For Australian businesses being asked how they govern AI

ISO/IEC 42001: The AI Management System Standard, For Australian Business

ISO/IEC 42001 was published in December 2023 as the first management system standard written specifically for artificial intelligence. It is built on the same skeleton as ISO 27001, it is auditable, and a certification body can issue a certificate against it. If you sell AI-touched services into government, a bank, an insurer, a health service or a large enterprise procurement team, you have probably already been asked about it, or you soon will be.

Most Australian SMEs do not need the certificate. They need the discipline underneath it: a register of every AI system in use, an honest view of what could go wrong, a decision-maker for each one, and evidence that the controls are real. Yes AI helps you build that, and tells you plainly when certification is not worth your money.

Book an AI Governance Call (03) 9003 0111

Realistic ROI

One register

Every AI system in one place

Discovery routinely turns up AI running in teams nobody had counted, usually switched on inside software the business was already paying for

3 to 9 months

From first workshop to audit ready

Faster if you already run ISO 27001, slower if the AI inventory has never been written down and nobody owns it yet

Days, not weeks

To answer an enterprise AI questionnaire

Once the evidence exists and is current, a procurement response can be assembled from the register instead of scrambled together across four people and a shared drive

Half a day a week

Realistic effort to keep it running

One accountable owner plus short quarterly reviews, once the system exists rather than being invented from scratch each time

Why Australian Businesses Use Yes AI For ISO/IEC 42001

Plenty of firms will sell you a document pack: a policy template, a risk register spreadsheet, a Statement of Applicability with the controls already ticked. An auditor reads those in about ten minutes and then goes and interviews your staff, and the gap between the binder and the working day is where certifications fail. We work the other way around, starting from the AI you are actually running and the people who have to live with the rules.

We find the AI you did not know you had

The hardest part of ISO/IEC 42001 is not the paperwork, it is scoping. AI is now switched on inside tools you already pay for: the summariser in your meeting software, the assistant in your Microsoft 365 or Google Workspace tenancy, the lead scoring in HubSpot or Salesforce, the resume screening in your recruitment platform, the chatbot a marketing contractor added to your website two years ago. We interview teams, walk the systems and read your software spend to build the real list, because a management system with a scope that misses half your AI is worse than no certificate at all.

Evidence you generate anyway, not a binder

Auditors sample records. They ask to see the impact assessment for a specific system, the approval that let it go live, the log of the last time a human overrode it, the review that happened when the vendor changed the model underneath you. We design the evidence to fall out of how you already work: approvals recorded where decisions get made, reviews scheduled in the calendar your managers already open, the register updated when procurement signs a new tool. Evidence that has to be manufactured before an audit is evidence that will not exist next year.

One Australian team from scope to surveillance

We are an Australian consultancy and the people who run your discovery workshops are the people who write the control set, sit with you through the internal audit, and are still there when the surveillance audit lands twelve months later. You are not handed from a strategist to an offshore template factory to a support queue that has never heard of your business. We also build the underlying automation, so where a control needs a system rather than a policy, we build the system.

Built around the people who have to run it

Very few Australian SMEs have a compliance manager. The AI management system usually lands on an operations lead, a practice manager or the finance director, on top of a job they already have. So we size it for that person: a small number of decisions that genuinely need to be made, a register they can actually maintain, quarterly reviews that take an hour rather than a day. A governance system that costs more attention than the AI it governs will be abandoned within a year, and we have no interest in building one.

What ISO/IEC 42001 Actually Asks You To Do

The standard follows the same harmonised structure as ISO 27001 and ISO 9001: context, leadership, planning, support, operation, performance evaluation, improvement. If you have been through an ISO audit before, the shape is familiar. What is new is Annex A, the AI-specific controls, and the requirement to assess the impact of your AI on people rather than only the risk to your own business.

