By the Aegentra Security Team — NV1-cleared ISO 27001 practitioners · Published 25 July 2026
AI governance has become a job title in Australia faster than anyone planned for. This guide is about the credential behind it — the PECB Lead Implementer pathway for ISO/IEC 42001: the tiers, the experience and project hours each one needs, the exam, the cost, and the roles it opens.
To become a PECB Certified ISO 42001 Lead Implementer you complete the official ISO/IEC 42001 Lead Implementer training, pass the PECB exam, then meet the experience tier you are claiming — five years of professional experience (two in AI management) and 300 hours of AI management system project activity for the full Lead Implementer credential. The entry tier, Provisional Implementer, needs only the exam. Aegentra Academy is an official PECB authorised training partner and runs the course for $849 + GST, with the exam voucher and a free 12-month resit included.
ISO/IEC 42001:2023 is the management-system standard for artificial intelligence — the AI equivalent of what ISO 27001 is for information security. A Lead Implementer is the person who builds and runs that system: the AI inventory, the AI policy, the impact and risk assessments, the Statement of Applicability, the Annex A controls, the training, and the audit readiness. The detail on the standard itself and how organisations get certified is covered in our ISO 42001 certification guide; this page is about the individual credential and the career behind it.
Two clarifications, because they are where most of the confusion sits. First, the Lead Implementer builds the system and the Lead Auditor assesses it — separate credentials and separate career tracks, so see the ISO 42001 Lead Auditor course if assessment is where you are headed. Second, this is a governance role, not a machine-learning role: you will spend your time on accountability, documentation, evidence and decisions, sitting next to data science teams rather than inside them.
Aegentra Academy is an official PECB authorised training partner and delivers the ISO 42001 Lead Implementer course online and self-paced, with instructor-led delivery available on request. Foundation-level grounding is available through the ISO 42001 Foundation course.
“Lead Implementer” is not a single pass/fail credential — it is the third rung of a four-tier ladder. All four tiers sit the same exam. What separates them is the professional experience and the hours of hands-on AI management system work you can evidence. You pass the exam once, then climb as your career grows.
| Credential tier | Total experience | In AI management | AIMS project hours |
|---|---|---|---|
| Provisional Implementer | None | — | 0 |
| Implementer | 2 years | 1 year | 200 |
| Lead Implementer | 5 years | 2 years | 300 |
| Senior Lead Implementer | 10 years | 7 years | 1,000 |
These are PECB scheme requirements, not requirements of the ISO standard itself — confirm the current criteria on the official PECB ISO/IEC 42001 Lead Implementer page. Every tier also requires signing the PECB Code of Ethics.
Two things are counted separately. Professional experience is your years of work, with a minimum specifically in AI management — one year for Implementer, two for Lead Implementer, seven for Senior Lead Implementer. Project activity hours are hands-on hours doing the AIMS work itself. This is the part people underestimate and then, later, cannot evidence. If you are already doing any of the activities below in a GRC, privacy, risk, audit or security role, you are banking hours right now and should be logging them with dates and outputs.
One caution on the last item: hours spent preparing for an internal audit count, and so do hours supporting one — but an organisation generally needs an independent pair of eyes on its own AIMS before a certification audit. We run that as a service, an ISO 42001 internal audit, precisely because the person who built the system cannot credibly audit it.
Australia has not legislated an AI act, and no Australian law currently requires ISO 42001. The demand is arriving through a different door — contracts, procurement, and offshore regulation. Four pressures account for most of it.
None of that guarantees a hiring boom, and it is worth being honest about that: AI governance is a young field and titles are still settling. What is observable today is that the questions are being asked — in questionnaires, in contracts, in board packs — and very few people can answer them with a defensible framework behind the answer. That gap is the opportunity.
