Your environment or ours. Self-hosted, air-gapped or hosted.
Discover it. Measure it. Govern it. Build it responsibly.
Try the demo Book a briefing

Shield360 › NAIC & ISO 42001 toolkits

Free NAIC AI & ISO 42001
toolkits

Editable workbooks and templates for the NAIC AI Risk Evaluation Supplement (Exhibits A to D) and an ISO/IEC 42001 AI management system, with a crosswalk that maps one to the other, to the NIST AI RMF and to the EU AI Act. Excel and Word files you can fill in without Shield360.

Excel and Word Free under CC BY 4.0 NAIC v6.0 exposure draft, Oct 16, 2026
Get the toolkits Or fill them in online
NAIC AI Risk Evaluation ToolkitInsurers

Based on the AI Risk Evaluation Supplement v6.0 exposure draft of October 16, 2026. We will update it after the NAIC votes on the final text.

  • Exhibit A inventory counts workbook: the 13 operation areas, by Generative AI, Agentic AI, GLMs and other AI/ML
  • AI system inventory register with the columns Exhibit A asks for
  • Exhibit B in both forms: the Checklist (1, 2, 2a–2c, 3a–3p) and the Narrative, each item with evidence prompts
  • Exhibit C high-risk model dossier: items 1 to 14, including 3a and 10a
  • Exhibit D data elements register: the 25 data element types, sourced internally or from a third party
  • Consumer-impact risk tiering worksheet
  • Vendor oversight questionnaire
  • Model testing and validation log
  • A README on how to use the files
ISO/IEC 42001 AIMS Starter KitAny sector

For an AI management system you mean to certify, or simply run well. Control titles are paraphrased; use your licensed copy of the standard.

  • Statement of Applicability workbook: all 38 Annex A controls
  • AI risk register
  • AI system impact assessment template
  • AI policy template
  • Internal audit checklist
  • Management review agenda and minutes
  • Nonconformity and corrective action log
  • Evidence plan: what an auditor will ask to see, control by control

Both downloads include the crosswalk: a workbook mapping NAIC Exhibit B to ISO/IEC 42001 Annex A, the NIST AI RMF and the EU AI Act, so one piece of work can answer several frameworks.

Online workbook

Prefer to fill it in here?

The same templates as forms in your browser: Exhibits A to D, risk tiering, vendor oversight, an ISO/IEC 42001 Statement of Applicability and an AI risk register. Print each section or save it as a PDF. Exhibit A counts, risk tiers and SoA status are calculated as you go.

Your answers stay in your browser. Nothing you type in the workbook is sent to Shield360 or anyone else; save a backup file to keep it or move it to another computer. The workbook opens once you have requested the toolkit below.

Open the online workbook

Download the toolkits

Where should we point the download?

Use your work email. The download links appear here as soon as you send the form.

Which toolkit?

We keep your name, email, company, role, the toolkit you chose and the page or campaign that brought you. Privacy policy

How Shield360 fills these in

The same records, kept as you work

The templates stand on their own. If you would rather keep the records in a system, these are the parts of Shield360 that hold them:

  • An NAIC profile for each AI system in the AI inventory: operation area, model type and an inherent risk tier from your own materiality threshold and criteria, with its reasons and an analyst's override
  • The Exhibit B Checklist and Narrative, answered from your recorded program, governance bodies and training, exported as PDF, HTML, CSV or JSON
  • Exhibit D from the dataset registry: the data element types each dataset holds, where they come from, and a data dictionary
  • Model testing records for Exhibit C items 10 to 14: validations, drift, material changes, compliance reviews, regulatory actions and consumer complaints, signed off by a second person
  • Third-party vendor oversight: contracts, due diligence, assurance reports and review dates
  • An ISO/IEC 42001 Statement of Applicability for all 38 Annex A controls, status from observed evidence kept as a daily history, and signed evidence packages an auditor verifies offline

Shield360 records what your company declares and observes. Your company reviews what it submits; nothing here is a statement that you comply with any law, bulletin or standard.

License and limits

The templates are free to use, adapt and share under CC BY 4.0, with attribution to Shield360. Consultants may rebrand them for clients as long as the attribution stays.

They are not legal advice. NAIC item wording is paraphrased: complete your response against the official NAIC text. ISO/IEC 42001 control titles are paraphrased: use your licensed copy of ISO/IEC 42001:2023. Shield360 is not affiliated with or endorsed by the NAIC or ISO.