GRCLibrary.ai

Document type

Templates

38 documents: 34 in the corpus and 4 adopter documents under docs/. Reusable blank skeletons meant to be copied into working instances.

Documents, 38

Every document of this type

Each with its area and its purpose; a document that states no purpose gets a line naming its type and area. A title in a corpus area opens the document's page, which holds the record and, where the document has them, its outline, frameworks, and related documents; a title in the Library area is a library specification with no page and opens its source on GitHub. The full text of every document is read on GitHub.

  • AI Assurance Case TemplateAIThis template is the record format for the assurance case of an AI system. It is completed and maintained by the AI System Owner under ai/procedure-ai-assurance-case.md, over the evidence model of ai/framework-ai-assurance-evidence.md. Its structure adapts, by paraphrase and clause reference, the assurance case structure of ISO/IEC/IEEE 15026-2:2022 (Clause 5): a licensed proprietary standard that is not reproduced here.
  • AI Red Team Report TemplateAIThis template defines the format of a structured AI red team engagement report. It is used for both internally-run engagements and externally-commissioned engagements against the organization's AI systems. The output is the durable record of the engagement, the findings, the recommendations, and the corrective actions tracked to closure.
  • AI System Register TemplateAIThis template defines the reusable structure for the AI System Register, the system-scoped view of the authoritative AI System Inventory, recording AI systems and use cases, owners, risk classification and impact levels, lifecycle status, data categories, suppliers, controls, approvals, and evidence. It must be adapted by adopting organizations before use in an internal environment.
  • AI Vendor Security Questionnaire TemplateAIThis questionnaire extends the general supplier security questionnaire with AI-specific items. Use this template for any supplier providing a foundation model, AI platform, AI service, or AI-enabled product that materially shapes the organization's AI behaviour or processes the organization's data through AI.
  • Dataset Datasheet TemplateAIThis template captures the documentation accompanying any dataset used by the organization for training, fine-tuning, evaluation, retrieval, or other AI processing. It is based on the datasheets-for-datasets pattern and is required for every dataset in the AI System Register. Each dataset has one datasheet; the datasheet evolves with the dataset and is versioned alongside it.
  • Model Card TemplateAIThis template provides a reusable structure for documenting an AI model. It records purpose, ownership, data provenance, evaluation results, limitations, model risk, monitoring, approval, retention, and retirement information.
  • System Card TemplateAIThis template provides a reusable structure for documenting an AI system that includes one or more models, retrieval sources, tools, integrations, workflows, suppliers, or user-facing capabilities.
  • Audit Evidence Package TemplateComplianceThis template packages per-control evidence into an audit-ready bundle: a single navigable artefact that an external auditor, regulator, or independent assessor can walk through to evaluate the controls over a defined period or, for a SOC 2 Type I package, as of a point in time. For a SOC 2 Type II package, that covers whether the service organization's description presents the system as designed and implemented throughout the period, whether the controls were suitably designed throughout the period, and whether they operated effectively throughout the period. For a SOC 2 Type I package, it covers whether the service organization's description presents the system as designed and implemented as of a point in time (the "as of" date) and whether the controls were suitably designed as of that date, and not whether they operated effectively.
  • Regulator Interaction TemplatesComplianceThis template consolidates the recurring regulator-facing interactions into reusable shapes. The library ships incident-notification language inside per-jurisdiction privacy annexes (under privacy/jurisdictions/) and inside industry compliance overlays (under compliance/<sector>/), but the shape of an organization-to-regulator interaction is broadly similar across jurisdictions and sectors. This template provides five reusable sub-templates so adopters facing first-time regulator contact have a starting structure.
  • Trade Compliance Programme Gap Assessment TemplateComplianceThis template provides a structured approach for assessing the organization's current security controls against the requirements of one or more internationally recognized trade compliance and trusted-trader programmes.
  • Citation Verification Worklist TemplateGovernanceThis template is the working artefact for a citation verification batch under the Citation Verification Specification (specification-citation-verification.md). It enforces the AI/human operating split defined in that specification ยง3: the AI verifier pre-fills the worklist, the human verifier fetches publisher pages and captures verbatim text, and the AI verifier transcribes the captured text into the Citation Verifications Register.
  • Document Review Record TemplateGovernanceThis template structures the record produced when a single document is reviewed under the library quality and review cadence procedure. The record captures who reviewed, what was assessed, what was found, the disposition, the actions, and the sign-off.
  • Executive Narrative Subtype TemplatesGovernanceThis template holds a copyable skeleton for each of the seven executive-narrative subtypes defined in the Executive Narrative Authoring Specification: Executive Brief, Scenario, Decision Narrative, Oversight Question Set, Story, Journey, and Outcome Map. Each skeleton carries the required metadata block, the universal authority disclaimer, and the subtype's mandatory section order, so an author starts from a conforming shape rather than assembling one by hand.
  • Library Health Report TemplateGovernanceThis template structures the quarterly library health report referenced by the library quality and review cadence procedure. The report aggregates the state of the library's documents, derived artefacts, tooling, and review cadence; surfaces drift; and proposes corrective actions.
  • Breach Notification Regulator Register TemplatePrivacyThis template is an adopter-fillable register of the breach-notification obligations that bind the organization, one row per applicable regulator. It exists to close a specific gap: the breach-response procedure assesses notifiability at the time of a breach, but each regulator's deadline and trigger differ, and the organization has no single instrument recording, per regulator, the regulatory deadline alongside an internal target deadline that is set tighter than the regulatory one. Without that internal target, the organization has no operational clock of its own and risks managing each breach to the external deadline, leaving no margin.
  • Data Processing Agreement Template (GDPR Article 28)PrivacyThis template defines the structure of a data processing agreement (DPA) sufficient to satisfy the controller-to-processor contract that GDPR Article 28(3) requires whenever a controller engages a processor to process personal data on its behalf. It collects, into one populatable instrument, the eight mandatory processor obligations of Article 28(3)(a) to (h) plus the sub-processor conditions of Article 28(2) and (4) and the written-form requirement of Article 28(9). It also accommodates the equivalent processor-contract obligation under UK GDPR Article 28 and the analogous operator or processor obligations under LGPD (Brazil), PIPL (China), and PIPEDA (Canada, accountability for transfers to third parties for processing).
  • Data Subject Access Request Workflow TemplatePrivacyThis template defines an operational workflow for handling Data Subject Access Requests (DSARs) and equivalent rights requests under GDPR, UK GDPR, LGPD, PIPEDA, PIPL, CCPA, and similar regimes. It complements the Data Subject Rights Management Procedure by providing the request-record structure, the stage gates, an operational rendering of the identity verification ladder the procedure's Section 4.2 defines and governs, and the response artefact format that the procedure relies on. Adopting organizations populate the placeholders, configure their own systems of record, and integrate the workflow with their case-management tooling.