The register

An inventory of every AI system in scope

Everything starts here. Each entry records what the system does, who owns it, what data goes in, what decision comes out, whether a person reviews that decision, and whether it was built in-house or arrived inside a vendor product. Vendor-embedded AI is the trap: a supplier can enable a new AI feature in a routine update, which quietly changes what your register says. We build the register so procurement and contract renewal feed it, not an annual spreadsheet audit.

Clauses 4 and 5

AI policy, objectives and clear ownership

The standard wants leadership to set an AI policy, state measurable objectives, and name who is accountable. In practice this is the part that gets copied off the internet and then contradicted by the working day. We write a short policy that matches what your business will genuinely do, including the uses you are ruling out, and we name a real person for each AI system rather than a committee that meets twice a year.

Clauses 6 and 8

Risk assessment plus AI impact assessment

This is where ISO/IEC 42001 diverges from the security standards. Alongside the usual risk assessment, it requires you to assess the impact of each AI system on individuals and on wider society, not just the risk to your revenue. For an Australian business that means thinking about who could be treated unfairly, what happens when the system is wrong, and how a person disputes an outcome. ISO/IEC 23894 and ISO 31000 give useful risk method, and auditors reliably probe this clause because it is the one most often skipped.

Statement of Applicability

Annex A controls, selected and justified

Annex A groups its controls under headings covering AI policy, internal organisation, resources for AI systems, assessing impacts, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third party and customer relationships. As with ISO 27001, you select the applicable controls and justify inclusions and exclusions in a Statement of Applicability. That document is usually the first thing an auditor opens, so it needs to be defensible rather than decorative.

Clause 9

Monitoring, measurement and real metrics

You have to show the system is working, which means numbers somebody looks at: how many AI systems are in the register versus how many were found in the last sweep, how often a human overrode an automated output, how many incidents or complaints were raised and how long they took to close, whether data quality checks passed. We wire the collection of these into the tools that already hold the data so the report builds itself, instead of a manager reconstructing a quarter from memory the week before an audit.

Plan do check act

Internal audit, management review, improvement

The certification cycle runs on this loop. An internal audit, done by someone independent of the work, finds the gaps before the certification body does. A documented management review by leadership makes the decisions. Nonconformities get corrective actions with owners and dates, and the closure evidence is what the next audit samples. Run properly this is where the standard earns its keep, because it forces a scheduled conversation about AI that most businesses otherwise never have.

Six Australian Situations That Trigger This Conversation

Task	Traditional	With Yes AI	Notes
Software vendor whose product now includes an AI feature, bidding to a bank or insurer	Each security review asks new AI questions, answered from scratch by whoever is free	One current register, impact assessments and control set the sales team can draw on	Enterprise buyers increasingly bolt AI questions onto their existing vendor security review, so the questions arrive through procurement rather than a formal standard. Having the evidence ready shortens the review, and that is usually worth more than the certificate itself.
Professional services firm on a government panel using AI to draft client work	AI use is informal, undocumented, and nobody is sure what the contract allows	Documented scope of permitted use, named owners, and records of human review	Australian government buyers increasingly ask suppliers how AI is used on their work and whether outputs are checked by a person. The answer that survives scrutiny is a documented process with sampling evidence, not a verbal assurance from the partner.
Health or allied health provider trialling AI scribes and triage assistants	A clinician-led trial spreads across the practice with no formal assessment	Impact assessment per system, consent and retention settled, clinical oversight recorded	Health data raises the stakes under the Privacy Act and the Australian Privacy Principles, and patient-facing AI needs a clear answer on what happens when it is wrong. The impact assessment is worth doing before the trial spreads. Clinical judgement stays with your practitioners, and the standard only asks you to show how it is exercised and recorded.
Recruitment or HR team using automated screening and ranking	A vendor tool scores candidates and nobody can explain how or audit the outcome	Documented purpose, fairness checks, human decision point, and a review path for candidates	Decisions about people carry the highest impact assessment burden in the standard, and Fair Work and discrimination exposure sits behind them. The control that matters most is the recorded human decision, not the model documentation the vendor supplies.
NDIS or aged care provider adding AI to rostering, notes and client communication	AI creeps in through the software the organisation already uses, unregistered	Vendor-embedded AI captured at contract renewal and assessed like anything else	Providers in regulated care are asked to show governance over anything touching participant outcomes. The vendor-embedded case is the one that catches people out, because the AI arrived in a product update rather than a purchase decision.
Business already certified to ISO 27001, now asked about AI governance	A separate parallel program is proposed, doubling the audit and document burden	One integrated management system, one internal audit program, one management review	The clause structure is shared, so the context, leadership, competence, internal audit and improvement work is largely reusable. Bringing both standards to the same certification body for an integrated audit generally takes less audit time than running two separate programs, though the body sets its own audit duration.

