FIELD NOTES / BUYER’S GUIDE

ISO 42001 in Australia: what it is, who certifies and do you need it?

Understand the AI management system standard, how certification works in Australia, which bodies certify, what it costs, and whether the free government guidance is enough for you.

By Find AI Consultants · AI-assisted research and writing · Updated 24 October 2026

Quick answer

ISO/IEC 42001 is the international standard for an AI management system: the policies, roles, risk processes and records an organisation uses to govern the AI it builds, provides or uses. It was published in December 2023.
Australia adopted it word for word as AS ISO/IEC 42001:2023 on 16 February 2024.
It is voluntary. Certification is optional and is done by an independent certification body, not by Standards Australia or the government.
Most smaller organisations can start with the free government Guidance for AI Adoption. Certification makes sense when customers, tenders or insurers ask for independent proof.

What ISO/IEC 42001 is.

It is a management system standard, like ISO 27001 for information security or ISO 9001 for quality. It does not test whether a particular AI model is accurate or safe. It checks that your organisation has a working system for governing AI: who is accountable, how risks and impacts are assessed, which controls apply, and how it all gets reviewed and improved. It applies to organisations of any size that develop, provide or use AI, including those that only use AI tools.

The requirements sit in clauses 4 to 10: context and scope, leadership and AI policy, planning (risk assessment, risk treatment and AI system impact assessment), support, operation, performance evaluation and improvement. Annex A lists reference controls covering areas such as AI policy, roles, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems and third-party relationships. You choose the controls that fit your risks and record the choice, usually in a Statement of Applicability.

Related standards
Standard	What it is	Can you be certified?
ISO/IEC 27001:2022	Information security management. Same structure as 42001, so the two can run together	Yes
ISO/IEC 22989:2022	AI concepts and terminology, referenced by 42001	No
ISO/IEC 23894:2023	Guidance on AI risk management	No
ISO/IEC 42005:2025	Guidance on AI system impact assessments	No
ISO/IEC 42006:2025	Rules for the bodies that audit and certify against 42001	Not for you; it applies to certifiers

In short: 27001 is about protecting information; 42001 is about governing how you build and use AI. Organisations that already hold 27001 often add 42001 because the audit approach is the same.

ISO 42001 in Australia.

Standards Australia adopted the standard as AS ISO/IEC 42001:2023, identical to the international text. At the time of checking, the Standards Australia Store listed it at A$260.82 including GST for one personal licence. Standards Australia also publishes a free whitepaper, “Understanding 42001”.

The government’s current guidance is the National AI Centre’s Guidance for AI Adoption ↗ (October 2025), built on six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It evolves the earlier Voluntary AI Safety Standard ↗ (2024), which named AS ISO/IEC 42001 as the main international standard it drew on.

The government guidance is free and has no certificate. ISO 42001 covers similar ground in a formal, auditable form, so work on the essential practices is a reasonable starting point. We found no official mapping between the two. If you need an AI policy and register first, start with our AI governance guide.

Who certifies in Australia.

Consultants help you prepare; certification bodies audit you; an accreditation body checks the certification bodies. In Australia and New Zealand that accreditation body is JAS-ANZ, which lists an Artificial Intelligence Management System Scheme.

Accreditation as stated in each source, checked 24 October 2026. Alphabetical, not a ranking.
Certification body	Accreditation for 42001 (as stated)	Source
A Good Certification Group	JAS-ANZ, reported September 2026	Trade press ↗ (we could not find the company’s own page)
BSI	UK, Dutch and US accreditation bodies; JAS-ANZ not mentioned	BSI Australia ↗
Compass Assurance Services	A JAS-ANZ accreditation number appears on a 42001 certificate it issued	Client certificate ↗
Intertek SAI Global	JAS-ANZ; says it was the first body accredited for 42001	Own announcement ↗

Before you engage a certifier, ask for its accreditation certificate and scope, or check the JAS-ANZ register. Other global certifiers have 42001 services overseas; we could not confirm they certify to 42001 in Australia. Certification bodies say they keep consulting separate from certification, so the business that helps you prepare should not be the one that certifies you.

What the certification process looks like.

Typical steps, compiled from published certifier guidance. Each certifier’s process differs.

