What Is ISO/IEC 42001, and Does Your Business Need an AI Management System?
ISO/IEC 42001 is the international, certifiable standard for an AI management system: the policies, roles, risk processes and controls an organisation uses to govern AI responsibly. Most Australian businesses do not need certification, but many benefit from using it as a blueprint for proportionate AI governance.
Written and reviewed by The Technology Office · Independent technology advisory
Key takeaways
- ISO/IEC 42001:2023 specifies requirements for establishing, running and improving an AI management system, and it can be independently certified.
- It follows the same management system structure as ISO/IEC 27001, so organisations with an information security system can extend it.
- Certification makes most sense for AI developers, AI-heavy service providers and businesses whose customers or tenders demand it.
- Every business using AI can borrow its core elements, such as an AI policy, an AI inventory, risk and impact assessments and clear accountability, without seeking certification.
The short answer
ISO/IEC 42001 is the international standard for an AI management system: a structured, auditable way to govern how your organisation develops, buys and uses AI. It is voluntary and certifiable. Most Australian businesses do not need certification, but almost any business using AI can use the standard as a blueprint for governance that is proportionate and defensible.
What exactly is ISO/IEC 42001?
ISO/IEC 42001:2023 was published by ISO and IEC in late 2023 and has been adopted in Australia as AS ISO/IEC 42001:2023. It specifies requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system, usually shortened to AIMS.
A "management system" is not software. It is the set of policies, roles, processes and records an organisation uses to manage a topic consistently. ISO 9001 does this for quality and ISO/IEC 27001 for information security. ISO/IEC 42001 does it for AI.
The standard applies whether you build AI models, embed AI into products, or simply use AI tools such as copilots, chatbots and AI features inside SaaS platforms.
What does the standard actually require?
ISO/IEC 42001 uses the harmonised structure common to modern ISO management system standards. The core clauses cover:
| Clause area | What it asks you to do | Practical example |
|---|---|---|
| Context | Understand your AI uses, stakeholders and obligations | List the AI systems in use and who they affect |
| Leadership | Set an AI policy and assign accountability | Executive approves an AI policy and names an AI owner |
| Planning | Assess AI risks and impacts and set objectives | Risk and impact assessment for an AI recruitment tool |
| Support | Provide resources, competence and awareness | Staff training on approved AI tools and data rules |
| Operation | Run the controls across the AI lifecycle | Testing before deployment, supplier checks, change control |
| Performance evaluation | Monitor, measure, audit and review | Quarterly review of AI incidents and model performance |
| Improvement | Fix nonconformities and improve | Update controls after an AI output error reaches a customer |
Annexes provide reference controls and implementation guidance, covering topics such as AI policies, internal organisation, resources, impact assessment, lifecycle management, data, information for interested parties, responsible use and third-party relationships. As with ISO/IEC 27001, you decide which controls apply and document why.
Two elements are distinctive. First, AI system impact assessments look beyond business risk to consider effects on individuals, groups and society. Second, the standard expects you to manage AI across its whole lifecycle, from design or procurement through to retirement.
Who should consider certification?
Certification means an accredited certification body audits your AIMS against the standard. It is a meaningful investment of time and effort, so match it to a real need.
| Your situation | Certification? | Suggested approach |
|---|---|---|
| You develop AI products or AI-enabled software for clients | Often worthwhile | Plan towards certification, ideally integrated with ISO/IEC 27001 |
| Enterprise or government customers ask for it in tenders | Likely | Confirm what evidence they actually require, then scope accordingly |
| You use AI heavily in decisions about customers or staff | Possibly | Build an aligned framework first and reassess in 12 months |
| You mainly use copilots and AI features in standard SaaS | Rarely | Adopt the core elements without certification |
| You are a small business starting with AI | No | Start with an AI policy, inventory and simple risk checks |
The honest answer for most mid-sized Australian businesses is that alignment delivers most of the value. Certification earns its keep when it unlocks revenue or meets a firm customer requirement.
How can you use ISO 42001 without getting certified?
Treat the standard as a well-tested checklist. A proportionate version for a mid-sized business could include:
- An AI policy approved by the executive, setting principles, approved tools and prohibited uses.
- An AI inventory of every AI system and AI feature in use, with an owner for each.
