A year ago, most of the AI questions I heard were about what the tools could do. Now they're about control. Tender documents ask how we govern AI. Insurers ask at renewal whether there's an AI policy in place. Boards want to know who is accountable when a model gets something wrong.
ISO/IEC 42001 is the international standard built to answer those questions. At cubesys we've just been through the full certification process ourselves, alongside our long-standing ISO 9001 and ISO/IEC 27001 certifications. I led that work, so this post is the plain-English guide I wish I'd had at the start: what the standard is, whether you need it, and what it actually takes.
ISO/IEC 42001 is the first certifiable international standard for an Artificial Intelligence Management System (AIMS). It was published in December 2023, and Standards Australia adopted it unchanged in February 2024 as AS ISO/IEC 42001:2023.
The most common misunderstanding is about what gets certified. It isn't your AI. It's the management system around your AI: the policies, accountabilities, risk processes and records that show you're making deliberate, reviewed decisions about how AI is used.
That matters because the standard applies to organisations that use AI, not only those that build it. If your people use Microsoft 365 Copilot, if your vendors have machine learning built into their platforms, or if AI influences decisions about customers or staff, ISO 42001 is relevant to you. The question it asks is simple to state and harder to answer: can you show, on paper and in practice, that this is under control?
No. ISO 42001 is voluntary, and Australia doesn't have a standalone AI Act. The government's direction has been to regulate AI through existing, technology-neutral law, supported by practical guidance.
There are two things worth knowing, though:
In practice, the pressure isn't coming from legislation. It's coming from customers, tenders, insurers and boards. For many organisations, a recognised standard is the clearest way to answer all of them at once.
ISO 42001 has two parts. Clauses 4 to 10 set out the management system itself: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A then lists 38 AI-specific controls grouped under nine control objectives.
Translated into day-to-day work, that looks like:
This requires defining the processes and methodology that are to be used for ensuring all aspects of the AI management system are addressed and satisfactorily meet the ISO standards. Then the organisation must enforce these through constant application of the management system components, and be able to provide evidence of internal compliance with our AI management system.
The two standards answer different questions. ISO 27001 asks whether information is protected. ISO42001 asks organisations to determine whether it is appropriate to use that information in an AI system, how the data will be protected from inappropriate use, how this will be monitored and controlled, and how is will be managed in the event of an AI data management failure.
|
|
ISO/IEC 27001 |
ISO/IEC 42001 |
|
Governs |
Information security |
Responsible development and use of AI |
|
Management system |
ISMS (Information Security Management System) |
AIMS (AI Management System) |
|
Annex A controls |
93, across 4 themes (2022 edition) |
38, across 9 control objectives |
|
Core question |
Is our information confidential, accurate and available? |
Is our use of AI accountable, assessed and overseen? |
Because both follow the same ISO management system structure, an existing ISO 27001 program gives you a real head start. Document control, internal audit, management review, corrective action and your risk methodology all extend into the AI scope rather than being rebuilt. You can certify to ISO 42001 without ISO 27001, but many organisations pursuing it already run an ISMS.
We ran our own certification the way we'd run a customer project: scoped, owned and tracked. A few lessons stood out.
You don't need a certificate to get value from ISO 42001. Aligning with it gives you the governance; certification turns that governance into a credential someone else has verified. For most organisations, the sensible path is to align now and certify when there's a commercial reason: a tender requirement, a major customer or an insurer asking for evidence.
If you're starting from scratch, these first steps cost very little:
When you do go for certification, the path is well defined: gap analysis, implementation, a Stage 1 audit of your documented system, a Stage 2 audit of how it works in practice, then annual surveillance audits. Use a certification body accredited for ISO 42001, and book early, as auditor availability is still catching up with demand.
Do we have to build AI to be certified? No. ISO 42001 applies equally to organisations that only use AI.
Does ISO 42001 certify that our AI is safe? No. It certifies that you have a working management system for governing AI. It's evidence of maturity, not a guarantee about any individual system.
Does it make us compliant with the EU AI Act? No. There's significant overlap in the governance themes, but the EU AI Act has its own legal definitions and obligations.
How long does it take? It depends on your starting point and scope. An existing ISO 27001 system shortens the path considerably.
Do companies have to be ISO42001 AIMS certified to sell agentic development? No, but we wanted to have that level of external confidence that we are compliant with the ISO standards for AI systems and agents.
We've done this ourselves, so we can help you do it with less guesswork. Whether you want an AI readiness assessment, help building an AI policy and register, governance for Microsoft 365 Copilot and AI agents, or a gap assessment, we start where you are and focus on governance your people will actually use.
Learn more about our ISO/IEC 42001 certification
This article is general information only and is not legal advice.