Get the standard and leadership support.
Decide your AI role (user, developer, provider or several) and the scope of the management system.
Run a gap analysis against the standard.
Build the system: AI policy, roles, risk and impact assessment, chosen controls and records.
Operate it for a while, including at least one internal audit and one management review.
Stage 1 audit: the certifier reviews documents, scope and risk assessment, and plans stage 2.
Stage 2 audit: the certifier checks the system works in practice. Major nonconformities must be fixed first.
Certificate issued, followed by surveillance audits and renewal every three years. One certifier describes surveillance audits as normally every six months; frequency varies.

Cost and time.

None of the certification bodies we checked publishes a fee. Fees depend on scope and audit days, so ask at least two certifiers for written quotes. Buying the Australian edition of the standard cost A$260.82 at the time of checking. Consultant preparation is extra, and few providers publish prices.

Timelines vary. TechnologyOne reported certification in five months, building on an existing compliance program. That is one large organisation’s experience, not a typical timeline.

Australian organisations that say they are certified.

Examples with a primary source, as published. This is not a complete list, and there is no authoritative count of certified Australian organisations.

Organisation	Certifier (as published)	Date (as published)
Clayton Utz ↗	Not named	9 June 2026
de.iterate ↗	Not named	Not dated
KPMG Australia ↗	BSI	16 October 2024
ReadyTech ↗	Compass Assurance Services	Certified 6 January 2026
Revio ↗	Not named on its own page	Not stated
Sekuro ↗	BSI	20 April 2026
TechnologyOne ↗	Not named	29 September 2025

Do you need it?

Certification is a way to prove your AI governance to outsiders. If nobody outside is asking for proof, the free government guidance gets you most of the benefit.

Worth considering when

Enterprise or government customers ask for it in security questionnaires, tenders or contracts.
Insurers or clients ask how you manage AI risk.
You build or sell AI products, so customers rely on your controls.
You already hold ISO 27001 or ISO 9001 and can extend the same system.

The free guidance is probably enough when

You mainly use off-the-shelf AI tools in low-risk ways.
No customer, regulator or insurer has asked for certification.
You do not yet have an AI policy, owner or register.

A middle path: use the standard as a reference without certifying. “Aligned with ISO 42001” is not the same as “certified”, so ask any provider which one they mean.

Questions to settle first: What is in scope, the whole organisation or one product? Is the goal certification or alignment? Which certification body, and who accredits it for 42001? Who owns the system after the consultant leaves?

Who can help you prepare.

These listings mention ISO/IEC 42001, AI management systems or audit readiness in their published material. Inclusion is not an endorsement or a check of their competence, and alignment work is not certification.

Aspire Sharp Consulting frames its AI management-system work around ISO/IEC 42001.
DigiRen describes governance policies, intake and decision rights aligned to ISO 42001 (alignment, not certification).
Envisyo lists AI policies, inventory, risk assessment and AI-management-system readiness, and advertises ISO/IEC 42001 alignment.
Scale Edge AI offers readiness assessments, evidence packs, audit preparation and training that reference ISO/IEC 42001.
Argen describes AI risk controls and management-system readiness.
Complyd describes AI governance and ISO audit readiness.
AI Strategy Consulting describes governance and management-system support.

For broader AI governance help, browse governance providers, then use the proposal checklist.

Common questions.

Is ISO 42001 mandatory in Australia?

No. It is voluntary, as is the government’s Guidance for AI Adoption.

Is there an ISO standard for AI?

Several. ISO/IEC 42001 is the one you can be certified against. Others, such as 22989, 23894 and 42005, are terminology or guidance.

Who can certify ISO 42001 in Australia?

Independent certification bodies. Check that the one you choose is accredited for 42001, for example on the JAS-ANZ register.

How much does certification cost?

No certifier we checked publishes fees. Quotes depend on scope and audit days. Preparation help from a consultant is extra.

Can a consultant certify us?

No. Consultants help you prepare; an independent certification body audits and certifies you.

What is an ISO 42001 lead implementer or lead auditor?

A training credential for people who build or audit an AI management system. It is not the same as your organisation being certified.

Sources and review scope

Find AI Consultants prepared this AI-assisted guide from the pages below, checked on 24 October 2026. It is not legal advice and does not assess any certifier’s or consultant’s competence.

Find relevant consultants ↗