Six Honest Warnings Before You Chase The Certificate

Most Australian SMEs do not need to certify

Certification is worth real money when a customer, a tender or a regulator-facing counterparty is actually asking for it, or when you sell AI-touched services and want it as a differentiator. If nobody has asked, the honest answer is that you need the discipline and not the badge: the register, the impact assessments, the named owners, the review cadence. That work is perhaps a fifth of the cost and delivers most of the benefit, and you can certify later on top of it if a deal demands it. We will tell you when you are in that group, even though it is the smaller piece of work for us.

The certificate covers the management system, not the model

This gets misread constantly, including by buyers. An ISO/IEC 42001 certificate says an accredited auditor found that you run a defined management system for AI. It does not say your model is accurate, fair, safe or free of hallucination, and it does not certify any individual AI system. If your sales team starts implying your AI itself is certified, you have made a claim about your own product that the certificate does not support, and misleading claims are exactly what the Australian Consumer Law and the ACCC exist to police. Say what the certificate actually covers.

It does not make you compliant with any law

Australia currently has a voluntary AI Safety Standard and a proposal for mandatory guardrails in high risk settings. Neither is a general AI statute and the guardrails are not law today. ISO/IEC 42001 is itself a voluntary international standard. Holding it demonstrates governance maturity, lines up neatly with the voluntary guardrails and gives you a head start if requirements harden, but it grants no presumption of conformity with Australian law, the Privacy Act, or overseas regimes such as the EU AI Act. Anyone who tells you a certificate makes you compliant is selling something. This page is general information about a standard, not legal or clinical advice, so check your own obligations with an adviser who knows your business.

Scoping the AI is harder than writing the documents

This is the stage implementations most often underestimate. AI arrives through software you already pay for, through a contractor who added a chatbot, through one team quietly using a free tool on client data. Two things follow. First, budget the discovery properly, because a scope that excludes the AI your customer cares about will be spotted and will embarrass you. Second, build a trigger so the register updates when new software is bought or a vendor changes their terms, otherwise your beautiful inventory is stale within two quarters.

Do not let AI write the evidence for you

It is tempting to generate the policy set, the risk register and the Statement of Applicability in an afternoon. The result reads well and describes a company that does not exist. Auditors interview staff, sample records and follow a decision from approval to outcome, and a documented process nobody follows is a worse finding than an undocumented one, because it is a nonconformity against your own stated system. Use AI to draft and accelerate by all means, then make every statement true before it goes into the system, and have a human who will be interviewed sign it off.

Choose the certification body carefully, and note who cannot audit you

Certification is issued by an independent certification body, not by a consultancy. JAS-ANZ is the accreditation body for Australia and New Zealand, and bodies accredited by other members of the international accreditation network also certify here. Not every firm offering ISO/IEC 42001 holds accreditation for this scheme, so ask to see the scope of their accreditation before you sign, because an unaccredited certificate may not satisfy the customer who prompted the exercise. Independence rules also mean the firm that implements your management system cannot audit it. Yes AI prepares you, runs the gap assessment and supports you through the audit. We do not issue certificates and we are not your auditor.