  • DPIA (Data Protection Impact Assessment) TemplatePrivacyThis template defines the structure of a Data Protection Impact Assessment (DPIA) sufficient to evidence the controller's obligations under GDPR Article 35 and the equivalent obligations under UK GDPR, LGPD Article 38, PIPL Article 55, the EU AI Act (where the processing is part of a high-risk AI system), and Quebec Law 25's privacy impact assessment obligation (Canada, CQLR c. P-39.1, section 3.3).
  • Employee Monitoring Notice TemplatePrivacyThis template defines the structure of the plain-language notice an organization gives its personnel about workforce network monitoring. It is the transparency instrument that the Workforce Network Monitoring Policy (Section 5, Transparency and notice) requires, and it delivers the advance-disclosure and right-to-object information that the Legitimate Interest Assessment for Employment Monitoring Annex (Section 6.3 and Section 7) treats as a required baseline measure of the balancing analysis.
  • Joint Controller Arrangement TemplatePrivacyThis template defines the structure of a joint controller arrangement sufficient to satisfy GDPR Article 26 and equivalent obligations under UK GDPR. It also accommodates PIPL's joint-personal-information-handler concept (China, Article 20 joint personal information handlers). LGPD (Brazil) has no statutory GDPR-Article-26-style co-controller category or arrangement duty: Article 5(VI) defines the controller, and Article 42 section 1(II) instead makes controllers jointly and severally liable where they are directly involved in the processing from which the data subject's damage resulted, subject to the Article 43 exclusions. India's DPDPA recognizes joint determination only definitionally (Data Fiduciaries acting in conjunction with others, section 2(i)) and creates no statutory joint-controller arrangement. Adopting organizations populate one arrangement per joint-processing context.
  • Legitimate Interest Assessment (LIA) TemplatePrivacyThis template is the instrument that records and evidences a Legitimate Interest Assessment (LIA): the documented three-part test an organization completes before relying on the legitimate-interests lawful basis under GDPR Article 6(1)(f) (Regulation (EU) 2016/679). Article 6(1)(f) permits processing that is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject". Relying on that basis without a recorded assessment leaves the organization unable to demonstrate the accountability that Article 5(2) requires.
  • Privacy Notice TemplatePrivacyThis template defines the structure of a privacy notice that satisfies the information duties of GDPR Articles 13 and 14, UK GDPR equivalents, LGPD, PIPEDA, PIPL, CCPA, and similar regimes. It accommodates both website-style standing notices and just-in-time notices delivered at the point of collection. Adopting organizations populate the placeholders, validate jurisdictional coverage, and publish through the appropriate channel.
  • Record of Processing Activities TemplatePrivacyThis template defines the structure of a Record of Processing Activities (ROPA) sufficient to satisfy GDPR Article 30 and equivalent record-keeping obligations under UK GDPR, LGPD, PIPL, and similar privacy regimes. Under PIPEDA, a ROPA is not a mandated statutory record but serves as accountability evidence supporting the Act's openness and accountability principles. It provides separate field sets for the controller view and the processor view. Adopting organizations populate one row per processing activity per controller or processor role.
  • Transfer Impact Assessment (TIA) TemplatePrivacyThis template is the instrument that records and evidences a Transfer Impact Assessment (TIA): the documented assessment an organization completes before transferring personal data to a third country in reliance on an Article 46 transfer tool, to confirm that the tool secures, in the destination country, a level of protection essentially equivalent to that guaranteed within the EEA. It operationalizes the six-step methodology in the EDPB Recommendations 01/2020 on measures that supplement transfer tools (attributed; the methodology is articulated by the European Data Protection Board, not reproduced verbatim here) and evidences compliance with GDPR Chapter V (Regulation (EU) 2016/679, Articles 44 to 49).
  • Departmental Continuity Plan TemplateResilienceThis template provides a reusable structure for documenting departmental or function-level continuity plans. It must be adapted by adopting organizations and must not be populated in the public repository with real department names, people names, contact details, system names, supplier names, locations, customer names, or recovery evidence.
  • Lessons Learned TemplateResilienceThis template defines the format of a lessons-learned report produced after a significant event: a real incident, a tabletop exercise, a recovery test, a regulatory inspection, or a major change with material disruption. The lessons-learned report is the durable record that drives systemic improvement; it is distinct from a single-domain post-incident review (PIR) in that it integrates findings across response streams and feeds the corrective action register.
  • Recovery Runbook TemplateResilienceThis template defines the structure of a recovery runbook for a single in-scope service, application, or platform. Each in-scope service has its own runbook instantiated from this template. The runbook is the authoritative operating document used by the recovery team during a degraded or failed state. It is not a strategy document; it is operational.
  • Tabletop Exercise TemplateResilienceThis template defines a reusable structure for designing, running, and learning from tabletop exercises. It supports the resilience testing programme by providing the scenario template, injects schedule, evaluation criteria, and after-action format that the Resilience Owner uses to commission each exercise. Adopting organizations select a scenario, populate the placeholders, and run the exercise.
  • Board Risk Report TemplateRiskThis template structures the periodic risk report delivered to the board (or its designated risk-oversight committee). It expresses what the board should see, how it should be expressed, and how it should be cross-linked to source-of-truth registers, while remaining concise enough for board consumption.
  • Enterprise Risk Register TemplateRiskThis template defines the schema, field definitions, population guidance, and governance requirements for the organization's enterprise risk register. The register is the primary instrument for tracking identified risks, their assessment scores, treatment plans, residual risk, and monitoring obligations across all risk categories.
  • Operational Risk Register TemplateRiskThis template structures the operational risk register that an organization maintains at the business-process and business-unit level. The operational risk register complements the enterprise risk register (which captures top-of-the-house risk) by capturing the risk-and-control state inside operational processes.
  • Risk Appetite Statement TemplateRiskThis template defines the structure for the organization's Risk Appetite Statement (RAS). The RAS translates the Board's strategic risk tolerance into measurable thresholds and qualitative statements that guide risk identification, assessment, treatment, and acceptance decisions across the enterprise.
  • Supplier Offboarding Evidence TemplateSupply chainThis template defines the evidence record produced at supplier offboarding to demonstrate that access has been revoked, organizational data has been returned or destroyed, residual obligations are documented, and the relationship has closed cleanly. The record is the auditable trail required by GDPR Article 28, DORA exit-strategy obligations, sector regulators, and the supplier exit procedure.
  • Supplier Security QuestionnaireSupply chainThis questionnaire is issued to suppliers and third-party service providers to gather information about their information security and privacy controls. Responses are used to assess whether the supplier meets the organization's requirements under supply-chain/standard-supplier-security-and-privacy-assurance.md.

