AI Security Standards Toolkit (ISO 42001, 42005, 27090, 23894)
Templates for the documents an AI governance and security programme actually has to produce: a Statement of Applicability, an AI system register, impact assessments, risk treatment plans, security test plans, supplier reviews and the management review pack. Each starts from worked sample data and generates your document as you fill it in.
Template & sample only — structured starting points with sample content for a fictional organisation, not legal, audit or certification advice. Standards are summarised in our own words; you still need your own copies of them.
The toolkit in brief
- Twelve editable templates covering the AI security and governance standards security leaders are being asked about: ISO/IEC 42001, 42005, 23894, 27090, 5338, 5259 and the EU AI Act.
- Each one opens with realistic sample data for a fictional organisation, so you can see what a finished document looks like before you replace it with your own.
- Fill in your details and each tool generates a document — Statement of Applicability, impact assessment, risk treatment plan, supplier review, management review pack and more — exported to Word, PDF, Markdown or CSV.
- Standards are described in our own words. You still need your own copies of the standards, and the output is a starting point, not certification or legal advice.
Build the AI management system (ISO/IEC 42001)
The core documents a certification audit expects to see.
ISO 42001 Statement of Applicability Builder
Mark every Annex A control area applicable or not, with status, owner and justification.
Pro · TemplateISO 42001 Evidence Binder
Organise the evidence behind each requirement and control so an auditor can find it.
Pro · TemplateISO 42001 Management Review Pack
Board pack and minutes for management review: every input, KPIs, decisions and actions.
Pro · TemplateISO 42001 Mock Audit
Rehearse a certification audit: answer the auditor's questions and get a debrief.
Know and assess your AI systems
Inventory, impact and risk — the inputs every other control depends on.
AI System Inventory & Register
Register every AI system with owner, data, decision impact and EU AI Act risk class.
Pro · TemplateISO 42005 AI Impact Assessment
Assess an AI system's impact on people, groups and society, and record the decision.
Pro · TemplateISO 23894 AI Risk Treatment Plan
Identify, analyse and treat AI risks with owners, controls and residual-risk sign-off.
Pro · TemplateAI Standards Crosswalk
See where ISO 42001, 27001, 27090, the EU AI Act and NIST AI RMF overlap.
Secure the AI life cycle
Security testing, life-cycle gates, data provenance and suppliers.
AI Life-Cycle Security Gates (ISO 5338)
Seven gates from inception to retirement with concrete pass criteria and HOLD on material gaps.
Pro · TemplateISO 27090 AI Security Test Plan
Plan tests for prompt injection, poisoning, extraction and evasion against your AI systems.
Pro · TemplateTraining Data Quality & Provenance
Prove where training data came from, that you may use it and that it was not poisoned.
Pro · TemplateAI Supplier Due-Diligence Questionnaire
Assess model, API and data vendors: training on your data, retention, testing, exit.
Start with the free labs
Not ready for the templates yet? These free PlayCISO tools help you understand where you stand first:
- ISO 27090 Readiness — Free self-check of your AI security readiness.
- ISO 42001 Gap Assessment Lab — Practise judging conformity against the AI management system standard.
- ISO 27090 Threat Mapping Lab — Map AI-specific threats to the controls that address them.
- EU AI Act Classifier — Work out which EU AI Act risk class a system falls into.
Frequently asked questions
Which standards does the toolkit cover?
ISO/IEC 42001 (AI management systems), ISO/IEC 42005 (AI system impact assessment), ISO/IEC 23894 (AI risk management), ISO/IEC 27090 (security guidance for AI systems), ISO/IEC 5338 (AI system life cycle processes) and the ISO/IEC 5259 data-quality series, together with the EU AI Act risk classes. A crosswalk shows how they relate to ISO/IEC 27001 and the NIST AI RMF.
Will these templates get us certified?
No template can do that. Certification to ISO/IEC 42001 is granted only by an accredited certification body after its own audit. The templates give you a structured, editable starting point for the documents and records an audit typically looks at.
Who can use them?
Every tool page and its sample are public. Customising a template with your own details and exporting the generated document is included with any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.