ISO/IEC 42001 is the international standard for managing artificial intelligence inside an organisation. It sets out the requirements for an AI management system (AIMS): the policies, roles, risk checks and records that show your business uses AI deliberately rather than by accident. In Australia it is published as AS ISO/IEC 42001:2023, and certification against it is voluntary. This guide explains what the standard covers, what it asks of you, what certification costs, and where a small or mid-sized business should begin.
CalibreforumSee Where AI Is Used Across Your BusinessCalibre Forum’s AI readiness assessment surveys employees and provides a scored report with recommendations for a 90-day action plan.Explore the AI readiness assessmentTL;DR
- ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, for organisations that provide or use AI.
- It applies to any organisation regardless of size or sector, and in Australia it is adopted as AS ISO/IEC 42001:2023. Certification is voluntary.
- Published certification pricing for a small site starts at A$15,000 to A$18,000 over three years, before internal time and GST.
- You cannot manage what you cannot see. The first practical step is a staff-wide picture of which AI tools are actually in use.
- Start with the areas that matter most to your current systems and risks, not the whole standard at once.
Table of Contents
- What ISO 42001 is, in plain words
- What the standard covers
- ISO 42001 compliance: what it really asks of you
- ISO 42001 versus ISO 27001
- How much does ISO 42001 certification cost?
- Where to start: use what Australia already gives you
- Who actually needs this
- Perspective
- Getting a staff-wide picture before you commit to a framework
- How the assessment lines up with the work ahead
- FAQ
- Sources
What ISO 42001 is, in plain words
The International Organization for Standardization describes ISO/IEC 42001 as a standard specifying requirements for establishing, implementing, maintaining and continually improving an AI management system for organisations that provide or use AI-based products or services. It was published in 2023 and deals with AI-specific concerns such as ethical considerations, transparency and continuous learning.
Two things are worth separating.
- It is a management system standard, not a technical specification. It does not tell you which model to buy or how to configure a chatbot. It tells you what a well-run organisation does around AI: who is accountable, how risks are assessed, how data is handled, how performance is monitored and how problems get fixed.
- It is about use as well as development. Many readers assume it is only for companies building AI products. The standard covers organisations that develop, provide or use products and services that rely on AI systems. A 40-person accounting firm that uses AI to draft client correspondence is within its scope in principle, even if it never pursues a certificate.
In Australia, Standards Australia published AS ISO/IEC 42001:2023 in February 2024 as an identical adoption of the international text. There is no separate local variant to learn. Whatever you read about the international standard applies here.
What the standard covers
The framework addresses transparency, explainability, fairness, data quality and continuous learning. In practice, ISO describes compliance as an AI management system with leadership and organisational context, AI policy and objectives, risk management, data governance and lifecycle controls, transparency, performance monitoring and continual improvement.
Translated into business terms, that means being able to answer these questions with evidence:
| Area | The question an auditor, client or board will ask |
|---|---|
| Context and scope | Which AI systems and uses are inside the management system, and why? |
| Leadership | Who at the top owns AI risk, and is that written down? |
| Policy and objectives | What is your AI policy, and what are you trying to achieve with AI? |
| Risk and impact | How have you assessed what could go wrong for customers, staff and the business? |
| Data | Where does the data going into AI tools come from, and who can see it? |
| Operation | How are AI tools approved, logged, monitored and retired? |
| Improvement | What happens when something fails, and how do you learn from it? |
Annex A: the controls
The standard includes an Annex A of reference controls. Standards Australia notes that it covers AI policy, roles, data quality, user information, logs, human oversight, and suppliers and customers. The same page lists the documents you typically maintain: the AI policy, AIMS scope, risk assessment and treatment plan, statement of applicability, impact assessments and operational logs.
That list is useful as a self-check. If you cannot currently produce a one-page AI policy or a list of the AI tools your staff use, you have found your starting point.
ISO 42001 compliance: what it really asks of you
People search for “ISO 42001 compliance” expecting a checklist. Because it is a management system standard, compliance means operating a system, not ticking boxes once. Three points matter for a small or mid-sized business.
