Templates and schemas, as code.

24 JSON Schemas for the records AI governance produces, each with a filled example that validates and a human template with the same fields, plus a policy kit of 6 organisation-level templates. Every field that helps evidence an obligation says which one, so a record drops into the evidence store and the audit becomes a query.

How the library fits together

One record per lifecycle step, all filed against the same key: the registry id and version of the system (id@version). The shapes published in the patterns chapter (registry entry, verdict, eval result, evidence record) validate against these schemas, and the site build checks that on every release.

Intake and inventory use-case-recordclassification-decision-recordai-system-register-entryagent-register-entryimpact-assessmentvendor-due-diligence-response
Design and data design-recorddataset-cardmodel-carddataset-admission-record
Test and evaluate test-planeval-resulttest-report
Release and deploy go-no-goinstructions-for-usedeployment-decision-record
Operate and monitor post-market-monitoring-planrisk-register-entryincident-recordcontrol-observation
Retire decommissioning-runbook
Organisation-wide policy-cardtraining-recordevidence-record

Schemas, by lifecycle stage

Each row gives the schema (JSON Schema draft 2020-12¹⁰), a filled example that validates against it, and a Markdown template with the same fields and short guidance. The examples follow two de-identified systems: a customer-service agent and an in-house credit affordability model.

Intake and inventory

Admit a use, register what runs, assess its impact, check the supplier.

Record	Purpose	Evidences	Patterns	Layer	Files
Use-case record use-case-record.v1.json 18 fields, 7 required	The intake record for a proposed AI use: the problem, the intended purpose and its limits, who is affected, whether AI is the right tool, the preliminary classification and which assessments it triggers.	`EU AI Act Art. 6` `EU AI Act Art. 9(2)` `EU AI Act Art. 27` `GDPR Art. 35` `ISO/IEC 42001 A.5` `ISO/IEC 42001 A.6` `NIST AI RMF MAP 1.1` `NIST AI RMF MAP 3.3`	FRIA-as-Code Agent Registry Use-Case Intake & Risk Tiering	L1 · L2	Schema Example Template
Classification decision record classification-decision-record.v1.json 14 fields, 14 required	The recorded EU AI Act triage of one AI system or model: the question set and version it was answered against, every answer with its article and meaning, the indicative scope, operator roles and risk classes with their reasons, the high-risk screen with the Art.	`EU AI Act Art. 6(3)` `EU AI Act Art. 6(4)` `EU AI Act Art. 49(2)` `EU AI Act Art. 25` `EU AI Act Art. 2` `EU AI Act Art. 5` `EU AI Act Art. 50` `EU AI Act Art. 52`	Policy Card Agent Registry	L1 · L2	Schema Example Template
AI system register entry ai-system-register-entry.v1.json 22 fields, 5 required	One entry in the inventory of AI systems and models: who owns it, what it may do, how it is classified and where its evidence lives.	`EU AI Act Art. 49` `EU AI Act Art. 71` `EU AI Act Art. 6` `EU AI Act Art. 26` `ISO/IEC 42001 A.4` `ISO/IEC 42001 A.6` `NIST AI RMF GOVERN 1.6`	Agent Registry Shadow-AI Discovery	L2	Schema Example Template
Agent register entry agent-register-entry.v1.json 23 fields, 5 required	One entry in the agent registry: a non-human actor with an owner, a declared scope, a workload identity, bounded tools and a kill switch.	`EU AI Act Art. 14` `EU AI Act Art. 12` `EU AI Act Art. 26` `ISO/IEC 42001 A.6` `ISO/IEC 42001 A.9` `NIST AI RMF GOVERN 1.6` `NIST AI RMF MANAGE 2.4`	Agent Registry Agent Identity & Scoped Credentials Kill Switch / Circuit Breaker	L2 · L4	Schema Example Template
Impact assessment impact-assessment.v1.json 24 fields, 8 required	One schema for three assessments, told apart by `type`: an AI system impact assessment (aiia), an AI addendum to a data protection impact assessment (dpia_addendum) and a fundamental rights impact assessment (fria).	`EU AI Act Art. 27` `EU AI Act Art. 27(1)` `EU AI Act Art. 27(3)` `EU AI Act Art. 27(4)` `GDPR Art. 35` `GDPR Art. 35(7)` `ISO/IEC 42005` `ISO/IEC 42001 A.5` `NIST AI RMF MAP 5.1`	FRIA-as-Code	L1 · L2	Schema Example Template
Vendor due-diligence response vendor-due-diligence-response.v1.json 9 fields, 6 required	A supplier's answers to the AI due-diligence questionnaire for one product, keyed to the obligations they help the buyer evidence, plus the buyer's assessment and reassessment date.	`EU AI Act Art. 25` `EU AI Act Art. 26` `EU AI Act Art. 53(1)(b)` `GDPR Art. 28` `ISO/IEC 42001 A.10` `NIST AI RMF GOVERN 6.1` `NIST AI RMF MANAGE 3.1`	Vendor / Model Due-Diligence Gate	L2 · L5	Schema Example Template

