6 free templates · Excel and Word · Updated 2026

Compliance templates in Excel and Word, free and without sign-up

KYC file, GDPR breach register, NIS2 incident register, ISO 9001 nonconformities, AI systems inventory and AICA food supply contract model, built for companies operating in Spain. Each file carries the fields the rule requires, drop-downs, calculated deadlines and an instructions sheet with the applicable articles. No macros, no form. The templates are in Spanish (the same files as the Spanish version of this page).

See the six templates See the modules that fill themselves in

Compatible with Excel 2016 or later, LibreOffice and Google Sheets (import); the contract model opens in Word and LibreOffice Writer. Between 13 and 41 KB per file.

What is in the pack

The six templates, one per obligation

Each one is designed to be filled in by whoever handles compliance in an SME, without a consultancy: the AML officer, the DPO, the security, quality, IT or purchasing manager. Below each card, the free Dokuflex module that does the same with rules, owners and alerts.

Excel Ley 10/2010 · RD 304/2014

KYC file template (customer due diligence)

One file per customer with formal identification, the beneficial owner, the purpose of the relationship, the written and reasoned risk analysis and the ongoing monitoring that Ley 10/2010 (Spain's anti-money-laundering act) requires of obliged entities.

What it includes
  • ✓File: customer data, channel, PEP, risk country and sector, risk level and measures (simplified, standard, enhanced) in drop-downs; mandatory reasoning and management approval.
  • ✓Beneficial owners with percentage, type of control and source of verification; Documents with expiry and location; Reviews with reason and outcome.
  • ✓Next review date calculated according to risk level (12, 24 or 36 months, editable) and 10-year retention (art. 25).
  • ✓Instructions with articles 3 to 7, 14 and 25 of Ley 10/2010 and those of RD 304/2014.

Who it is for: accounting firms, law firms, real estate agencies, small finance companies, jewellers and property developers bound by Ley 10/2010 that today keep risk in a shared folder.

Download KYC file (.xlsx, 17 KB, in Spanish)

The version that fills itself in: free KYC due diligence file with rules and automatic reviews.

Excel GDPR arts. 33 and 34 · LOPDGDD

GDPR security breach register template

The register of security breaches that article 33.5 requires of every data controller, including breaches it decides not to notify. One row per breach, with the 72-hour deadline calculated from the moment of awareness.

What it includes
  • ✓Register: detection date, awareness date, description, origin, type (confidentiality, integrity, availability), categories and number of records and data subjects, risk.
  • ✓Notification to the AEPD (Spanish data protection authority) yes/no with reasoning if not notified, 72 h deadline calculated, submission date and file number; communication to data subjects (art. 34).
  • ✓Processor involved, containment measures, preventive measures, owner, status and closure; Summary with totals for the DPO's report.
  • ✓Instructions with the minimum content of the notification (art. 33.3) and the AEPD and EDPB guidelines.

Who it is for: DPOs and privacy officers of SMEs, e-commerce, clinics, schools and small public bodies.

Download breach register (.xlsx, 14 KB, in Spanish)

The version that fills itself in: free GDPR security breach and data subject rights register with the 72 hours monitored.

Excel NIS2 art. 23 · DORA art. 19

NIS2 cybersecurity incident register template

Incident register for essential and important entities and their ICT suppliers, with the significance decision and the three deadlines of article 23 turned into due dates that calculate themselves.

What it includes
  • ✓Early warning 24 h, notification 72 h and final report 1 month: due date calculated from the moment of awareness, submission date and reference returned by the CSIRT.
  • ✓Incident type, framework (NIS2, DORA, ENS), significant? with reasoning, services affected, ICT supplier involved, owner, root cause, measures, status and approved closure.
  • ✓“Personal data affected?” column to open in parallel the row in the GDPR breach register.
  • ✓Deadlines sheet: NIS2 versus DORA milestone by milestone, and who to notify in Spain while the transposition act is pending.

Who it is for: security and IT managers of essential and important entities, financial entities subject to DORA and suppliers that must report to their customers.

Download NIS2 register (.xlsx, 16 KB, in Spanish)

The version that fills itself in: free NIS2 and DORA incident register with the three dates as mandatory fields.

