Deliverable Templates
Turn "we need compliance" into a document you can start filling in today
23 templates. Each says what to write, what evidence to attach, which obligation or standard it answers and where reviewers usually push back. Download the Markdown skeleton without signing up.
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.
Impact assessment4
GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference
Completed and filed before launching processing "likely to result in a high risk to the rights and freedoms of natural persons", to satisfy GDPR Art. 35 and to serve as the first document produced in a regulator enquiry, customer due diligence or an Art. 36 prior consultation. In AI settings it does a second job: answering, once and in one place, which personal data went into training, on what lawful basis, and how data subjects can exercise their rights.
EU AI Act Article 27 Fundamental Rights Impact Assessment (FRIA)
Completed by the **deployer** of a high-risk AI system before first use, assessing the impact its use may produce on fundamental rights, with the results notified to the market surveillance authority. Chinese companies meet it in two ways: either they have an EU entity that deploys a third-party high-risk system internally (in which case they are the deployer), or their customer is caught by Art. 27 and passes the inputs a FRIA needs down the chain as a pre-contract condition. This template works through the six elements of Art. 27(1)(a)–(f) and adds applicability, the DPIA interface, notification and update.
Personal Information Protection Impact Assessment (PIPIA) report
Carried out in advance in the five situations listed in Art. 55 of the Personal Information Protection Law and containing the matters required by Art. 56, then retained with the processing records for at least three years. For AI companies it is the common base document for three arguments at once: using sensitive personal information in model training, recommendation or risk-control amounting to automated decision-making, and calling an offshore model API amounting to an outbound transfer. GB/T 39335-2020, the recommended national standard on personal information security impact assessment, supplies a methodology, but the report is structured around the three statutory elements in Art. 56.
Double materiality assessment workpaper (CSRD / ESRS basis)
Documents a reviewable double materiality assessment: impact materiality (the undertaking’s effects on people and the environment) and financial materiality (the effects of sustainability matters on the undertaking), and derives the disclosure list from it. For most Chinese AI companies the first use of this workpaper is not reporting under the CSRD themselves but answering EU customers’ supplier enquiries — it evidences that an assessment was performed and it grounds the negotiation over what information you are entitled to withhold.
Technical documentation4
EU AI Act Annex IV technical documentation for a high-risk AI system
Drawn up under Art. 11(1) and Annex IV and kept up to date before the system is placed on the market; it is the precondition for conformity assessment (Art. 43), the EU declaration of conformity (Art. 47) and CE marking, and the first pack a market surveillance authority calls for under Art. 74(12). The structure mirrors the nine Annex IV items exactly, because reviewers check item by item and a missing item is a formal failure. Note that the second subparagraph of Art. 11(1) was replaced by Art. 1(10) of Regulation (EU) 2026/1744 (the AI Omnibus), adding a simplified route: SMEs including start-ups, and small mid-cap companies, may provide the Annex IV elements in a simplified manner, for which the Commission is to establish a simplified technical documentation form targeted at their needs; a company opting for the simplified route must use that form, and notified bodies must accept it for the conformity assessment. Most Chinese companies going abroad fall in that bracket, but as at the review date of this corpus you must confirm with the AI Office or your notified body whether the form has actually been published — until then, prepare the full Annex IV content and do not trim to a simplified format you have only heard about.
Public Summary of Training Content for a general-purpose AI model (EU official template)
Under Art. 53(1)(d) of the EU AI Act, every provider placing a general-purpose AI model on the Union market must draw up and make publicly available a "sufficiently detailed" summary of the content used for training, following the template provided by the AI Office — including models released under free and open-source licences, since the Art. 53(2) open-source exemption does not extend to this obligation. This template mirrors the official section numbering (1.1–1.3, 2.1–2.6, 3.1–3.3) so it can be filled in directly, and flags at each section the points rightsholders and regulators press on.
Model Card
A model description for downstream integrators, enterprise customers and internal governance. No single law requires a "model card" as such, but it is the most economical vehicle for several statutory duties at once: Annex XII of the EU AI Act (the Art. 53(1)(b) transparency information for downstream providers integrating the model into their AI systems), the publishable part of Annex XI (the Art. 53(1)(a) technical documentation), the Art. 13 instructions for use for deployers, and the technical underpinning of the Art. 50 transparency duties. A good model card also shortens customer security questionnaires materially in the EU, Singapore and Japan. Methodologically it can draw on ISO/IEC 42001 for AI management systems, ISO/IEC 23894 for AI risk management and the NIST AI Risk Management Framework, though all are voluntary and create no presumption of conformity.
