Build an AI management system in New Zealand and carry it through to an ISO/IEC 42001 certificate.
The route runs from a register of the AI you use to a certificate an accredited auditor signs off, with yearly surveillance after it. Below are the six steps in the order the work happens, what each one leaves on file, and where we come in.
Typical clients
First step
Register every AI system and measure the gap against the standard.
Records in hand at the end
- A register of each AI system, who is accountable for it and who approved it
- A scope statement written for the buyers who will read your certificate
- A rating of today's position on clauses 4 to 10 and the 38 controls
- Clause 6.2 objectives the board can track
The register comes first. It takes in vendor features, models built in house and the generative tools staff picked up on their own. The Privacy Commissioner expects senior leaders and the privacy officer to take part in generative AI decisions, so each line records who approved the tool as well as who runs it.
The boundary follows from the register. A vendor to government writes a scope an evaluator will read as covering the service in the contract. GCDO procurement guidance tells agencies to build AI risk assessment into their procurement plans, and the Government Procurement Rules contain nothing AI specific, so the questions you face come from the agency's own plan.
Last comes the gap score. Every clause and control is rated against what exists today, and the ratings turn into a plan with owners and dates. Plan on 2 to 4 weeks for this first step. The score then sets the length of the whole programme: 4 to 6 months to stage 2 with ISO 27001 or a similar management system already running, 9 to 12 months for a mid-size organisation starting from scratch, and 12 to 18 months for a large or multi-entity group.
From practice
Which designation goes in the tender. Buyers here search for "ISO 42001 2025" and assume a revision exists. NZS ISO/IEC 42001:2025 reproduces ISO/IEC 42001:2023 word for word, and the year marks the adoption. Cite the NZS designation in tenders and board papers, because it shows the text has been through the national process.
The Public Service AI Framework tells agencies to work with commercial and security colleagues on procurement and assurance of AI tools and makes no mention of ISO 42001, so your certificate is evidence an agency can accept without a rule telling it to ask.
Our part
We lead the register workshops, write the boundary with your executive sponsor and hand over the gap rating with a plan.
Second step
Design the system around New Zealand law and data.
Records in hand at the end
- An AI policy and a risk method on ISO/IEC 23894
- One impact assessment process under clause 6.1.4 that carries the PIA and the Te Tiriti analysis
- A roles matrix fitted to how your organisation is governed
- Data controls with a classification step for Māori data
- Supplier controls that record where each model runs
- The Statement of Applicability
The standard is international and the evidence an auditor reads is local, so four parts of the build are written for this country. Allow 3 to 5 months to write and approve the full set.
The impact assessment comes first. The Algorithm Charter asks public agencies to weigh impacts on Māori and on fairness, and a privacy impact assessment is expected before any AI tool goes live. One process under clause 6.1.4 produces both.
Data controls under A.7 include a classification step for Māori data drawn from Te Kāhui Raraunga's Māori Data Governance Model, with provenance recorded for anything used in training or fine-tuning. Where iwi engagement or collective consent is needed, the control names the partner, and we say plainly when a Māori data specialist should lead.
Supplier controls under A.10 are written for a market that imports nearly all its AI. They record where each model runs, what the contract says about data use and residency, and the fallback when a provider changes terms. MBIE's AI Procurement Checklist, covering supplier capability, legal compliance and data governance terms, becomes the onboarding control.
Clause 5.3 roles map to the chief executive, the privacy officer under the Privacy Act, the board or Crown entity board and, in agencies, the official who signs Algorithm Charter commitments.
The Statement of Applicability then justifies each of the 38 controls in or out. Exporters to the EU keep logging and technical documentation in scope. ISO 42001 is not a harmonised standard under the EU AI Act and gives no presumption of conformity. EN 18286:2026 maps its Annex D to 42001 Annex A, so controls built here carry across.
From practice
One signature from the privacy officer. A firm putting a generative tool over customer records runs a single impact assessment. Its privacy section tests the tool against the 13 information privacy principles, its Te Tiriti section records any Māori data in the inputs and how that data is classified, and the privacy officer signs the whole record once. At stage 2 the auditor samples that one record.
The Privacy Commissioner applies all 13 information privacy principles to AI tools and expects a privacy impact assessment before use.
Our part
We write the policy, both methods, the controls and the Statement of Applicability alongside your owners, following the Evidence-First Method.
Third step
Operate the system for three months or more to build a record.
Records in hand at the end
- Risk and impact assessments completed on live systems, with treatments logged
- Monitoring results and staff competence evidence
- Internal audit findings, each one closed
- Management review minutes that show decisions
Stage 1 checks that the system has been used, and a shelf of signed policies will not pass that check. Three months of operating records is the minimum we plan for.
Run the risk process under clause 8.2 and the impact process under 8.4 on the systems inside the boundary, log the treatments and let monitoring results accumulate. Train the staff who build and use AI, and file the evidence of their competence.
The step ends with an internal audit under clause 9.2 by someone outside the AI function, its findings closed under 10.2, and a management review under 9.3 with the decisions minuted. Both have to be on the table at stage 1.
From practice
An adviser business under FMA review. The FMA's thematic review of AI in financial advice covers governance, oversight, suitability, record keeping and consumer outcomes. A licensed adviser business that has completed this step already holds what the review asks about: technical documentation under A.6.2.7, rules for staff use under A.9 and named roles under clause 5.3.
Our part
We can act as the independent internal auditor, and we prepare the pack for the management review.
Further reading
Fourth step
Engage an accredited auditor and clear stage 1.