How Yes AI Helps

The AI inventory and system register

We run the discovery that finds every AI system actually in use, including the ones embedded in software you already license and the ones a single team adopted without telling anyone. You get a register with owners, data flows, decision points and human review status, plus a trigger built into procurement so it stays current rather than ageing quietly in a shared drive.

The evidence trail, built into how you work

We design the approvals, reviews, logs and metrics so they are produced by the working day rather than assembled the fortnight before an audit. Where a control needs a system rather than a policy, we build the integration or the automation that captures it, so the record exists whether or not anyone remembers to write it down.

Gap assessment against the standard

A structured read of where you sit against each clause and each applicable Annex A control, with the gaps ranked by how much audit risk and how much real risk they carry. You get a plan with owners, effort estimates and an honest recommendation on whether to pursue certification now, later, or not at all. We are not an auditor and this is not a certification audit.

Running it after the launch

The management system has to survive contact with a normal year. We stay on for the internal audit, the management review, the corrective actions and the surveillance audit preparation, and we adjust the register and controls as you adopt new tools or a vendor changes what their AI does. Ongoing support sized for a business without a compliance department.

How An ISO/IEC 42001 Program Runs

Five stages from a first conversation to either a certification audit or a deliberate decision that you do not need one. Most Australian businesses reach audit readiness in three to nine months, faster where an ISO 27001 management system already exists and slower where the AI inventory has never been written down.

Scope and inventory

We work out what the management system covers and find every AI system inside that boundary, through team interviews, a walk through your software estate and a read of what you actually spend money on. We agree the scope statement in writing, because a scope that quietly excludes something a customer cares about is the single most damaging shortcut available at this stage.

Gap assessment

We assess where you sit against each clause and each applicable Annex A control, and rank the gaps by audit risk and real risk. You get a costed plan, an effort estimate in hours per person, and a clear recommendation: certify now, build the discipline and revisit in twelve months, or integrate with your existing ISO 27001 program.

Build the management system

Policy, objectives, roles, risk assessments, AI impact assessments and the Statement of Applicability, written to match how your business genuinely operates. We build the supporting automation where a control needs a system, and we deliberately keep the document set small, because every page you write is a page an auditor can hold you to.

Operate it and audit yourselves

The system has to run for long enough to generate evidence before anyone can certify it, usually a few months of live operation. We help you gather it, then run an internal audit with independence from the people who did the work, take the findings to a documented management review, and close the corrective actions properly so the certification body samples a clean trail.

Certification audit, or the decision not to

If you are certifying, we help you shortlist accredited certification bodies, prepare for the Stage 1 documentation review and the Stage 2 audit of the system in operation, and support you through findings and surveillance audits in the years after. If certification is not warranted, we say so and hand you a running management system instead, which is what most businesses needed in the first place.

FAQ

What is ISO/IEC 42001 in plain English?

It is an international standard, published in December 2023, that describes how an organisation should manage its use of artificial intelligence. It is a management system standard, which means it governs how you make decisions, assign accountability, assess risk and improve over time, rather than setting technical requirements for a model. It uses the same harmonised clause structure as ISO 27001 and ISO 9001, so context, leadership, planning, support, operation, performance evaluation and improvement, and it adds an Annex A set of AI-specific controls plus a requirement to assess the impact of your AI on individuals and society. Because it is a management system standard, an accredited certification body can audit you against it and issue a certificate.

Do we actually need to be certified?

Probably not, and we would rather say that up front. Certification earns its cost when a customer, a tender or a procurement process is asking for it, when you sell AI-touched services into government, banking, insurance, health or large enterprise, or when you want a credential competitors do not have. If nobody is asking, what you need is the discipline: a register of every AI system, an impact assessment for the ones that affect people, a named owner for each, and a quarterly review that actually happens. That is a fraction of the effort, delivers most of the risk reduction, and leaves you able to certify later if a deal requires it.