Excel ISO 9001 cl. 8.7 and 10.2

ISO 9001 nonconformity and corrective action register template

The documented information required by clause 10.2.2: nature of the nonconformity, action taken and results. It separates into columns what the auditor checks one by one: correction, root cause, corrective action and effectiveness verification.

What it includes
  • ✓Register: source (audit, complaint, process, supplier…), standard (9001, 14001, 45001, 27001), requirement, severity minor, major or critical, product affected.
  • ✓Immediate correction (8.7), analysis method (5 whys, Ishikawa, 8D), root cause, corrective action, owner, planned date and implementation.
  • ✓Effectiveness verification with date, evidence and result (effective, not effective, reopen), status and closure approved by someone other than the owner.
  • ✓Summary for management review (9.3): open, by severity, overdue, pending verification.

Who it is for: quality, environment, health and safety or information security managers in certified SMEs or those on the way to certification.

Download NC register (.xlsx, 13 KB, in Spanish)

The version that fills itself in: free nonconformity and corrective action register that does not close without a root cause and verified effectiveness.

Excel Regulation (EU) 2024/1689 (AI Act)

AI systems and tools inventory template (AI Act)

The inventory from which the AI Act obligations start: which AI the company uses, for what, with what risk and who is responsible. It includes the general-purpose tools employees use and the AI embedded in the ERP, the CRM or HR.

What it includes
  • ✓Inventory: system, provider, type (generic, embedded, GPAI via API, in-house development, agent), department, purpose, company role (provider or deployer).
  • ✓AI Act risk category in a drop-down (prohibited art. 5, high risk Annex III, transparency art. 50, minimal) and Annex III area (employment, credit, education, biometrics…).
  • ✓Personal data, special categories, decisions about people, human oversight, transparency obligation, assessments (DPIA, FRIA), provider documentation, owner, status.
  • ✓Review date calculated (6 months for high risk, 12 for the rest) and Summary: pending classification, prohibited, high risk, review overdue.

Who it is for: IT managers, DPOs, compliance and HR in companies that use third-party AI and need the inventory before the usage policy and the article 4 training.

Download AI inventory (.xlsx, 15 KB, in Spanish)

The version that fills itself in: free AI systems register with AI Act risk classification and automatic rules.

Word Ley 12/2013 art. 9 · RD 1028/2022

Food supply contract model with the article 9 clauses (AICA)

Food supply contract structure in Word with the eleven minimum clauses of article 9.1 of Ley 12/2013 (Spain's food chain act), help text in italics in each one, a clause on registration in the Registro de Contratos Alimentarios (food contracts register) and an addendum annex. Indicative model: review the contract with your adviser.

What it includes
  • ✓Identification of the parties with primary producer status, subject matter with category, quantity, quality and perishable nature.
  • ✓Price, fixed or variable by objective factors, with the declaration that it exceeds the effective cost of production (art. 9.1.c); payment terms with the legal 30 and 60 days; delivery.
  • ✓Rights and obligations, information between the parties, duration, renewal, modification and renegotiation, grounds for termination, dispute resolution and force majeure.
  • ✓Clause on registration with AICA (Spain's food chain authority) before delivery and 4-year retention, signatures, data protection and addendum annex for each modification.

Who it is for: buyers in the food chain (industry, distribution, cooperatives, integrators) and producers who want to come to the negotiation with the mandatory clauses already on the table.

Download contract model (.docx, 41 KB, in Spanish)

The version that fills itself in: free AICA food supply contract software with the art. 9 clauses as mandatory fields.

How to use the templates in five minutes

The five Excel sheets follow the same logic; the contract model is filled in from top to bottom, deleting the help text in italics.

1

Read the Instrucciones sheet

Each file opens on it: what it is, how to fill it in step by step, the articles of the applicable rule and what the template cannot do for you.

2

One row (or one file) per case

Breaches, incidents, nonconformities and AI systems go in rows with filters and numbering. The KYC file is one file per customer, with its sheets for beneficial owners, documents and reviews.

3

Let it calculate the deadlines

The 72 hours before the AEPD, the 24 hours, 72 hours and one month of NIS2 and the next KYC and AI inventory review come out automatically from the date you enter. Weekends included.

4

Close with evidence

No row should move to “Closed” without a root cause, without verification or without the submission reference. The template gives you the column; the discipline comes from you, or from the module.