The credential maps onto a cluster of roles that barely existed three years ago and now appear regularly in Australian job ads. Most sit inside risk, GRC or security functions rather than engineering ones. Ranges below are indicative AUD base salaries drawn from public Australian technology, risk and cyber-security salary guides — a guide to the market, not a quote, and a thinner market than the equivalent information-security roles.
| Role | Indicative AUD base |
|---|---|
| GRC Manager (AI) | $130k–$170k |
| Responsible AI Manager | $140k–$185k |
| AI Risk & Compliance Manager | $145k–$190k |
| AI Governance Lead | $155k–$205k |
| Head of AI Assurance | $190k–$255k |
The two standards share the Annex SL high-level structure that ISO uses across all its management-system standards. Clauses 4 to 10 are the same skeleton in both: context, leadership, planning, support, operation, performance evaluation, improvement. That is why experienced ISO 27001 practitioners convert quickly — the machinery is familiar, and only the subject matter changes.
| ISO 27001 Lead Implementer | ISO 42001 Lead Implementer | |
|---|---|---|
| System built | Information Security Management System (ISMS) | AI Management System (AIMS) |
| Clause structure | Annex SL clauses 4–10 | The same Annex SL clauses 4–10 |
| Risk lens | Confidentiality, integrity, availability of information | Harms from AI systems — bias, drift, opacity, misuse, oversight |
| Assessment artefact | Risk assessment and treatment plan | Risk assessment plus AI system impact assessment (AIIA) |
| Control set | Annex A controls of ISO/IEC 27001:2022 | 38 Annex A controls of ISO/IEC 42001:2023 |
| Typical background | Security, IT, GRC | Security, GRC, privacy, risk, audit — often the same people |
In practice a great many practitioners hold both, and integrate the two systems rather than running them in parallel — one risk register, one internal audit programme, one management review, with AI treated as an additional scope. If you are coming the other way and want the information-security credential first, the companion guide is how to become a certified ISO 27001 Lead Implementer. If your organisation needs the AI Management System built rather than a person trained, that is our ISO 42001 implementation service.
It is worth it if you want to own AI governance rather than advise on it from the sidelines. ISO 42001 is currently the only certifiable international management-system standard for artificial intelligence, so it is the framework Australian organisations reach for when a customer, a regulator, or a board asks how AI is controlled. The credential is early-mover territory — the supply of people who can genuinely stand up an AIMS is small relative to the number of organisations that have just realised they need one. If your role has nothing to do with AI risk, governance, or compliance, the return is much weaker.
No. There is no prerequisite credential and you can enrol in the ISO 42001 Lead Implementer course without any ISO 27001 background. That said, ISO 42001 uses the same Annex SL management-system structure as ISO 27001 — context, leadership, planning, support, operation, evaluation, improvement — so practitioners who already run an ISMS learn the AIMS material considerably faster and often integrate the two systems rather than running them separately.
Around 30 to 40 hours of study, self-paced online, which most people spread across a few weeks alongside their job. The exam itself is three hours, open book, remotely proctored, with a 70% pass mark. Instructor-led delivery is available on request.
Aegentra Academy runs the official PECB ISO 42001 Lead Implementer course for $849 + GST as self-study, and $928 + GST for the eLearning option. Both include the official PECB exam voucher and one free resit within 12 months, so there is no separate exam fee. A GST tax invoice with our ABN is issued at checkout for reimbursement.
Take Lead Implementer if you will build the AI Management System: writing the AI policy, running impact assessments, implementing Annex A controls, and getting an organisation ready for certification. Take Lead Auditor if you will assess someone else’s system — as an internal auditor, a consultant reviewing clients, or working toward audit work for a certification body. Most people in industry roles want Lead Implementer; auditing is a separate career track with its own credential.
Yes. PECB is accredited by ANAB (the ANSI National Accreditation Board) under ANSI/ASTM E2659-24, and the credential is issued against the international ISO/IEC 42001:2023 standard rather than an Australian scheme. It is verifiable online, which matters when it appears in a tender response or a capability statement.
Both, and they are separate things. Individuals earn a professional credential like Lead Implementer. Organisations get certified by building an AI Management System and passing an audit by an accredited certification body — the outcome is an organisational certificate. Aegentra delivers that implementation work as a service, and runs AIMS internal audits for organisations that need an independent check before a certification audit.
No. The Lead Implementer role is governance, not model development. You need to understand enough about how AI systems are built and behave to ask the right questions — training data, model lifecycle, evaluation, drift, human oversight — but you are not expected to train models or write code. The people who do best in the role come from GRC, risk, privacy, audit, and information security backgrounds, and work alongside data science teams rather than inside them.
Ready to start? Aegentra Academy is an official PECB authorised training partner and runs the ISO 42001 Lead Implementer course for $849 + GST, exam voucher and free 12-month resit included, with instructor-led delivery available on request. More field notes are on the Aegentra Insights hub.