Design and data

Record the design decisions and let only documented data into the pipeline.

Record	Purpose	Evidences	Patterns	Layer	Files
Design record design-record.v1.json 14 fields, 7 required	The design review of one AI system version: requirements traced to their source, the model-selection trade-off, the oversight and logging designed in, and the metrics and thresholds the release will be judged on.	`EU AI Act Art. 9` `EU AI Act Art. 11` `EU AI Act Annex IV` `EU AI Act Art. 12` `EU AI Act Art. 14` `EU AI Act Art. 15` `ISO/IEC 42001 A.6` `NIST AI RMF MAP 1.6` `NIST AI RMF MAP 3.5`	Human-in-the-loop Gate Kill Switch / Circuit Breaker Eval Gate in CI	L1 · L3	Schema Example Template
Dataset card dataset-card.v1.json 19 fields, 9 required	The card that travels with a dataset: what it contains, where it came from, the right to use it, how representative it is, how it was checked and when it must be deleted.	`EU AI Act Art. 10` `EU AI Act Art. 4a` `EU AI Act Art. 53(1)(d)` `GDPR Art. 6` `GDPR Art. 9` `ISO/IEC 42001 A.7` `NIST AI RMF MAP 4.1`	AIBOM Model Card as Control Evidence Training-Data Rights Ledger	L2	Schema Example Template
Model card model-card.v1.json 51 fields, 3 required	A model or system card as a record: what the model is, what it is for and not for, the data it was built and tested on, how it performs across groups and conditions, its limits, and the links to the rest of the technical file.	`EU AI Act Art. 11` `EU AI Act Annex IV` `EU AI Act Art. 13` `EU AI Act Art. 53(1)(a)` `EU AI Act Art. 53(1)(b)` `ISO/IEC 42001 A.6` `ISO/IEC 42001 A.8` `NIST AI RMF MAP 1.1` `NIST AI RMF MEASURE 2.1`	Model Card as Control Evidence AIBOM	L2	Schema Example Template
Dataset admission record dataset-admission-record.v1.json 12 fields, 7 required	The verdict of the dataset admission gate: whether one dataset version may enter one pipeline, which checks ran and who or what decided.	`EU AI Act Art. 10` `ISO/IEC 42001 A.7` `NIST AI RMF MAP 4.1` `NIST AI RMF MEASURE 2.1`	Eval Gate in CI AIBOM Dataset Admission Gate	L3	Schema Example Template

Test and evaluate

Fix thresholds before testing, then file every result against the version tested.