Which rules the templates apply (and what they cannot do for you)

Informative content; it does not replace legal advice. References checked on 20 October 2026.

Honestly

When the template stops being enough

For a firm with thirty clients, an SME with one breach a year or a quality system with ten nonconformities, Excel works. These are the signs that it is already costing you more than a process would.

More than one person fills it in

Two versions of the file, one overwritten cell and nobody knows which is the right one. The register needs an owner per row and a change history.

There is a legal deadline in hours

72 hours before the AEPD or 24 before the CSIRT are not monitored with a column: someone has to receive the alert on a Saturday morning.

Someone external will ask for evidence

SEPBLAC, the AEPD, an ISO auditor or an AICA inspector ask who decided, when and on what grounds. A cell does not prove it; a file with a history does.

It gets closed without what the rule requires

The sheet allows “Closed” with the root cause empty or the contract saved without a price. A form with mandatory fields does not.

The evidence lives somewhere else

The ID in an email, the auditor's report in a folder and the AICA receipt on the register's website. The file should have them together.

Reviews are not triggered

The calculated next-review date is only useful if someone looks at it. A process creates the task and assigns it to someone.

The same logic, without Excel

Dokuflex's six compliance modules do what these templates do and what the templates cannot: mandatory fields according to the rule, an owner and a deadline per file, alerts before it expires, attached evidence and a history of who did what. They are free, are activated from the account and are adapted with the low-code designer without an implementation project.

Start for free See the module catalogue

Frequently asked questions about the compliance templates

Are the compliance templates free and without sign-up?

Yes. The six files are downloaded directly from this page, with no form or email. They contain no macros or protection: they are Excel sheets with list validations and standard formulas (compatible with Excel 2016 or later, LibreOffice and Google Sheets on import) and an editable Word document. The templates are written in Spanish, because the obligations they cover are Spanish and EU ones.

Is an Excel file valid as a security breach register before the AEPD?

Article 33.5 of the GDPR requires all security breaches to be documented, including those not notified, but it does not impose a format. An Excel file complies if it is complete and up to date: the template records the date of awareness, the 72-hour deadline, the decision to notify with its reasoning, the communication to data subjects and the measures. What a sheet cannot prove is who recorded what and when, nor does it warn that the deadline is about to expire; that is what Dokuflex's free GDPR rights and breaches module is for.

Which deadlines does the NIS2 incident template apply?

Those of article 23 of Directive (EU) 2022/2555: early warning within 24 hours, notification within 72 hours and final report within one month, counted from when the entity becomes aware of the incident and only if it has classified it as significant. The template calculates the three deadlines from the awareness column and summarises in another sheet the differences with DORA (4 hours from classification and 24 from detection for the initial notification). In Spain the deadlines depend on the transposition act, whose draft bill was approved on 14 January 2025.

Does the food supply contract model replace an approved standard contract or legal counsel?

No. It is an indicative structure with the eleven minimum clauses of article 9.1 of Ley 12/2013 (parties, subject matter, price above the effective cost of production, payment in 30 or 60 days, delivery, rights and obligations, information, duration and modification, termination, disputes and force majeure), plus the clause on registration in the Registro de Contratos Alimentarios (food contracts register) and an addendum annex. The help text is in italics so it can be deleted. Review the contract with your adviser and, if an approved standard contract exists for your product, check that it does not conflict.

Can I adapt the templates to my company?

Yes. They have no protection or macros: you can add columns, change the values of the drop-downs (they are in each column's data validation or in the Listas sheet) and modify the deadline formulas. The only things best left untouched without reading the Instrucciones sheet are the fields the rule requires, marked in each template with the corresponding article.

When is it worth moving from the template to the Dokuflex module?

When more than one person has to fill it in, when there is a legal deadline that cannot be missed (72 hours before the AEPD, 24 hours before the CSIRT, delivery under a food supply contract) or when someone external is going to ask for evidence: SEPBLAC, the AEPD, an ISO auditor or an AICA inspector. At that point you need what an Excel file does not give you: an assigned owner, mandatory fields, alerts and a history of who did what. Dokuflex's six compliance modules are free and are activated from the account without an implementation project; they are in the process template catalogue.