It is voluntary. There is no Australian law that requires you to hold ISO 42001. Certification is something you choose, typically because a customer, tender or insurer asks for assurance. A certification body notes that certification is voluntary and that the decision is made by independent personnel who were not on the audit team.
You can use it without certifying. Many organisations use the standard as a reference model, working through the policy, risk and data controls for their own benefit and deciding about an external audit later. That is a sensible path when you are still finding out how AI is used across the business.
It scales with your footprint. Audit effort depends on scope, your role in the AI life cycle, and the number and risk of your AI systems, according to an Australian certification body’s published guidance. A business using a handful of off-the-shelf tools has a far lighter task than one embedding models in a customer-facing product.
ISO 42001 versus ISO 27001
This is the question people ask most after “what is it”. The short answer: ISO 27001 manages information security, ISO 42001 manages AI. They are designed to sit together.
- Different subject. ISO 27001 protects the confidentiality, integrity and availability of information. ISO 42001 adds AI-specific concerns: fairness, explainability, human oversight, impact on people and the AI life cycle.
- Same skeleton. Standards Australia says ISO 42001 shares ISO’s harmonised structure with ISO 27001, which supports alignment with management systems you already run.
- Can be integrated. The same source says it can be integrated with ISO 27001 information security programs, so a business with 27001 in place does not start from zero. Its risk register, document control, internal audit and management review habits carry over.
If you have neither, the order matters less than the groundwork they share: knowing what systems and data you have, who has access, and who is accountable. Our guides on AI data governance and AI access control cover that groundwork in plain language.
How much does ISO 42001 certification cost?
The honest answer is that it depends on scope, but there are published anchors for Australia.
- Audit fees. One Australian certification body publishes a price of A$15,000 to A$18,000, excluding GST, for the full three-year cycle for an organisation using or providing AI with up to 20 people involved in AI work at a single site. Larger scope, more sites or higher-risk systems raise audit time and therefore cost.
- Training. If you want someone in-house who can run the system, courses exist locally. One Australian provider lists lead implementer training at A$699 plus GST.
- Internal time. This is the line most budgets miss. Writing policies, running risk and impact assessments, collecting logs and sitting through audits takes staff hours. Larger mid-market estimates run well above the audit fee, but for a small business the figure depends almost entirely on how much you already have documented.
The practical conclusion: the audit invoice is the smaller part of the work. The larger part is knowing your own AI footprint well enough to describe it to an auditor. Businesses that skip that step tend to pay for it in rework.
Where to start: use what Australia already gives you
You do not need to build everything before you begin. The National AI Centre’s implementation guidance recommends documenting strategic intent, policies and processes for safe AI development and deployment. It also advises organisations to start with the areas that matter most to their current systems and risks rather than trying to implement all of AI governance at once.
That advice fits the first stage of any AIMS. A workable sequence for a small or mid-sized business looks like this:
- Inventory real use. List every AI tool in use, approved or not, and what data goes into it. This almost always turns up more than management expects.
- Name an owner. One accountable person for AI risk, with authority to approve or stop a tool.
- Write a short policy. One or two pages: what is allowed, what data must never be entered, who approves new tools.
- Assess the highest risks first. Tools touching client data, personal information, hiring or financial decisions come before a team’s use of an AI meeting summariser.
- Set controls. Access, logging, supplier checks and staff guidance. Our AI security checklist and guide to AI model risk management go step by step.
- Review on a rhythm. AI use changes quickly, so a one-off review goes stale. A quarterly check is a realistic cadence.
The first step is where most businesses stall. Leadership tends to know about the tools it approved, while staff use others. Our piece on finding shadow AI in a security assessment explains why the gap exists and how to close it, and the guide to AI risk mitigation shows how to prioritise what you find.
Who actually needs this
Not every business needs a certificate, but most need what sits underneath it. Some typical triggers:
- A client or tender asks for AI governance evidence. Government and enterprise buyers increasingly ask suppliers how they manage AI. A certificate is one answer. A documented, working system is the foundation for any answer.
- You handle sensitive data. Health, aged care, disability and education providers hold information where a careless prompt matters. See how this plays out for aged care and NDIS providers and medical and allied health clinics.
- You supply technology to others. IT firms and service providers are asked about AI controls by their own customers. See the assessment for managed service providers.
