Five minutes before you start
Three small things make everything afterwards work properly. Do them before you touch the substance.
Open 24. Config and enter real names
Replace the generic role titles with the actual people in your organisation. Every Owner dropdown across all 27 sheets reads from this one list, so it is the only place you ever set it.
Learn the two cell colours
Pale yellow means you fill it in. Grey means the workbook calculates it. If you overtype a grey cell you break a formula that something else depends on.
Enable editing and macros are not needed
There are no macros. If your version of Excel opens the file read-only, choose Enable Editing. Everything runs on standard formulas, so it works in Excel, LibreOffice and Google Sheets.
How the workbook talks to you
The whole file uses one visual convention. Once you can read it, you can navigate any sheet without instructions.
Your input
A fact only you know: a system name, an owner, a status, a date, a score. Dropdowns appear wherever the answer comes from a fixed set.
Calculated
Derived from what you entered, often on another sheet. Risk tiers, deadlines, completion percentages, ageing flags. Never overtype these.
Status flags
Applied automatically so problems surface without being hunted for.
The order to work in
Each phase makes the next one possible. Skipping ahead is the most common way these programmes fail: controls with no inventory behind them cannot be traced to anything.
Scope: know what you have
Week 1List every AI system, including shadow AI and the AI quietly embedded in tools you already buy. Answer seven questions per system and the workbook derives the risk tier, the compliance deadline and the control load for you. Your real inventory is always larger than your official one, so sweep before you assume.
Mark the markets you operate in. Each regime then flags as Applies, Monitor or Not in scope, with its dates, penalty exposure and the specific crosswalk capabilities that satisfy it. This is where nineteen sets of obligations collapse into one control set.
Use this for a single system when you need a fast answer rather than a portfolio view. It assembles an obligation profile at the bottom: your role, the regime, the deadline, whether agentic controls apply.
Map: design one control set
Weeks 2–4The master map, and the reason the toolkit exists. Each row is one capability with the single artifact that evidences it across all three frameworks at once. Design your controls from this sheet and you build once instead of three times.
Which companion standard fills which gap. Referenced by number, clause and intent only, so you will still need licensed copies to implement against.
The depth the management frameworks deliberately leave out. Prompt injection, excessive agency, model poisoning and the rest, each mapped back to the crosswalk row that owns it. Give this sheet to your security team.
If you are in financial services, life sciences, insurance, HR, healthcare or the public sector, this is what stacks on top. Sector rules rarely replace AI law; they add to it.
Operate: do the work
Months 1–6Your backlog. Assign an owner, a status and a target date to each item. This one sheet drives most of the dashboard, the Gap Report and the Owner View, so time spent here pays back everywhere else.
Nothing to fill in. Every open P1 foundation appears here automatically, in order, and drops off when you mark it complete. This is what you take to a steering meeting.
Pick a person from the dropdown and see only their outstanding items. Send it to them as their to-do list rather than asking them to search a 260-row sheet.
Where the artifacts the crosswalk names actually live: Risk Register with calculated inherent and residual ratings, Impact Assessment for FRIA and DPIA records, Statement of Applicability, Incident Log, Vendor Register, Training Records for the AI-literacy duty, and Model Cards. The RACI flags any activity that does not have exactly one accountable owner.
Prove: show it works
OngoingThe artifact-to-control index, and the first sheet an auditor should see. Evidence past its review date is flagged Stale automatically, because governance that was true last year is not evidence today.
Score honestly against the five-level model. The radar chart shows your profile against the Level 3 target, which is the point at which a programme becomes genuinely defensible.
KPIs and KRIs on one printable page, several pulling automatically from your working sheets. Report the risk indicators every meeting and the performance indicators quarterly.
The 30 / 60 / 90 / 180-day plan with an exit test for each phase, so you know when you are genuinely finished rather than merely busy.
What updates on its own
You should never type the same fact twice. Enter something once and it flows everywhere it is needed.
The Command Center tells you what to do next
It is not only a dashboard. A guidance line changes as you progress: with an empty file it says start with the inventory; once foundations are open it names how many and sends you to the Gap Report; past Level 3 it moves you on to assurance and conformity preparation.
One system, end to end
A European bank putting a credit-scoring model into production. Five minutes of input, and the workbook does the rest.
- Name it
Credit Scoring Model, give it a purpose and an owner from the dropdown. - Q1 Build or buy →
Building. Q2 Uses a foundation model →Yes. - Q3 Annex III use case →
Essential services / credit. Q4 Embedded in a regulated product →No. - Q5 EU market exposure →
Yes. Q6 Regulated sector →Financial services. Q7 Agentic →No. - Stop typing. The three grey columns fill themselves.
Keeping it honest
A governance file that is filled in once and never reopened is documentation, not governance. This is the minimum cadence.
Work the Gap Report
Ten minutes. Move P1 items forward, and add anything new that surfaced.
Sweep for new systems
Shadow AI arrives continuously. Check the inventory against reality, and clear overdue reviews.
Re-verify the Atlas
Re-score maturity, refresh the Board Pack, and check the jurisdiction dates against primary sources.
Review the whole file
Record it on the Version Log. Auditors ask when a governance artifact was last reviewed, and by whom.
What people ask
Do I need all 27 sheets?
No. The minimum viable path is four: AI Systems, Jurisdiction Atlas, Checklist and Gap Report. Everything else supports those or proves them. Start there and let the rest earn its way in.
Will it work in Google Sheets or LibreOffice?
Yes. Every formula avoids Excel-only functions for exactly this reason. Charts and conditional formatting may render slightly differently, but nothing breaks and no macros are used.
How many AI systems can it hold?
Sixty in the inventory as shipped, which suits a single team or business unit. Beyond a few hundred systems, or with many people editing at once, you have outgrown a spreadsheet and should move to a GRC platform. Use the workbook as the specification for configuring it.
How current are the regulatory dates?
Every date in the Jurisdiction Atlas was verified in August 2026. Two entries show why that matters: Colorado repealed and replaced its 2024 AI Act, and Canada's AIDA died in Parliament and was never reintroduced. Re-verify against primary sources before you act, and log the check.
Does it reproduce the ISO standards?
No, deliberately. ISO/IEC standards are copyrighted. Everything here refers to them by number, clause and intent in original words. You need licensed copies to implement against, and the toolkit tells you which ones and why.
Can I use it with clients or inside a product?
Use it freely inside your own organisation, including on client work you deliver yourself. Reselling it, redistributing it as your own, or white-labelling it into a commercial product needs written permission.
Get the toolkit
One Excel file. No macros, no sign-up wall inside the file, nothing phoning home. Free to use inside your organisation.
Download the Enterprise AI Governance Toolkit (.xlsx)Version and updates. This is a living tool, not an archived document, so it is versioned rather than given a DOI. The current release always lives at akhawat.com/toolkits. The companion article and its guidance crosswalk are archived separately at DOI 10.6084/m9.figshare.33137024.
Not legal advice. This toolkit is an educational and operational reference. AI regulation moves faster than any static file. Verify against primary sources for your own jurisdiction, and take professional advice before making compliance decisions.
Licence. © 2026 Prashant Akhawat. Free to use and adapt inside your own organisation. Not for resale, redistribution or white-labelling without written permission.