Data Card — datasheet for a training, validation or test dataset
A per-dataset datasheet answering where the data came from, whether it may be used, what is inside it, how it was processed and what biases it carries. It serves four duties directly: Annex IV item 2(d) of the EU AI Act, which calls for datasheets describing training methodologies and techniques and the training datasets used; the Art. 10 data-governance requirements for high-risk systems; the working basis for the Art. 53(1)(d) public training-content summary; and Arts. 7 and 8 of China’s Interim Measures for Generative AI Services on lawful data sources and labelling governance. A well-made data card feeds the DPIA, the PIPIA, the filing pack and customer diligence at once, and is the most reusable document in this set.
Transfer assessment2
Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses
Completed before transferring personal data to a third country under a Chapter V Art. 46 tool — in practice the (EU) 2021/914 standard contractual clauses — to support the warranty in Clause 14(a) and to satisfy Clause 14(d), under which the parties agree to document the assessment and make it available to the competent supervisory authority on request. For companies moving EU personal data to China, or giving China-based teams remote access to EU data, this is the document EU customers almost always ask for; vague drafting stalls deals, while a solid version can be reused across customers. The structure crosses the three elements of Clause 14(b) with the six steps of EDPB Recommendations 01/2020.
Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)
Under Art. 5 of the Measures for the Security Assessment of Outbound Data Transfers, a data processor must run its own risk self-assessment before filing; the self-assessment report is item 7 of the application pack listed in the CAC filing guide and the first document called for in any subsequent interview, inspection or re-assessment. Annex 4 of the guide fixes a four-part structure for the report; this template adds a threshold determination at the front and re-filing triggers at the back, so a company can work from "do we have to file at all" through to "what makes us file again". **Precondition for use: the structure here is taken from Annex 4 of the first edition of the filing guide (31 Aug 2022), which is the edition actually downloaded in this round. The CAC Q&A of July 2026 already cites a third edition, whose text was not obtained. Use this template to organise materials and self-check, but confirm the current edition’s forms and requirements with your provincial cyberspace authority before filing; and test the filing thresholds solely against the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows, never against the older thresholds stated in the first-edition guide.**
Filing package2
Filing pack for generative AI services and algorithm filing, including the security assessment report
For companies offering generative AI or algorithmic recommendation services in China, this settles in one place whether filing is required, what goes in, when, and what follows. The statutory path: Art. 17 of the Interim Measures for the Management of Generative AI Services requires a provider of generative AI services with public-opinion attributes or social-mobilisation capability to carry out a security assessment under the applicable national rules and to complete algorithm filing, amendment and cancellation under the Provisions on the Management of Algorithmic Recommendations in Internet Information Services; Art. 24 of those Provisions sets the deadline and the fields to be filed; and Art. 12 of the Measures for Labelling AI-Generated Synthetic Content requires labelling materials to be supplied when completing filing and security assessment. The security assessment report is structured on Arts. 5 and 6 of the Provisions on the Security Assessment of Internet Information Services with Public Opinion Attributes or Social Mobilisation Capability.
Investor ESG due diligence pack (for fundraising and pre-IPO)
Organises what investors ask for in ESG and compliance diligence into a data room structure you can open directly: the governance and compliance base, AI and data compliance, carbon and environment, people and labour, supply chain, litigation and penalties, and commitments with remediation plans. The aim is to turn diligence from a company-wide scramble for every new investor into "open the relevant folder and fill the questionnaire gaps", while avoiding over-exposure of sensitive information along the way.
Governance record3
AI incident and serious incident reporting record (register plus report drafts)
A document maintained in peacetime and used the moment something goes wrong: an AI incident register day to day, and the working draft for every reporting duty during an incident. It must satisfy several regimes with very different clocks — Art. 73 of the EU AI Act on serious incidents (15 days / 10 days / 2 days), GDPR Art. 33 on the 72-hour breach notification and Art. 34 on informing data subjects, Art. 10 of China’s Network Data Security Management Regulations on the 24-hour report where national security or the public interest is endangered, Art. 27 of the Cybersecurity Law on emergency plans and reporting, and Art. 14 of the Interim Measures for Generative AI Services on handling and reporting unlawful content. The shortest clock dictates the design of the whole process: there is no time to draft from scratch during an incident, so the determinations, templates and contacts must exist beforehand.