Record	Purpose	Evidences	Patterns	Layer	Files
Test plan test-plan.v1.json 13 fields, 5 required	What will be tested before a release and how the release will be judged: suites by category, each with its metric, threshold and failure mode, set before testing starts.	`EU AI Act Art. 9(6)` `EU AI Act Art. 9(8)` `EU AI Act Art. 15` `EU AI Act Art. 60` `ISO/IEC 42001 A.6` `NIST AI RMF MEASURE 2.1` `NIST AI RMF MEASURE 2.11`	Eval Gate in CI Adversarial Red-Team Suite	L3	Schema Example Template
Eval result eval-result.v1.json 14 fields, 6 required	The structured result of one eval suite run against one system version, filed against its registry entry.	`EU AI Act Art. 15` `EU AI Act Art. 9(8)` `EU AI Act Art. 55` `ISO/IEC 42001 A.6` `NIST AI RMF MEASURE 2.3` `NIST AI RMF MEASURE 2.5`	Eval Gate in CI Adversarial Red-Team Suite Fairness Eval Suite	L3	Schema Example Template
Test report test-report.v1.json 12 fields, 6 required	The dated, signed report of a test campaign: the eval results against the plan, deviations and waivers, and the conclusion the go/no-go reads.	`EU AI Act Annex IV(2)(g)` `EU AI Act Art. 9(8)` `EU AI Act Art. 15` `ISO/IEC 42001 A.6` `NIST AI RMF MEASURE 2.3` `NIST AI RMF MEASURE 2.13`	Eval Gate in CI Adversarial Red-Team Suite	L3	Schema Example Template

Release and deploy

Decide on evidence, tell deployers how to use it, check deployer duties.

Record	Purpose	Evidences	Patterns	Layer	Files
Go/no-go decision go-no-go.v1.json 11 fields, 6 required	The release gate for one system version: a checklist whose items name the obligation they evidence and the record that proves them, the reviewers' decisions by role, any overrides, and the rollout and rollback plan.	`EU AI Act Art. 9` `EU AI Act Art. 17` `EU AI Act Art. 43` `ISO/IEC 42001 A.6` `NIST AI RMF MANAGE 1.1` `NIST AI RMF MANAGE 1.4`	Eval Gate in CI Human-in-the-loop Gate Staged Rollout with Rollback Criteria	L3 · L5	Schema Example Template
Instructions for use instructions-for-use.v1.json 16 fields, 8 required	The information a provider gives deployers so they can use a high-risk system correctly, one field per element the EU AI Act lists for instructions for use.	`EU AI Act Art. 13` `EU AI Act Art. 13(3)` `EU AI Act Art. 26(1)` `ISO/IEC 42001 A.8` `NIST AI RMF MAP 2.2`	Model Card as Control Evidence	L2	Schema Example Template
Deployment decision record deployment-decision-record.v1.json 12 fields, 7 required	The deployer's decision to put one AI system into use in one context, with the deployer duties checked one by one: use per the instructions, assigned and trained oversight, input data, monitoring, log retention, worker and affected-person information, impact assessments and registration.	`EU AI Act Art. 26` `EU AI Act Art. 27` `EU AI Act Art. 25` `EU AI Act Art. 50` `GDPR Art. 35` `ISO/IEC 42001 A.9` `NIST AI RMF MANAGE 1.1`	Vendor / Model Due-Diligence Gate Human-in-the-loop Gate Decision Notice & Contest Path Disclosure & Notification Pipeline	L2 · L4	Schema Example Template

Operate and monitor

Watch the system, keep the risk scores honest, handle incidents.

