Skip to main content
Praxikon
Agent check

Free template · Word · English and Dutch

AI governance framework template for the AI Act and GDPR (free Word download)

An AI governance framework sets out who in your organisation decides about AI, who carries out which obligation and how you demonstrate it. It assigns obligations under the AI Act (as provider or deployer) and the GDPR (as controller) to existing roles, with decision rights, a power to stop, rules for risk acceptance and a quarterly report to the board.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:ai-governance-framework
Legal basis
Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Regulation (EU) 2016/679 (GDPR)

Who is this template for?

  • Management board or board of directorsApproves the framework, decides on high-risk applications and high residual risks, and receives the quarterly report (chapters 4, 6 and 8)
  • AI governance ownerMaintains the AI register and the decision rights. The law does not require this role; only a provider of a high-risk AI system must have an accountability framework (Article 17(1)(m) AI Act)
  • Data protection officer (DPO)Advises on the DPIA and is involved in good time, without a conflict of interests (Articles 35, 38 and 39 GDPR)
  • Legal and procurementDetermines the role for each application and checks whether a change makes the organisation a provider (Article 25(1) AI Act)
  • HR and employee representativesAI literacy measures (Article 4) and informing workers' representatives before high-risk AI is used at the workplace (Article 26(7)); add any information, consultation or consent rights under national law
  • Internal auditReviews the design, existence and operating effectiveness of the framework with the annual review questions (chapter 9)

What is inside

  • Chapter 1: purpose, scope and a set-up by size, from a single owner to a monthly AI meeting
  • Chapter 2: three lines for AI, with what each line does not do and why the DPO belongs in the second line
  • Chapter 3: internal roles and four tables of obligations per role: general (Articles 4, 5 and 50), deployer and provider of a high-risk AI system, and controller under the GDPR
  • Chapter 4: decision rights for twelve types of decision, with a power to stop (Article 26(5)) and escalation
  • Chapter 5: the AI register cycle in eight phases, triggers for reassessment and a decision box for Article 25(1)
  • Chapter 6: risk acceptance with thresholds, lapse periods and a form to fill in
  • Chapter 7: one route for the AI Act and the GDPR, covering the DPIA, the fundamental rights impact assessment and the DPO
  • Chapter 8: cadence and structure of the quarterly report to the board, with a worked fictional example
  • Chapters 9 and 10: review questions for the third line and a 90-day implementation plan
  • Appendix A: optional mapping to ISO/IEC 42001

How to use the template

  1. In section 1.4, choose the set-up that fits your size. A small organisation does not need an AI committee.
  2. Determine your role for each AI application with the AI register workbook and fill in, in chapter 3, which internal role carries out each obligation.
  3. Compare the decision rights (chapter 4) and the risk acceptance thresholds (chapter 6) with your delegation of authority and adjust roles and deadlines.
  4. Ask the DPO, information security and employee representatives for advice, and have the framework approved by the management board or board of directors.
  5. After the first quarter, prepare the quarterly report as set out in chapter 8 and have the third line review the framework every year.

Common mistakes

  • Making the DPO the owner of AI governance. They would then co-decide on processing they must later monitor, which can conflict with their independent position (Article 38(3) and (6) GDPR).
  • Accepting a legal obligation as a risk. Nobody in the organisation can accept a prohibited practice, processing without a lawful basis or continued use where Article 26(5) requires suspension.
  • Assigning obligations to the organisation as a whole. The role differs per application: the same organisation can be the provider of its own chatbot and the deployer of a procured HR system.
  • Reading Article 49 as a duty to keep an internal AI register. Article 49 concerns registration in the EU database; your internal register is your own choice, while the record of processing activities under Article 30 GDPR is mandatory as a rule.
  • Forgetting AI features that suppliers switch on in existing software. They belong in the register and go through the decision rights too.

When do you need legal advice?

  • The DPO gets a second hat. You want to make the DPO the owner of AI governance or have them co-decide on AI applications. That can conflict with their independent position (Article 38(3) and (6) GDPR), which the controller must safeguard.
  • You want to accept a high residual risk. If a DPIA shows a high residual risk, the controller must first consult the data protection supervisory authority (Article 36 GDPR). If use of a high-risk AI system may lead to a risk within the meaning of Article 79(1), the deployer must suspend that use (Article 26(5)).
  • A change can shift your role. As a deployer you put your name or trademark on a high-risk AI system, make a substantial modification to it, or change the intended purpose of a system so that it becomes high-risk. You then become a provider (Article 25(1)), with the obligations of Article 16.

Frequently asked questions

Does the AI Act prescribe a governance structure?

No. The AI Act allocates obligations to roles such as provider and deployer and does not require an AI committee or ethics board. Only a provider of a high-risk AI system must have a quality management system that includes an accountability framework for management and staff (Article 17(1)(m)). A DPO is only mandatory in the cases set out in Article 37 GDPR.

Do I need to appoint an AI officer?

No, the law does not require an AI officer. Since the amendment of 27 July 2026, providers and deployers take measures to support the development of AI literacy of their staff, without having to guarantee a specific level for any individual (Article 4). You decide who carries out those measures and the other tasks; this framework assigns them to an existing role as AI governance owner.

Which obligations already apply (law as of 6 October 2026)?

The prohibited practices (Article 5) and Article 4 have applied since 2 February 2025, Article 4 in its current wording since 27 July 2026. Article 50 has applied since 2 August 2026; for systems placed on the market before that date, the provider must have the machine-readable marking of paragraph 2 in place by 2 December 2026. The new prohibitions in Article 5(1)(ba) and (bb) also apply from 2 December 2026. The obligations for high-risk AI systems follow on 2 December 2027 (Annex III) and 2 August 2028 (Annex I), with transitional rules in Article 111(2).

When does my organisation become a provider instead of a deployer?

Under Article 25(1), when you put your name or trademark on a high-risk AI system already placed on the market or put into service, when you make a substantial modification to it so that it remains high-risk, or when you change the intended purpose of a system that was not high-risk in such a way that it becomes high-risk. You then take on the obligations of Article 16. Section 5.3 of the framework contains a decision box for this.

Can I map the framework to ISO/IEC 42001?

Yes. Appendix A maps each chapter to the clauses of ISO/IEC 42001:2023. The standard is voluntary. As of 6 October 2026 it has not been published as a harmonised standard in the Official Journal, so applying it or being certified against it gives no presumption of conformity with the AI Act (Article 40) and replaces no legal obligation.

May I adapt the template and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place. The template is a tool, not legal advice for your situation.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, AI governance framework template for the AI Act and GDPR (free Word download), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/ai-governance-framework

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597