How does it relate to ISO 27001?

They are deliberately compatible. Both use the harmonised structure, so clauses 4 through 10 cover the same ground and the work you have already done on context, leadership, competence, documented information, internal audit, management review and improvement is largely reusable. What differs is the control set. ISO 27001 Annex A is about information security. ISO/IEC 42001 Annex A is about AI specifically: data used for AI systems, the AI system life cycle, impact assessment, information provided to interested parties, and third party relationships. If you already hold ISO 27001, the sensible path is one integrated management system audited by the same certification body in a single visit, which usually costs less audit time than running the two separately.

How long does certification take?

For an Australian SME, three to nine months from first workshop to audit readiness is a realistic range. An organisation already certified to ISO 27001, with a small AI footprint and an executive who makes decisions promptly, sits at the fast end. An organisation starting from no inventory, no owners and AI spread across several teams sits at the slow end. Add time after that for the certification body itself: the Stage 1 documentation review and the Stage 2 audit of the system in operation are separate visits, usually weeks apart, and the system needs enough live operating history to have generated evidence worth sampling.

What does it cost?

The honest answer has three parts and only one of them is a consulting fee. First, internal effort: expect a senior owner giving roughly half a day a week during the build and less once it is running, plus workshop time from each team using AI. Second, the certification body, which is a separate independent organisation and quotes on your headcount, number of sites and scope complexity, so get two or three quotes and check their accreditation scope. Third, our work. Yes AI strategy and readiness engagements start at $1,000 AUD for a focused BASIC piece, $3,000 for a STANDARD engagement, and $10,000 for a STRATEGIC one covering a broader estate. We scope after discovery and give you a fixed price before any build starts.

Does Yes AI issue the certificate or audit us?

No, and no consultancy can. Certification is issued by an independent certification body. JAS-ANZ is the accreditation body for Australia and New Zealand, and bodies accredited by other members of the international accreditation network also certify here, so check the accreditation scope covers ISO/IEC 42001. Independence rules mean the firm that helps you build a management system cannot then audit it. What we do is the preparation: discovery and the AI inventory, gap assessment, risk and impact assessments, the control set and Statement of Applicability, the evidence trail, internal audit support, and help shortlisting an accredited certification body and getting through Stage 1 and Stage 2. If certification is not warranted we will tell you, and you keep the working management system either way.

Does 42001 make us compliant with Australian AI regulation?

No, and be wary of anyone who says otherwise. Australia currently has a voluntary AI Safety Standard and a proposal for mandatory guardrails in high risk settings rather than a general AI statute, so those guardrails are not binding law today, and ISO/IEC 42001 is itself a voluntary international standard. Holding it does not create a legal presumption of conformity here, nor under the EU AI Act if you sell into Europe. What it does do is demonstrate governance maturity to buyers, align closely with the voluntary Australian guardrails, and put the register, accountability and impact assessment machinery in place, so if requirements do harden you are adjusting an existing system rather than starting one. Your obligations under the Privacy Act and the Australian Privacy Principles continue to apply regardless. This is general information rather than legal advice, so confirm your own position with your adviser.

We only use AI inside tools we already buy. Does this still apply?

Yes, and that is the most common situation we see. If your meeting software summarises calls, your recruitment platform ranks candidates, your CRM scores leads or your productivity suite drafts documents on client data, you are using AI systems and they belong in the register. The standard treats third party and customer relationships explicitly, so the question becomes what your vendor does, what you are accountable for, and what evidence you can get from them. The practical risk is that a vendor enables a new AI feature in a routine product update and changes your exposure without a purchase decision, which is why we tie the register to contract renewal and procurement rather than an annual review.

Work Out Whether You Need The Certificate Or The Discipline

Book a call and we will map the AI already running in your business, tell you plainly whether ISO/IEC 42001 certification is worth pursuing in your situation, and show you the first three things worth doing either way. No obligation and no scare campaign.