Question 1

Is ISO 42001 mandatory in Australia?

Accepted Answer

No. ISO/IEC 42001 is voluntary in Australia, but it is the most widely recognised international standard for AI governance. Demand is driven by three things: enterprise procurement now asks AI-specific questions in vendor security questionnaires; the EU AI Act (in force since August 2024, phasing in through 2027) makes AI governance a condition of selling into Europe; and Australian government AI policy — the Voluntary AI Safety Standard and the DTA's responsible-AI policy — increasingly flows to suppliers through contract. A certified AIMS is the efficient way to evidence all three.

Question 2

Do I need ISO 27001 before ISO 42001?

Accepted Answer

No. Neither standard is a prerequisite for the other. But because ISO 42001 shares the Annex SL structure with ISO 27001, an existing ISMS reuses roughly 60% of the framework — context, leadership, risk methodology, internal audit and management review carry straight over. Most Australian AI-led companies implement ISO 27001 first (the wider buyer base understands it) and add ISO 42001 within six to twelve months, run as one integrated management system.

Question 3

How long does ISO 42001 implementation take?

Accepted Answer

For an organisation that already runs an ISO 27001 ISMS, plan on around 12 weeks to audit-ready for a single AIMS scope. Starting greenfield — no ISMS, no model inventory, no AI register — is more realistically 16 to 22 weeks. The practical bottleneck is booking the certification body: JAS-ANZ-recognised bodies are still scaling ISO 42001 capacity, so secure a Stage 2 slot early rather than at the end of readiness.

Question 4

What does ISO 42001 cost in Australia?

Accepted Answer

Aegentra's implementation is fixed-scope and fixed-price, quoted after a short Week 0 discovery, so you know the number before any work begins. Separately, the certification body's own Stage 1 and Stage 2 audit typically runs $10,000–$22,000 AUD for an SMB, with annual surveillance audits from around $2,500 in years one and two and a re-certification audit (roughly $9,000–$17,000) in year three. These external ranges are illustrative and depend on scope and the body you choose.

Question 5

How is this different from an ISO 42001 course?

Accepted Answer

A course certifies a person to implement or audit the standard. This service certifies your company's AI Management System. Aegentra's senior engineers actually build the AIMS inside your tenant, implement and evidence the controls, run the internal audit, and prepare you for the Stage 1 and Stage 2 audit by an accredited certification body. If you want to train your own people, that runs separately through Aegentra Academy.

Question 6

Does ISO 42001 make me EU AI Act compliant?

Accepted Answer

Not automatically. The EU AI Act is binding law; ISO 42001 is a voluntary international standard. Certification does not equal legal compliance on its own, but ISO 42001 is the most defensible AI-governance evidence base a provider or deployer can point to, and the CEN-CENELEC standards being written to support the Act draw heavily on it. For Australian companies selling AI into the EU, an ISO 42001 AIMS is the practical fast lane to demonstrating governance maturity.

Question 7

Which AI systems go in scope?

Accepted Answer

You define the scope. It typically covers the AI use cases inside your product, the data pipelines feeding them, the model life cycle from development to retirement, the human-oversight controls, and the third-party AI you embed. In a Microsoft-based environment that usually means Microsoft 365 Copilot, Azure OpenAI, embedded model APIs, and any classifiers, recommendation engines, or generative features in your own product.

Question 8

Do we have to be on Microsoft 365?

Accepted Answer

Our fastest path is for Microsoft 365 and Azure tenants, where most Australian SMB AI use already runs and where the Aeges risk engine collects evidence automatically. Other environments can be scoped during the Week 0 discovery — the AIMS framework is platform-agnostic; the speed advantage comes from building the controls where your AI actually lives.

Question 9

Who issues the ISO 42001 certificate?

Accepted Answer

A JAS-ANZ-accredited certification body issues the certificate — Aegentra implements and prepares the AIMS but never certifies its own work, which preserves the independence auditors require. We sit in on both the Stage 1 and Stage 2 audits with you, and an optional retainer keeps the AIMS current as new models and use cases are deployed.

ISO 42001, implemented.