Adopter documents, 4

The 4 adopter documents of this type, under docs/ and outside the corpus taxonomy; each entry is read from the leading metadata block of its file at build time. Each title opens the document's page, which holds the record and, where the document has them, its outline and related documents.

  • Adopter Implementation Roadmap TemplateAdopter documentsThis template helps an adopter sequence the modules selected via docs/template-startup-roadmap.md into 90-day, 180-day, and one-year phases. The roadmap is composition-aware: it does not assume a fixed adopter profile, it works from the modules the adopter actually picked.
  • Adopter Maturity Self-Assessment TemplateAdopter documentsThis template is a guided self-assessment that lets an adopting organization score its own programme maturity per library domain and overall. The result is a programme-shaped picture of where the adoption is mature and where it is shallow, with concrete next-step guidance per tier.
  • Adopter Quickstart TemplateAdopter documentsA 10-minute on-ramp for an adopter who wants to take a defensible starting set from the library today. This quickstart names the minimum viable adoption; the deeper composition workbook lives in docs/template-startup-roadmap.md.
  • Adopter Startup Roadmap TemplateAdopter documentsThis template helps an adopter compose a starting set of library artefacts from a small core baseline plus stacking modules. The composition matches what the organization actually does (its activities, data scope, audience, regulatory exposure, and GRC team capacity), rather than a pre-set profile by company size or sector.

With script, All Documents, filtered to Templates, lists the 34 of this page's 38 documents that sit in a corpus area, and the area chips holding any of them, and its text filter, narrow them further.