-party and customer relationships (3). Each control gets its own reference slide: what it asks for, how this pack answers it, who owns it, what evidence to keep, and the gap that appears most often in practice. The numbering starts at A.2 and no control ends in .1 – the guide explains why, because it is the first thing that looks like an error and is not.
THE AI SYSTEM IMPACT ASSESSMENT, WORKED END TO END
Clause 8.4 is the clause firms skip. The method is here: five impact dimensions – individual rights and dignity, group and demographic fairness, safety and wellbeing, economic and access, environmental and societal – with the question set, the scoring bands, the decision rule and the signed decision record. It is worked in full on an HR CV screening assistant, with the arithmetic visible, so you can see what a Red-tier system assessment looks like before you write your own. A blank form and a completed example ship together.
THE WORKBOOK DOES THE REMEMBERING
42 tabs across 7 groups, exactly as the Start Here tab lists them: establish: Scope & Context, Interested Parties, AI System Register, Roles & RACI, AI Objectives & KPIs; assess: AI Risk Register, Risk Treatment Plan, Risk Heatmap, Impact Assessment Log, Impact Assessment Form, Gap Assessment, AIMS Maturity Model, Opportunity Register, Risk Acceptance Register; operate: Resource Inventory, Dataset Inventory, Data Quality & Provenance, Tool & Model Register, Vendor & Supplier DD, Incident & Concerns Log, Legal & Regulatory Reg, Competence & Training, Document Control, Change Control Log, Release Gate Checklist, Concerns Log, Party Request Log, Model Card Register; check: Internal Audit Program, Audit Checklist, Management Review, Monitoring & Metrics, Training Effectiveness; improve: Nonconformity & CAPA, Improvement Register; prove: Statement of Applicability, Clause Control Map, Evidence Log, Certification Readiness; reference: Start Here & How to Use, Dashboard, Setup & Lists.
The Dashboard is entirely formula-driven – nothing is typed. Change a status in the Statement of Applicability or add a risk and the tiles, the objective roll-up and the "what to do this week" lines move with it, because they read those tabs. The 48-question audit checklist asks evidence-seeking questions, not yes/no ones: "Trace one dataset from source to model input and show where each transformation is recorded" rather than "Is data provenance documented?"
22 EDITABLE DOCUMENTS, EACH WITH ITS CLAUSE MAP
Start Here and Tailoring Guide; AIMS Scope Statement; AI Policy; AIMS Manual; Document Control Standard; Roles, Responsibilities and RACI; AI Risk Assessment Method; AI Risk Treatment Method; AI System Impact Assessment Method; AI System Life Cycle Standard; Data Management Standard; Data Provenance and Quality Procedure; Logging and Retention Standard; Resource and Competence Plan; Awareness and Training Program; Communication and External Reporting Procedure; Supplier and Third-Party AI Control; Incident, Concern and Notification Procedure; Internal Audit Program; Management Review Pack; Nonconformity and Corrective Action Procedure; License Sheet. Every one ends with a table naming the clause and Annex A controls it satisfies and what conformance looks like in practice – so the document set is also your audit trail index.
20 PRINTABLE FORMS, TWO PAGES EACH
System registration, use-case tiering, impact assessment, risk assessment record, risk treatment plan, risk acceptance statement, SoA cover, competence record, policy acknowledgement, concern report, incident report, release gate approval, model card, dataset record, vendor due diligence, shared responsibility matrix, audit working paper, nonconformity and corrective action, management review attendance and decisions, evidence request record. Each asks for exactly what the matching workbook tab holds, so paper feeds the register without translation.
THE BOARD PACK – UNCONTESTED
Not one listing in this niche at any price ships a separate quarterly board briefing deck. This one does: 18 slides covering AIMS status, the estate by tier, the SoA position, readiness by clause family, the top five AI risks, supplier posture, incidents against their clocks, audit findings and CAPA, the decisions the board is being asked to take, and the next 90 days.
Every figure names the workbook tab it came from, so the second slide you are asked – "where does that number come from?" – has an answer. Plus a 16-slide all-staff awareness deck with facilitator notes on every slide.
HOW THE 90-DAY PLAN WORKS
Six phases, each with a named output: mobilize (scope, roles, register live), baseline (gap assessment and SoA signed), build controls (impact assessments, life-cycle and data controls), operate (monitoring, release gates, suppliers), check (first internal audit and CAPA), prove it (management review and evidence pack). Written for a part-time effort of roughly four hours a week. A 90-minute path gets a small firm to a defensible position; the full plan gets you to certification-ready documentation.
PROMPT-FREE, MACRO-FREE, SUBSCRIPTION-FREE
Plain Excel, Word and PowerPoint. No macros, no add-ins, no external links, no bank or API connections, no internet requirement, no telemetry. The formulas are standard spreadsheet functions and the files open in Google Sheets and Docs, but the workbook was validated in Microsoft Excel – if you move it to Sheets, recalculate the Dashboard once before you trust it. Yellow cells are inputs; everything else calculates. Conditional formatting and dropdowns are set so the colors and lists survive editing and re-sorting.
WHO IT IS FOR
Independent AI-governance, ISO and risk consultants who must deliver an AIMS on a client engagement this month. Internal compliance, risk, IT-governance, data-protection and security leads introducing AI tools at work. Professional services firms – legal, accountancy, advisory – answering AI governance questions in tenders. Anyone who has been told "we need an AI policy" and knows a one-page policy will not survive the first real question.
HOW TO START
Download the ZIP. Open Start Here in the workbook. Write your scope statement (Document 01) and load your AI systems into the register. Run the gap assessment. Then complete the Statement of Applicability – that single document turns this from a library into your management system. Everything else follows from those four steps.
WHAT TO KNOW BEFORE YOU BUY
References to law and regulation, including the EU AI Act (Regulation (EU) 2024/1689), are current at October 2026 and change; the workbook carries a legal register you maintain, and every dated claim tells you to verify against primary sources. Clause and control numbering follows the 2023 edition.
This is educational and implementation material: it is not legal, regulatory or compliance advice, it is not an ISO training course, and using it does not make your organization compliant with or certified to any law or standard. All firm names, systems, scores and figures are illustrative sample data built to show the method working – replace them with your own.
One commercial license per organization covers your internal use and your client work; editing is expected, resale of the templates themselves is not.
Got a question about the product? Email us at support@flevy.com or ask the author directly by using the "Ask the Author a Question" form. If you cannot view the preview above this document description, go here to view the large preview instead.
Source: Best Practices in Artificial Intelligence, ISO 42001 PowerPoint Slides: ISO/IEC 42001:2023 (AIMS) Implementation Toolkit PowerPoint (PPTX) Presentation Slide Deck, WebsiteGeek