Record	Purpose	Evidences	Patterns	Layer	Files
Post-market monitoring plan post-market-monitoring-plan.v1.json 13 fields, 7 required	How a provider watches a system after release: the data it collects, the metrics and thresholds, the triggers and the actions they fire, and how findings feed incidents, risk and retraining.	`EU AI Act Art. 72` `EU AI Act Annex IV(9)` `EU AI Act Art. 9(2)` `ISO/IEC 42001 9.1` `ISO/IEC 42001 A.6` `NIST AI RMF MANAGE 4.1` `NIST AI RMF MEASURE 3.1`	Continuous Assurance Telemetry Incident Pipeline Drift & Fairness Monitor	L5	Schema Example Template
Risk register entry risk-register-entry.v1.json 17 fields, 11 required	One risk in the AI risk register, as code: the failure mode, its inherent and residual scores, the treatment and the controls that realise it, who accepted what remains, and the links to the incidents and eval results that keep the scores honest.	`EU AI Act Art. 9` `EU AI Act Art. 9(5)` `ISO/IEC 42001 6.1` `ISO/IEC 23894` `NIST AI RMF MAP 5.1` `NIST AI RMF MANAGE 1.2` `NIST AI RMF MANAGE 1.3` `NIST AI RMF MANAGE 1.4`	FRIA-as-Code Continuous Assurance Telemetry	L1 · L3	Schema Example Template
AI incident record incident-record.v1.json 45 fields, 11 required	One AI incident or hazard, from detection to closure.	`EU AI Act Art. 73` `EU AI Act Art. 55(1)(c)` `EU AI Act Art. 26(5)` `EU AI Act Art. 72` `GPAI Code of Practice, Safety and Security, Commitment 9` `ISO/IEC 42001 10.2` `NIST AI RMF MANAGE 4.3` `NIST AI RMF MANAGE 2.3`	Incident Pipeline Kill Switch / Circuit Breaker	L5 · L4	Schema Example Template
Control observation control-observation.v1.json 16 fields, 8 required	One observation of one open reference control on one subject: what the control expects, what was observed, whether it held, when, and the evidence the observation rests on.	`EU AI Act Art. 12` `EU AI Act Art. 15` `EU AI Act Art. 17` `ISO/IEC 42001 9.1` `NIST AI RMF MEASURE 3.1` `NIST AI RMF MANAGE 4.1`	Continuous Assurance Telemetry Machine-Readable Evidence (OSCAL) Eval Gate in CI	L4 · L5	Schema Example Template

Retire

Take the system out of service without losing its history.

Record	Purpose	Evidences	Patterns	Layer	Files
Decommissioning runbook decommissioning-runbook.v1.json 13 fields, 6 required	The executed plan for retiring one AI system or agent: why, who is told, each step with its owner and evidence (identity revoked, traffic stopped, register entry retired, evidence archived, data disposed of), and the sign-off.	`NIST AI RMF GOVERN 1.7` `NIST AI RMF MANAGE 2.4` `EU AI Act Art. 18` `EU AI Act Art. 26(6)` `ISO/IEC 42001 A.6` `GDPR Art. 5(1)(e)`	Kill Switch / Circuit Breaker Agent Registry Deactivation, Localisation & Retirement Runbook	L2 · L4	Schema Example Template

Organisation-wide

The rules, the people and the evidence every system shares.

Record	Purpose	Evidences	Patterns	Layer	Files
Policy card policy-card.v1.json 12 fields, 7 required	A governance rule set as a machine-readable artefact that travels with the system it governs: each rule's effect, the failure mode it addresses, where it is enforced and the engine module that implements it.	`EU AI Act Art. 9` `EU AI Act Art. 17` `ISO/IEC 42001 5.2` `ISO/IEC 42001 A.2` `NIST AI RMF GOVERN 1.2` `NIST AI RMF GOVERN 1.4`	Policy Card Framework Crosswalk	L1	Schema Example Template
Training record training-record.v1.json 11 fields, 7 required	Proof that one person completed one AI literacy or role-based module, with the assessment result and the access it unlocks.	`EU AI Act Art. 4` `EU AI Act Art. 26(2)` `EU AI Act Art. 14` `ISO/IEC 42001 7.2` `ISO/IEC 42001 7.3` `NIST AI RMF GOVERN 2.2` `NIST AI RMF MAP 3.4`	Human-in-the-loop Gate Agent Identity & Scoped Credentials Sanctioned AI Gateway	L1	Schema Example Template
Evidence record evidence-record.v1.json 13 fields, 6 required	The common, signed record every control writes to the assurance store, as published in chapter 05: which control decided what about which subject, against which metric and obligation, on which input, when and by whom.	`EU AI Act Art. 12` `EU AI Act Art. 17` `EU AI Act Art. 72` `ISO/IEC 42001 9.1` `NIST AI RMF MEASURE 3.1` `NIST AI RMF MANAGE 4.1`	Continuous Assurance Telemetry Machine-Readable Evidence (OSCAL) Model Artefact Integrity Sanctioned AI Gateway	L5	Schema Example Template

