Take your organisation from no AI management system to an ISO/IEC 42001 certificate in Australia.
The path has six steps. You list your AI and score the gap, build the management system, and run it for three months or more so it has records. A JAS-ANZ accredited auditor then takes you through stage 1 and stage 2, and annual surveillance keeps the certificate valid for its three years. Each step below sets out the work, the documents you hold once it is done, and the part PolyGovern takes on.
Who this is for
Step 01 of 06
Draw the scope from an AI inventory, then score the gap.
You finish this step holding
- An AI inventory with a named lifecycle owner for every system
- A draft scope statement under clause 4.3
- A gap score against clauses 4 to 10 and all 38 Annex A controls
- A dated programme plan the board has approved
Start with the inventory. Every AI system in use goes on it, including Copilot seats, AI features switched on inside SaaS products and models your developers call through an API. Each entry gets an owner who answers for the system from design to retirement.
The inventory sets the scope. Clause 4.3 asks you to name the AI systems, business units, sites and processes the management system covers, and that wording ends up printed on the certificate. Draw it wide enough for a procurement reviewer to read it as covering the service they buy, and narrow enough to certify in one cycle. An APRA entity begins with the systems that support a critical operation under CPS 230. A supplier to Commonwealth agencies begins with the product those agencies buy, since the DTA's AI technical standard applies to AI an agency procures as well as AI it builds.
With the scope drafted, we rate the organisation against each clause from 4 to 10 and each of the 38 controls. The ratings become the programme plan. Allow 2 to 4 weeks for the rating.
Worked example
A Sydney practice management software company scopes the full lifecycle of its AI systems and lists every product line that carries an AI feature. Because the scope uses product names its customers already know, a buyer can tell at a glance which systems sit inside the boundary.
APRA's letter to industry on AI expects an AI inventory with an owner across each system's lifecycle, so this first document serves the supervisor and the auditor at once.
What we do
We run the inventory workshops, draft the scope with your accountable executive and deliver the gap score with a dated plan.
Step 02 of 06
Build the management system and write the Statement of Applicability.
You finish this step holding
- An AI policy approved by the board or accountable executive
- Roles and accountabilities under clause 5.3
- An AI risk method and an AI system impact assessment method
- The Statement of Applicability, with each of the 38 controls justified in or out
- AI objectives under clause 6.2 and a controlled document set
Clauses 5 to 7 set the frame. The AI policy is approved at the top, and the roles under clause 5.3 line up with FAR accountabilities where they apply. The full build, from policy to Statement of Applicability, takes 3 to 5 months.
Clause 6 calls for two methods. We build the risk method on ISO/IEC 23894 and seed it with the risk sources listed in Annex C of the standard. The impact method follows ISO/IEC 42005 and answers clause 6.1.4, a requirement no other Annex SL management standard has: a documented way to assess consequences for individuals, groups and society.
Clause 6.1.3 then produces the Statement of Applicability. None of the 38 controls is mandatory by default. Each is included or excluded with a written justification, and the auditor reads every one. Your vendors belong in it too. A vendor's own ISO 42001 certificate covers its management system, and your A.10 supplier controls still have to assess how you use its AI.
Worked example
The logging decision. A.6.2.8 (event logs) and A.6.2.7 (technical documentation) are optional controls. For a regulated entity we mark both applicable. APRA expects drift monitoring, and drift monitoring depends on the event logs and documentation these two controls produce.
In REP 798, ASIC reviewed 23 AFS and credit licensees, found AI adoption running ahead of governance and flagged a credit model it called a black box. The documented risk and impact assessments from this step are the records that close that gap.
What we do
We draft the policy, both methods and the Statement of Applicability with your owners, then test each justification the way an auditor will.
Step 03 of 06
Run the system for at least three months so it has a record to show.
You finish this step holding
- Completed risk and impact assessments for the systems in scope
- Risk treatment records and monitoring results
- Training and competence records
- An internal audit report with its findings raised and closed
- Minutes of a management review with the decisions recorded
A certification auditor samples evidence that the system has operated. Approved documents with no records behind them will not get past stage 1.
The system now runs on real work. Risk assessments under clause 8.2 and impact assessments under 8.4 are carried out on live systems and kept, treatments are applied, and monitoring results under clause 9.1 build up, drift checks on production models included. Staff complete their training and the competence records under clause 7.2 go on file.
Two events close the step. An internal audit under clause 9.2, run by someone independent of the AI function, raises nonconformities and tracks them to closure under clause 10.2. A management review under clause 9.3 then considers the results and minutes its decisions. Stage 1 will not proceed without both. Schedule both inside that three-month window, with the review after the audit.
Worked example
A first internal audit at a lender. The risk team audits the credit decisioning model under clause 9.2 and finds that drift checks ran but nobody reviewed the results. It raises a nonconformity, closes it under clause 10.2 and takes the closed finding to the management review.
APRA has observed that few entities monitor model drift in real time and that internal audit and risk teams lack AI specialist skills, so the monitoring results and the internal audit report from this step answer the supervisor as well as the auditor.
What we do
We run the internal audit as the independent party or coach your internal audit team through its first one, and we prepare the management review pack.
Step 04 of 06
Choose an accredited body and pass stage 1.
You finish this step holding
- A signed engagement with an accredited certification body
- The stage 1 report and its areas of concern
- A stage 2 date 4 to 8 weeks after stage 1
ISO does not certify anyone. Accredited certification bodies do, and they are assessed against ISO/IEC 17021-1 plus ISO/IEC 42006:2025 for AI management systems. In Australia the accreditor is JAS-ANZ, through its AI Management System Scheme.