SOC 2 Type II readiness checklist (Trust Services Criteria)
Breaks "obtain a SOC 2 Type II report your customers will accept" into schedulable work: how to fix the scope and criteria categories, how to write the system description, how to build the control matrix, how to generate evidence continuously across the coverage period, how to select the firm, how to handle exceptions, and how to maintain the report once issued. Aimed at Chinese vendors whose main market is North American enterprises and whose contracts require an annual Type II report covering the trailing twelve months.
Third-party sustainability assurance readiness checklist (starting from limited assurance)
A readiness checklist for companies taking sustainability information through external assurance for the first time: how to set the assurance scope, choose the applicable criteria and standard, close internal control and evidence gaps, select the practitioner, prepare for fieldwork, handle findings, and state the assurance conclusion correctly in the report. Aimed at Chinese AI companies driven by exchange rules or asked by customers and investors for assured data.
Disclosure report4
ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outline
Turns the four-pillar structure of IFRS S1 and IFRS S2 (governance, strategy, risk management, metrics and targets) into a report skeleton you can start filling in immediately, so that one drafting effort serves HKEX Appendix C2 Part D, the mainland exchanges’ sustainability reporting guides and overseas customer or investor questionnaires, instead of re-cutting the same data three times.
Greenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)
Breaks the GHG Protocol requirements into a workpaper structure your finance or EHS colleagues can fill in directly: how the boundary is drawn, where activity data comes from, how factors are selected, how calculations are evidenced, and how figures are recalculated when the basis changes. These workpapers are both the data source for external disclosure (ISSB, HKEX Appendix C2, exchange guides, customer questionnaires) and the first file an assurance practitioner will ask for.
HKEX ESG report outline (Listing Rules Appendix C2, including Part D climate disclosures)
Gives issuers listed or listing in Hong Kong a report outline that maps section by section to Appendix C2: the Part B mandatory disclosures, the Part C comply-or-explain environmental Aspects A1–A4 and social Aspects B1–B8, and the Part D climate-related disclosures. The outline marks what is mandatory, what may be explained, and which indicators were repealed in the version effective 1 January 2025, so that old templates do not produce reports containing retired KPIs.
Sustainability report outline for issuers on the Shanghai, Shenzhen and Beijing exchanges (aligned to the MOF Basic Standard)
Gives AI companies listed or listing in mainland China a report outline aligned to the exchanges’ sustainability report preparation guides and to the Ministry of Finance Basic Standard for corporate sustainability disclosure, and explains how one set of underlying ledgers can serve the domestic basis, the ISSB investor basis and EU customer enquiries at the same time, instead of re-compiling the same electricity, water and waste data repeatedly.
Questionnaire response3
Customer security and privacy questionnaire answer bank (grouped by CAIQ / CCM domains)
Turns the security and privacy questionnaire that has to be re-answered for every deal into a reusable, auditable, version-controlled internal answer bank: grouped by the domains of the Cloud Controls Matrix (CCM), each group gives the skeleton of how you should answer, the evidence to attach, and the follow-up questions buyers most often ask. The aim is to cut response time from weeks to days while ensuring every answer is supported — an answer bank is not a script library, and an answer you cannot evidence does not belong in it.
Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)
Turns the compliance material repeatedly demanded in bids into a standard-parts library that can be assembled quickly: eligibility and exclusion-ground declarations, financial and technical capacity evidence, management system and environmental management certificates, the data protection and security exhibit, AI-related declarations, subcontracting and reliance-on-other-entities arrangements, and sustainability and social responsibility commitments. The goal is to turn the compliance half of a bid from a company-wide scramble into "pull the parts from the list and tailor to the buyer".
Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)
The users of this template are your own procurement and legal teams: use it on compute providers, data labelling vendors, contract manufacturers, SaaS tools and channel subcontractors. It has two design goals — to pass on effectively the supply chain due diligence duties that downstream customers (EU enterprises, financial institutions, listed companies) impose on you, and to give you ready evidence of what you do about your own supply chain when a customer audits you, rather than assembling it under time pressure. Apply it by risk tier; do not send the same questionnaire to every supplier.
Internal policy1
ISO/IEC 42001 AI management system implementation and certification readiness checklist
Breaks the Clause 4–10 requirements and Annex A control domains of ISO/IEC 42001 into a schedulable build list: how to set the scope, write the AI policy and assign responsibilities, run AI risk assessment and AI system impact assessment, compile the Statement of Applicability, implement life-cycle and data governance controls, run internal audit and management review, and prepare for the certification audit. For a Chinese AI company the commercial value is twofold: it is an increasingly common entry ticket in Western customers’ AI due diligence, and it is the skeleton that organises existing compliance outputs — algorithm filings, security assessments, model evaluations — into an internationally readable system.