Policy kit

The organisation-level documents the records hang from. The AI policy is written once, as YAML, and read two ways: as prose people approve and as a Rego¹¹ skeleton a policy engine evaluates, both keyed to the same rule ids so a verdict traces back to the clause that produced it.

Template	Purpose	Evidences	Patterns	Layer	Files
AI policy (YAML, prose and Rego)	One YAML source for the AI policy, with the prose policy people approve and the Rego skeleton an engine evaluates, keyed to the same rule ids.	`ISO/IEC 42001 5.2` `ISO/IEC 42001 A.2` `NIST AI RMF GOVERN 1.2` `NIST AI RMF GOVERN 1.4` `EU AI Act Art. 17`	Policy Card Framework Crosswalk	L1	YAML Prose Rego
AI governance committee charter	Authority, membership, quorum, inputs and outputs of the forum that takes the decisions the policy reserves, each decision written as a signed record.	`ISO/IEC 42001 5.3` `ISO/IEC 42001 A.3` `NIST AI RMF GOVERN 2.1` `NIST AI RMF GOVERN 2.3` `EU AI Act Art. 17`	Policy Card	L1	Markdown
Lifecycle RACI	Who is responsible, accountable, consulted and informed for each lifecycle activity, with the record each activity produces.	`ISO/IEC 42001 A.3` `NIST AI RMF GOVERN 2.1`	Policy Card	L1	CSV
Policy gap assessment	A worksheet to test existing policies (privacy, security, data, IP, acceptable use, procurement, HR) against AI, with the evidence each answer needs.	`ISO/IEC 42001 A.2` `NIST AI RMF GOVERN 1.1`	Framework Crosswalk	L1 · L5	CSV
AI literacy curriculum	Role-based modules with objectives, format, assessment, refresh cycle and the access each unlocks; completions are training records.	`EU AI Act Art. 4` `ISO/IEC 42001 7.2` `ISO/IEC 42001 7.3` `NIST AI RMF GOVERN 2.2`	Human-in-the-loop Gate	L1	CSV
AI contract clause checklist	The terms an AI supply contract should settle, each tied to its obligation and to the due-diligence field it closes. What to secure, not clause wording.	`EU AI Act Art. 25` `GDPR Art. 28` `ISO/IEC 42001 A.10` `NIST AI RMF GOVERN 6.1`	Vendor / Model Due-Diligence Gate	L2 · L5	Markdown

Using the schemas

Validate a record with any draft 2020-12 validator. Each record names its schema in $schema; organisation-specific fields go in extensions, because every other unknown field is rejected so a typo cannot pass as evidence.
Obligation tags. x-evidences names the obligations a record or a field helps evidence: EU AI Act articles¹², GDPR articles⁹, NIST AI RMF subcategories⁵ and ISO/IEC 42001, 42005 and 23894 clauses or controls⁶⁷⁸, by identifier only. x-layer, x-pattern and x-lifecycle-stage place the record in the stack, the pattern catalogue and the lifecycle.
Incident record. Its field names follow the Commission's ten-item template for serious incidents involving general-purpose AI models with systemic risk³ and the OECD common reporting framework (29 criteria, seven mandatory)⁴; each field says which item or criterion it matches in x-aligns-with, and the seven mandatory criteria are required. Generate a report from the record rather than retyping it.
Instructions for use carry one field per element the EU AI Act lists for them¹. Post-market monitoring plan: since the Digital Omnibus, the Act asks the Commission for guidance, including a voluntary template, by 2 Sep 2027²; align this schema with it once published.
Dataset card follows the datasheet idea¹² and adds the fields an admission gate checks: lawful basis, licence, provenance and retention.
Checked on every build. The site's schemas-check script parses every schema and example, checks each $id against its file name, validates each example with a dependency-free validator for the keyword subset the library uses, and fails the build on drift.