Choose a body that is JAS-ANZ accredited for ISO 42001, and check the scope entry that names ISO/IEC 42001 on the JAS-ANZ register before you sign. The body you pick cannot have built your system, which is why implementation support and the audit are two separate engagements. If you already hold ISO 27001, ask for both standards to be audited together.
Stage 1 is a review of the documents and runs 1 to 2 days, on site or remote. The auditor reads the scope, the AI policy, the risk and impact methods, the Statement of Applicability, the internal audit results and the management review minutes. Areas of concern go into a report. Set stage 2 for 4 to 8 weeks later so there is time to fix them.
Worked example
Checking a body before you sign. A procurement team asks each shortlisted body for a sample certificate, takes the accreditation number printed beside the JAS-ANZ mark and looks it up on the register. A certificate issued outside accreditation has no mark and no number to check.
What we do
We shortlist bodies on fit with your existing certifications and sector, assemble the stage 1 pack, attend the review and close each concern before stage 2.
Step 05 of 06
Pass stage 2 and receive the certificate.
You finish this step holding
- Each stage 2 nonconformity closed with evidence
- A certificate valid for three years that states the scope, the accreditation and the dates
Stage 2 tests whether the system runs as written. The auditor interviews staff, observes the processes and samples the records from step 3 to confirm the selected controls work. Allow 2 to 5 audit days. A wider scope sits at the top of that range.
Nonconformities are closed before the certification decision. The certificate then covers the management system within the stated scope and says nothing about whether an individual AI product is safe or fair.
Worked example
Closing a stage 2 finding. The auditor samples impact assessments and finds one completed after its system went live. The organisation logs a corrective action, reruns the assessment and sends the evidence to the certification body ahead of the certification decision.
APRA's letter does not name ISO 42001 and calls its own framework technology and vendor agnostic, so present the certificate as evidence of the globally recognised control framework the letter asks for, within the certified scope.
What we do
We prepare the people who will be interviewed, sit in on stage 2 and run the corrective actions to closure.
Step 06 of 06
Keep the certificate through surveillance and recertification.
You finish this step holding
- A surveillance audit report in each of years one and two
- A Statement of Applicability updated whenever scope or controls change
- A recertification audit in year three and a new three-year certificate
Surveillance audits come at least once a year in years one and two. They take 1 to 2 days, sample part of the system, and follow up earlier findings and any change in scope. In year three a full recertification audit opens the next three-year cycle.
Between audits the system keeps running. Risk assessments are repeated at planned intervals and whenever a system changes significantly. Control A.2.4 requires the AI policy to be reviewed on schedule and when something outside the organisation shifts.
Worked example
A triggered policy review. A new APRA letter to industry or an update to the DTA policy reopens the AI policy for any organisation within its reach. The review, the changes and the approval go into the record the surveillance auditor samples.
AI-enabled services fall under CPS 230 and CPS 234, and CPS 230 has reached every contracted service provider since 1 July 2026, so a new model vendor is a change your next surveillance audit will ask about.
What we do
Through ongoing advisory support we run the annual internal audit and management review cycle and keep the Statement of Applicability current.
Questions Australian boards ask about ISO 42001 certification.
Who can certify an Australian organisation to ISO 42001?
A certification body accredited for ISO 42001 by JAS-ANZ under its AI Management System Scheme, or by another IAF member accreditor. Choose a JAS-ANZ accredited body and check its scope on the JAS-ANZ register before you sign.
Can the certification body also build our AI management system?
No. Accredited certification bodies keep consulting separate from certification, so implementation support and the certification audit are two separate engagements.
How long will our certification take?
Plan on 4 to 6 months from gap assessment to stage 2 if ISO 27001 or a comparable management system is already in place. A mid-size organisation starting without one needs 9 to 12 months, and a large or multi-entity group 12 to 18 months. The gap score from step 1 shows which range you sit in. Within that time the system has to run for at least 3 months, through one internal audit and one management review, before stage 1.
Does APRA require ISO 42001?
No. APRA's letter to industry on AI does not name ISO 42001 or any prudential standard. It expects regulated entities to use globally recognised control frameworks, keep an AI inventory, map suppliers to fourth parties, test exit options and monitor drift. ISO 42001 is the certifiable framework that covers those expectations.
Does an ISO 42001 certificate cover our AI products?
It covers the management system within the stated scope. The standard certifies how AI is managed and says nothing about whether an individual system is safe or fair.
We already hold ISO 27001. How much carries across?
Clauses 4, 5, 7, 9 and 10 share the Annex SL structure, so leadership, documented information, internal audit, management review and corrective action can be extended. AI risk assessment, the AI system impact assessment under clause 6.1.4 and the Annex A lifecycle controls are new work.
Related services.
An independent gap assessment against clauses 4 to 10 when you want the readiness answer before committing to the programme.
The clause 6.1.4 assessment as a standalone engagement, built on ISO/IEC 42005 and the Commonwealth AI Impact Assessment Tool.
The A.10 supplier controls and the CPS 230 material service provider register for foundation-model and SaaS vendors.
Find out how far you are from stage 1.
A readiness review scores your current state against clauses 4 to 10 and the 38 controls, names the accredited body that fits your existing certifications, and sets a programme the board can hold you to. APRA's prudential reviews are already running. The review tells you what they will find.