ISO 42001 implementation in Australia

Yes. The relevant question is what your organisation does with AI, not only whether it builds a model. Using an external model can still involve decisions about intended use, affected people, data, human oversight, supplier dependencies and incident handling. Define your role and the AI activities in scope. A supplier’s assurance can inform that assessment, but it does not certify your organisation’s use of the service.

They answer related but different questions. A risk assessment supports decisions about uncertainty, objectives and treatment; an impact assessment examines potential consequences of an AI system’s use for affected people or groups and society. Connect both to the intended use, evidence, accountable decisions and review triggers. Completing a form for one purpose does not automatically cover the other, and neither is a blanket determination of legal compliance.

Consider the actions it can perform, the data it can reach, who authorised those permissions and how an action can be stopped or reversed. Record testing, human approval points, monitoring and escalation against the intended use. A read-only demonstration is not evidence that production write access is safe. The implementation scope can address those governance decisions; specialist technical testing and production changes must be expressly agreed.

ISO/IEC 42001 is a voluntary management-system standard. A customer contract or tender may require certification or particular governance evidence, so check the applicable terms. Certification does not by itself establish legal compliance or satisfy every procurement requirement.

No. Neither standard is a prerequisite for the other. Their compatible management-system structures mean an operating ISMS may provide reusable processes for document control, competence, internal audit, management review and corrective action. The actual reuse depends on scope and maturity and is assessed during discovery.

The plan depends on the number and complexity of AI systems, existing governance, evidence maturity and access to accountable owners. Aegentra confirms a staged timeline after discovery and separates implementation milestones from the independent certification body’s Stage 1 and Stage 2 dates.

Aegentra provides a fixed scope and written price after discovery. The quote identifies assumptions, client responsibilities and exclusions. Certification-body audit fees are separate and must be obtained from the selected body because they vary with scope, locations and audit time.

A course develops a person’s knowledge and leads to the applicable PECB examination and credential pathway. This service builds an organisation’s AI management system. Aegentra implements and prepares the AIMS; only an independent accredited certification body can certify the organisation. Training runs separately through Aegentra Academy.

No. An AIMS can organise governance evidence, but ISO 42001 certification does not establish EU AI Act compliance. The European Commission distinguishes ISO 42001 from the quality-management requirements under the Act. Assess applicable obligations and any relevant harmonised standards separately with appropriately qualified advice.

You define the scope. It typically covers the AI use cases inside your product, the data pipelines feeding them, the model life cycle from development to retirement, the human-oversight controls, and the third-party AI you embed. In a Microsoft-based environment that usually means Microsoft 365 Copilot, Azure OpenAI, embedded model APIs, and any classifiers, recommendation engines, or generative features in your own product.

Our fastest path is for Microsoft 365 and Azure tenants, where most Australian SMB AI use already runs and where the Aeges risk engine collects evidence automatically. Other environments can be scoped during the Week 0 discovery — the AIMS framework is platform-agnostic; the speed advantage comes from building the controls where your AI actually lives.

An independent accredited certification body issues the certificate. Aegentra implements and prepares the AIMS but does not make the certification decision. Attendance during Stage 1 and Stage 2 is agreed with the client and remains subject to the certification body's rules.