- Risk and impact screening for each use case, scaled to its potential harm.
- Controls for higher-risk uses, such as human review of outputs, testing, logging and supplier due diligence.
- Training and awareness so staff know what data can and cannot go into AI tools.
- A review rhythm, where AI risks, incidents and new requests are considered quarterly by management, with a summary to the board.
That structure mirrors the standard and makes certification easier later if you need it. Our guide to building an AI governance framework goes into each step.
How does ISO 42001 fit with Australian regulation?
Australia does not currently have AI-specific legislation that requires ISO/IEC 42001. AI use is governed through existing laws, including privacy, consumer protection, anti-discrimination and sector-specific rules, supported by voluntary government guidance. We summarise the current position in Australian AI regulation for business.
Privacy deserves particular attention. The OAIC has published guidance on privacy and the use of commercially available AI products, and Privacy Act changes require transparency about certain automated decisions from 10 December 2026. An AIMS gives you a natural home for that work: the AI inventory, impact assessments and supplier reviews all feed directly into privacy compliance.
This is general information, not legal advice.
What are the common pitfalls?
- Starting with documentation instead of an inventory. You cannot govern AI you have not found, including AI features switched on inside existing software.
- Treating it as an IT-only project. AI risk involves legal, HR, operations and customer teams.
- Over-engineering low-risk uses. A meeting-notes assistant does not need the same scrutiny as an AI tool that screens job applicants.
- Separating it from security and privacy. Running ISO/IEC 42001 alongside your existing security and privacy processes avoids duplicated effort.
- Certifying for the badge. If no customer or regulator values the certificate, put the effort into controls instead.
What should boards ask?
Directors do not need to read the standard, but they should be able to get clear answers to these questions:
- Do we know every AI system we use, and who owns each one?
- Which AI uses could materially affect customers, staff or our reputation?
- What controls apply to those higher-risk uses, and are they working?
- Would ISO/IEC 42001 certification help us win or keep business?
For more on director responsibilities, see AI governance for boards.
Getting AI governance right with The Technology Office
The Technology Office helps Australian businesses decide how much of ISO/IEC 42001 they actually need, then build it. We are independent and vendor-neutral, so our advice is not tied to a certification body, an AI platform or a software licence. We bring a CIO-level and board perspective that connects AI governance to strategy, risk appetite and commercial reality.
Through our AI governance consulting, we design right-sized AI policies, inventories and risk processes that align to the standard, and we prepare organisations for certification when there is a clear business case. We work with businesses of any size and in any industry across Australia, and we report to boards in plain English, not standards jargon.
Frequently asked questions
What is ISO 42001 in simple terms?
It is an international standard that sets out how an organisation should govern AI through a management system: an AI policy, defined roles, risk and impact assessments, controls, monitoring and continual improvement. It applies to organisations that develop, provide or use AI.
Is ISO 42001 mandatory in Australia?
No. It is a voluntary standard, adopted locally as AS ISO/IEC 42001:2023. Some customers, tenders or partners may ask for it, but no general Australian law requires certification.
How is ISO 42001 different from ISO 27001?
ISO/IEC 27001 manages information security risk, while ISO/IEC 42001 manages risks specific to AI, such as bias, transparency, misuse and impacts on people. They share the same structure, so they can be run as one integrated management system.
Can a small business get ISO 42001 certified?
Yes, the standard is designed to scale, but certification involves documented processes, internal audit and external audits. For many small businesses, a lighter AI governance framework aligned to the standard is a better first step.
Does ISO 42001 align with Australian AI guidance?
Broadly, yes. Australia's voluntary AI guidance from the National AI Centre covers similar ground, including accountability, risk management, testing and human oversight, so work done against ISO/IEC 42001 supports both.
Sources and further reading
- Guidance on privacy and the use of commercially available AI products — Office of the Australian Information Commissioner
Mentioned services
These service and regional NSW pages expand on the topics covered in this article.
Need help applying this?
Bring in senior technology leadership without the full-time overhead.
The Technology Office works with Sydney and regional NSW businesses on embedded CIO support, Head of IT leadership, governance, vendor management, cost optimisation, crisis stabilisation, and no-cost technology reviews as a lighter first step.