ISO 42001 Explained: What It Means for Australian Organisations

A year ago, most of the AI questions I heard were about what the tools could do. Now they're about control. Tender documents ask how we govern AI. Insurers ask at renewal whether there's an AI policy in place. Boards want to know who is accountable when a model gets something wrong.

ISO/IEC 42001 is the international standard built to answer those questions. At cubesys we've just been through the full certification process ourselves, alongside our long-standing ISO 9001 and ISO/IEC 27001 certifications. I led that work, so this post is the plain-English guide I wish I'd had at the start: what the standard is, whether you need it, and what it actually takes.

What ISO 42001 Actually Is

ISO/IEC 42001 is the first certifiable international standard for an Artificial Intelligence Management System (AIMS). It was published in December 2023, and Standards Australia adopted it unchanged in February 2024 as AS ISO/IEC 42001:2023.

The most common misunderstanding is about what gets certified. It isn't your AI. It's the management system around your AI: the policies, accountabilities, risk processes and records that show you're making deliberate, reviewed decisions about how AI is used.

That matters because the standard applies to organisations that use AI, not only those that build it. If your people use Microsoft 365 Copilot, if your vendors have machine learning built into their platforms, or if AI influences decisions about customers or staff, ISO 42001 is relevant to you. The question it asks is simple to state and harder to answer: can you show, on paper and in practice, that this is under control?

Is It Mandatory in Australia?

No. ISO 42001 is voluntary, and Australia doesn't have a standalone AI Act. The government's direction has been to regulate AI through existing, technology-neutral law, supported by practical guidance.

There are two things worth knowing, though:

• The Privacy Act has a firm date. From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when personal information is used in automated decisions that significantly affect people. It's a disclosure obligation, and you can't disclose what you haven't mapped.
• The national guidance has changed. In October 2025 the National AI Centre released the Guidance for AI Adoption, which replaced the 2024 Voluntary AI Safety Standard. It condenses the earlier 10 guardrails into six essential practices: decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, and maintain human control. It's free, practical and aligned with ISO 42001.
• An AI policy that's approved and reviewed, not written once and forgotten
• Named accountability, so a person (not a committee) owns how AI is used and what it produces
• An inventory of AI in use, including AI built into the third-party tools you already pay for
• Impact assessments before deployment for AI that could affect customers, staff or decisions
• Data governance for what goes into AI tools and what comes out, including what staff paste into prompts
• Human oversight, so people can question, correct or override AI output
• Supplier governance, because for most organisations AI risk arrives through vendors

In practice, the pressure isn't coming from legislation. It's coming from customers, tenders, insurers and boards. For many organisations, a recognised standard is the clearest way to answer all of them at once.

What the Standard Asks of You

ISO 42001 has two parts. Clauses 4 to 10 set out the management system itself: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A then lists 38 AI-specific controls grouped under nine control objectives.

Translated into day-to-day work, that looks like:

This requires defining the processes and methodology that are to be used for ensuring all aspects of the AI management system are addressed and satisfactorily meet the ISO standards. Then the organisation must enforce these through constant application of the management system components, and be able to provide evidence of internal compliance with our AI management system. 

 ISO 42001 and ISO 27001: Layers of control and protection, not alternatives 

The two standards answer different questions. ISO 27001 asks whether information is protected. ISO42001 asks organisations to determine whether it is appropriate to use that information in an AI system, how the data will be protected from inappropriate use, how this will be monitored and controlled, and how is will be managed in the event of an AI data management failure. 

Because both follow the same ISO management system structure, an existing ISO 27001 program gives you a real head start. Document control, internal audit, management review, corrective action and your risk methodology all extend into the AI scope rather than being rebuilt.  You can certify to ISO 42001 without ISO 27001, but many organisations pursuing it already run an ISMS. 

What We Learned Getting Certified

We ran our own certification the way we'd run a customer project: scoped, owned and tracked. A few lessons stood out.

1. Write a short AI policy covering approved tools, what data can go into them and when a human must review the output. Build on what you already have. With more than a decade of ISO 9001 and an established ISO 27001 system, we extended our existing management system rather than standing up a second one alongside it. One system is easier to run and easier to audit.
2. AI risk needs its own lens. We started from our information security risk method, but AI risk is different in nature: bias, explainability, over-reliance and output quality don't fit neatly into confidentiality, integrity and availability. Our risk assessment and treatment methodology had to be adapted.
3. Ownership changes everything. Having a named owner for the AI management system, with time dedicated to it, was the difference between a project and an ongoing capability. Name an owner who is accountable for AI use across the organisation.
4. Run a gap assessment against ISO 42001 to see how far your existing ISO 27001 or ISO 9001 system already takes you.
   

Aligned or Certified? Where to Start

You don't need a certificate to get value from ISO 42001. Aligning with it gives you the governance; certification turns that governance into a credential someone else has verified. For most organisations, the sensible path is to align now and certify when there's a commercial reason: a tender requirement, a major customer or an insurer asking for evidence.

If you're starting from scratch, these first steps cost very little:

When you do go for certification, the path is well defined: gap analysis, implementation, a Stage 1 audit of your documented system, a Stage 2 audit of how it works in practice, then annual surveillance audits. Use a certification body accredited for ISO 42001, and book early, as auditor availability is still catching up with demand.

Quick Answers

Do we have to build AI to be certified? No. ISO 42001 applies equally to organisations that only use AI.

Does ISO 42001 certify that our AI is safe? No. It certifies that you have a working management system for governing AI. It's evidence of maturity, not a guarantee about any individual system.

Does it make us compliant with the EU AI Act? No. There's significant overlap in the governance themes, but the EU AI Act has its own legal definitions and obligations.

How long does it take? It depends on your starting point and scope. An existing ISO 27001 system shortens the path considerably.

Do companies have to be ISO42001 AIMS certified to sell agentic development? No, but we wanted to have that level of external confidence that we are compliant with the ISO standards for AI systems and agents.  

How cubesys Can Help

We've done this ourselves, so we can help you do it with less guesswork. Whether you want an AI readiness assessment, help building an AI policy and register, governance for Microsoft 365 Copilot and AI agents, or a gap assessment, we start where you are and focus on governance your people will actually use.

 Learn more about our ISO/IEC 42001 certification 

This article is general information only and is not legal advice.

Sources

• ISO/IEC 42001:2023, International Organization for Standardization
• AS ISO/IEC 42001:2023, Standards Australia
• Guidance for AI Adoption, Department of Industry, Science and Resources
• Automated decision-making transparency, Office of the Australian Information Commissioner