- Staff are adopting AI faster than policy. This is the common case, and it is where visibility pays off first.
Perspective
We read the ISO 42001 conversation from one angle: the businesses we talk to are rarely stuck on the standard’s clauses. They are stuck on a simpler problem. Nobody can say with confidence which AI tools their people use, for what, and with which data.
That matters because every part of an AI management system depends on the answer. A policy written without knowing real usage describes an imagined workplace. A risk assessment of three approved tools misses the five that were never approved. An auditor, a client or a board will eventually ask what is in use, and “we think” is not an evidence trail.
This is why we built our assessment around the whole team rather than around software. Every staff member answers an anonymous survey, and the answers are combined into a scored report that maps current tool usage and workflows, points to areas of strength and risk, and sets out a 90-day action plan. Anonymity is deliberate: people tell the truth about tools when they are not worried about being singled out. We install nothing and we do not collect individual data.
To be clear about what it is: our report is a readiness view, not an ISO 42001 certificate, and we make no compliance or legal claims. What it gives you is the thing a management system, certified or not, has to start from: an honest, organisation-wide picture, and a concrete next ninety days. In our view that is the most useful first move for a small or mid-sized business, because it turns a vague worry about AI into a short list of actions.
Anthony
Getting a staff-wide picture before you commit to a framework
Our AI readiness assessment is built for Australian and New Zealand businesses that want that starting picture. Staff complete a short, anonymous survey. The responses are combined into a scored report that shows how AI is used across the organisation, where your strengths and risks sit, and a tailored 90-day action plan covering operational and security improvements. You can see what is in the readiness report and how the process runs from setup to report.
The one-off report is A$1,990 on our pricing page. If you want to track progress, membership is A$2,388 per year and covers recurring quarterly assessments and reports, which suits a business that wants to see change from one quarter to the next. Accountants, IT providers and brokers who advise several clients can also look at our page for firms.
How the assessment lines up with the work ahead
If you do pursue an AIMS, whether or not you certify, the first 90 days usually produce the same raw material the standard expects you to hold:
- A scope and inventory: which AI tools and uses exist, based on what staff report.
- Risk priorities: which uses touch sensitive data or important decisions and need attention first.
- Policy inputs: what staff already do, so a policy fits real behaviour and gets followed.
- Awareness gaps: where people need guidance. Our guide to AI security awareness for staff covers what to teach.
- A baseline: a score to compare against next quarter.
You can then decide on evidence whether a formal audit is worth the fee, or whether a lighter internal system meets your needs. More practical writing on this topic is on our blog for Australian and New Zealand businesses.
FAQ
Is ISO 42001 mandatory in Australia?
No. Certification is voluntary, and the certificate decision is made independently of the audit team. Businesses usually pursue it because customers, tenders or insurers ask for assurance. Even if you never certify, the standard is a useful model for governing AI.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 governs information security, while ISO 42001 governs how an organisation manages AI. They share ISO’s harmonised structure, so they can be integrated. A business that already runs 27001 can reuse much of its document control, risk and audit routine.
Does a small business need ISO 42001?
The standard applies to any organisation regardless of size or sector that develops, provides or uses AI. A small business does not have to certify, but the basics still apply: know which tools are used, set a short policy, name an owner and review risks regularly.
How long does it take to prepare?
That depends on scope and on how much you already have documented. A realistic first milestone is a 90-day period that produces an AI inventory, an owner, a short policy and a prioritised risk list. Certification timing then depends on your chosen audit body and the size of your AI footprint.
Sources
- ISO/IEC 42001:2023 - AI management systems (ISO)
- AS ISO/IEC 42001:2023 preview (Standards Australia Store)
- ISO 42001 explained (ISO)
- Spotlight on AS ISO/IEC 42001:2023 (Standards Australia)
- Guidance for AI adoption: implementation guidance (National AI Centre)
- ISO 42001 Certification in Australia
- ISO 42001 Foundation Certification Course
Recommended
- AI Risk Mitigation: A Practical Guide for Australian Businesses
- AI Model Risk Management for Australian Businesses
- AI Data Governance: A Practical Guide for Australian Businesses
- AI Security Checklist for Australian Businesses
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.