Records in hand at the end
- A contract with a body accredited for ISO/IEC 42001
- The auditor's stage 1 findings
- A stage 2 booking 4 to 8 weeks out, with room to resolve them
JAS-ANZ is the joint accreditor for both countries, so a body it has accredited for ISO 42001 audits here without a separate New Zealand accreditation. ISO/IEC 42006:2025 sets the AI-specific requirements those bodies are assessed against, on top of ISO/IEC 17021-1.
Choose a body that is JAS-ANZ accredited for ISO 42001 and confirm the scope line naming ISO/IEC 42001 on the JAS-ANZ register before you engage. Accreditation rules keep implementation and audit apart, so the body you choose cannot have helped build your system.
At stage 1 the auditor reads the scope, the AI policy, the risk and impact methods and the Statement of Applicability, and looks for proof that the internal audit and the management review have happened, over 1 to 2 days in person or remote. Concerns are written up, and stage 2 is booked 4 to 8 weeks later to leave time to resolve them.
From practice
Picking a body that fits what you already hold. A Wellington health software provider with ISO 27001 asks its current certification body whether ISO/IEC 42001 sits in its JAS-ANZ scope. It does not, so the provider finds a body on the register that holds both and books one combined stage 1.
Our part
We shortlist the accredited bodies, put the document pack together, attend stage 1 and work through each concern before stage 2.
Further reading
Fifth step
Clear stage 2 and receive the certificate.
Records in hand at the end
- Stage 2 nonconformities closed, with evidence
- A three-year certificate naming the scope, carrying the accreditation mark and giving the dates
At stage 2 the auditor watches the system run. That takes 2 to 5 days, depending on how many systems sit inside the boundary. Staff are interviewed, processes observed and the records from the third step sampled. Nonconformities are closed before a certification decision is made.
The certificate attests to how AI is managed inside the stated scope and makes no claim that a given model is safe or fair.
From practice
A stage 2 sample at a SaaS provider. The auditor picks systems from the register and asks each owner to walk through the latest impact assessment. One logged treatment does not match what runs in production, so it becomes a minor nonconformity, closed with evidence before the certification decision.
The Public Service AI Framework delivers accountability through reporting, auditing and independent review, and a certificate from an accredited body is independent review an agency can put on file.
Our part
We brief the staff who will be interviewed, sit in on stage 2 and drive corrective actions to closure.
Sixth step
Hold the certificate through yearly surveillance.
Records in hand at the end
- A surveillance report from each of the first two years
- Supplier records and a Statement of Applicability kept current as systems change
- A full recertification audit in year three
Surveillance visits of 1 to 2 days happen at least once a year in years one and two. Each tests a sample of the system and follows up earlier findings. Year three brings a full audit that starts the next cycle. Holders of ISO 27001 can have both standards audited together, since five of the seven requirement clauses share a structure.
Between visits, risk assessments repeat on schedule and whenever a system changes in a significant way, and the AI policy is reopened when something outside the organisation moves.
From practice
Supplier concentration at a surveillance visit. The RBNZ treats reliance on a small number of overseas AI providers as a systemic vulnerability. When a provider changes its terms or you move to a new model, the A.10 supplier record and the fallback are updated, and the surveillance auditor follows that change through.
When the FMA publishes findings from its review of AI in financial advice, treat them as a trigger for the policy review that control A.2.4 requires.
Our part
Under ongoing advisory support we run the yearly internal audit and management review and keep the supplier records up to date.
Further reading
Common questions about ISO 42001 in New Zealand.
Is NZS ISO/IEC 42001:2025 a newer version of the standard?
No. NZS ISO/IEC 42001:2025 is an identical reproduction of ISO/IEC 42001:2023, and the year in the designation is the adoption year. Australia's AS ISO/IEC 42001:2023 and the NZ edition are the same text.
Which certification bodies can audit us in New Zealand?
Any body JAS-ANZ has accredited for ISO 42001, because that accreditation covers New Zealand and Australia alike. Check the body on the JAS-ANZ register before you engage it.
Does any New Zealand government document reference ISO 42001?
Yes. MBIE's Responsible AI Guidance for Businesses lists ISO/IEC 42001:2023, ISO/IEC 23894:2023 and ISO 31000:2018 as frameworks businesses can use. The Public Service AI Framework does not mention it.
Has a New Zealand organisation been certified yet?
To confirm a claim, ask the organisation for its certificate and read the scope printed on it. Then look up the issuing body on the JAS-ANZ register to confirm it is accredited for ISO 42001.
How do the Privacy Act 2020 and Te Tiriti fit into the management system?
The 13 information privacy principles apply to AI tools, and the Privacy Commissioner expects a privacy impact assessment before use. Both sit inside the clause 6.1.4 AI system impact assessment. Māori data governance questions, including classification and collective consent, are documented in the same assessment and in the A.7 data controls.
Will the certificate help with government tenders?
The Government Procurement Rules are not AI specific, and GCDO guidance asks agencies to build AI risk assessment into procurement plans. A certificate from an accredited body answers the assurance questions an agency is told to ask, and NZS ISO/IEC 42001:2025 gives you a national designation to cite in the response.
Engagements that feed the AIMS.
The clause 8.2 assessment for one system, before deployment.
The clause 6.1.4 process, with the PIA and Te Tiriti analysis inside it.
A.10 supplier controls for the overseas providers RBNZ is worried about.
An independent clause 9.2 internal audit, or a readiness gap score on its own.
Scope your route to an ISO 42001 certificate.
A scoping conversation starts the register from the first step, tells you how far your current controls sit from stage 1 and names the accredited body that fits your existing certifications.