Sources

[1] Regulation (EU) 2024/1689 (Artificial Intelligence Act), consolidated text of 27 July 2026, Arts. 9, 13, 18, 26, 27, 53, 72 and 73 and Annex IV (Art. 13(3) lists the content of instructions for use; Annex IV(2)(g) asks for test reports dated and signed by the responsible persons). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)
[2] Regulation (EU) 2026/1744 (Digital Omnibus on AI): Art. 4 reworded so providers and deployers take measures to support AI literacy; the implementing act on a post-market monitoring template replaced by Commission guidance, including a voluntary template, due by 2 Sep 2027. Publications Office of the EU (EUR-Lex). 2026-07-24. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng (verified: primary)
[3] "Report for Serious Incidents under the AI Act (General-Purpose AI Models with Systemic Risk)": reporting template with ten items (start and end dates; resulting harm; chain of events; model involved; evidence available; serious incident response; recommendation; root cause analysis; patterns in post-market monitoring; submitter information), for Art. 55(1)(c) and Commitment 9 of the Safety and Security chapter of the GPAI Code of Practice. European Commission. 2025-11-04. https://digital-strategy.ec.europa.eu/en/library/ai-act-commission-publishes-reporting-template-serious-incidents-involving-general-purpose-ai (verified: primary)
[4] Towards a common reporting framework for AI incidents (OECD Artificial Intelligence Papers No. 34; 29 criteria in eight dimensions, seven of them mandatory). OECD. 2025-02. https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/02/towards-a-common-reporting-framework-for-ai-incidents_8c488fdb/f326d4ac-en.pdf (verified: primary)
[5] NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0); subcategories cited by identifier (for example GOVERN 1.6 inventory, GOVERN 1.7 decommissioning, MANAGE 1.1 whether development or deployment should proceed, MANAGE 4.1 post-deployment monitoring plans, MANAGE 4.3 incident communication). NIST. 2023-01-26. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf (verified: primary)
[6] ISO/IEC 42001:2023, Artificial intelligence: Management system (clauses and Annex A controls referenced by identifier only). ISO/IEC. 2023. https://www.iso.org/standard/81230.html (verified: secondary)
[7] ISO/IEC 42005:2025, AI system impact assessment (referenced by identifier only). ISO/IEC. 2025-05. https://www.iso.org/standard/44545.html (verified: secondary)
[8] ISO/IEC 23894:2023, Guidance on AI risk management (referenced by identifier only). ISO/IEC. 2023-02. https://www.iso.org/standard/77304.html (verified: secondary)
[9] Regulation (EU) 2016/679 (GDPR): Arts. 5(1)(e), 6, 9, 22, 28, 35 and 36 referenced by identifier; the text of Art. 28 (processor terms) and Art. 35(7) (minimum content of a data protection impact assessment) checked on a consolidated reproduction. Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: secondary)
[10] JSON Schema Draft 2020-12 (meta-schema https://json-schema.org/draft/2020-12/schema). JSON Schema. 2022-06-16. https://json-schema.org/draft/2020-12 (verified: primary)
[11] Policy Language (Rego, the policy language of Open Policy Agent). Open Policy Agent. 2026. https://www.openpolicyagent.org/docs/policy-language (verified: primary)
[12] Datasheets for Datasets (arXiv 1803.09010, v8). Gebru et al. 2018-03-23, revised 2021-12-01. https://arxiv.org/abs/1803.09010 (verified: primary)