What is ISO 42001 and why does it matter now?

ISO 42001 is the international standard for AI Management Systems, published in late 2023. It provides a structured framework for governing AI responsibly — covering AI policy, model inventory, risk and impact assessment, human oversight, and monitoring. It matters now because enterprise procurement teams, cyber insurers, and the EU AI Act are all converging on ISO 42001 as the credible evidence base for AI governance — and in Australia, where the government has chosen voluntary guidance over a mandatory AI Act, that same evidence is exactly what buyers and insurers are asking for anyway. Organisations implementing now have the evidence ready before the December 2027 high-risk tranche and whatever their next tender asks for.

How long does ISO 42001 implementation take in Australia?

For mid-market organisations (50–500 staff) with a focused number of AI systems in scope, the implementation typically takes 8–12 weeks. Smaller organisations or those with a single AI use case can complete in 6–8 weeks. Organisations already holding ISO 27001 certification have a significant head start because the management system structure carries over.

How much does ISO 42001 implementation cost?

Our fixed-price ISO 42001 engagements range from $18k for under-50-staff scope to $100k for 500+ staff enterprise scope. Because ISO 42001 builds on the same management system structure as ISO 27001, organisations already certified to ISO 27001 typically see 30–40% lower implementation cost for ISO 42001 due to shared controls and evidence. Certification body fees (if formal certification is pursued) are separate and paid directly to your auditor.

Do we need new tools or a dedicated AI governance platform?

No. We implement your AI Management System inside your existing Microsoft 365 environment, on Checkpoint — our own console, included in the engagement — SharePoint for model inventory and risk registers, Purview for audit trails, Power Automate for monitoring workflows. Some third-party GRC platforms have started releasing AI governance modules but they are immature and add significant annual licence cost. Building inside M365 keeps evidence where your team already works and avoids ongoing vendor dependency.

What AI systems does ISO 42001 apply to?

ISO 42001 applies to any organisation that develops, provides, or uses AI systems — including third-party AI tools (Microsoft Copilot, OpenAI APIs, vendor ML models), internally developed AI or automation, and AI embedded in products or services. The standard uses a risk-tiering approach so governance effort is proportionate to actual AI risk. Most organisations are surprised by how much shadow AI is already in use once a structured inventory is conducted.

Can ISO 42001 sit alongside ISO 27001 and ISO 27701?

Yes. ISO 42001 is designed to integrate with ISO 27001 (information security) and ISO 27701 (privacy) using the same Annex SL high-level structure. We deliver integrated management systems where policy, risk, evidence, and audit infrastructure are shared across all three standards. Combined engagements typically reduce total cost by 30–40% versus running them sequentially.

Do we need formal external certification for ISO 42001?

No. ISO 42001 can be implemented as an internal governance framework without external certification. The documentation and governance structure still satisfies enterprise procurement and provides a defensible posture for regulators. We build whichever path fits: internal governance only, or the full certification route with an accredited certification body.

How do I know if my AI system is high-risk under the EU AI Act?

The EU AI Act sorts every AI system into one of four tiers: Prohibited (Article 5 — eight banned practices such as social scoring or real-time public biometric identification by law enforcement), High-risk (Annex III — eight named categories including employment, essential services access, and law enforcement), Limited risk (Article 50 transparency triggers such as chatbots and deepfake generation), and Minimal risk (everything else). We built a free classifier that walks through the actual clauses and gives an instant, plain-English answer with the specific obligations that apply — try it further up this page.

ISO 42001 · AI Governance · Delivered Remotely · Australia · US · UK

ISO 42001 — the AI governance evidence buyers are now asking for.

Q: Does ISO 42001 cover the EU AI Act?

ISO 42001 is closely aligned with the principles and requirements of the EU AI Act and provides a strong foundation for compliance. For Australian organisations supplying software, services, or AI-enabled products to EU-domiciled customers, the EU AI Act reaches you regardless of where you are incorporated. Obligations are already applying in stages (AI literacy and prohibitions since February 2025, general-purpose AI rules since August 2025, transparency duties since August 2026); high-risk system obligations, including conformity assessment, were deferred to December 2027. ISO 42001-aligned AIMS is the fastest path to demonstrating readiness for either.

Q: What is our responsibility vs our AI vendor?

Your obligation covers how you select, deploy, monitor, and govern AI systems — including third-party tools. Your vendor is responsible for the model; you are responsible for the use case, the oversight, and the impact on people affected by the output. The model inventory and risk assessment makes this distinction explicit for every AI system in scope.

ISO 42001 is the global standard for AI governance. The EU AI Act's general obligations are in force. Enterprise procurement questionnaires carry a dedicated AI section. We deliver your AI Management System (AIMS) in 8–12 weeks, inside your existing Microsoft 365 environment — so the evidence exists before the next questionnaire, tender or audit asks for it.

8–12 weeks
Built on your ISMS
Microsoft 365 native
EU AI Act aligned

Book a 30-min call Free readiness assessment

Estimate your cost: year one and three years, by size ↓

Checkpoint Microsoft 365 posture scan: an overall score, counts of checks needing attention, to review and clear, and the failing checks to fix first — Checkpoint, demo tenant with sample data. Open it in the demo

Three pressures converging. One framework that answers all of them.

Most Australian organisations are using more AI than they realise — and the questions are starting to arrive from three directions at once. ISO 42001 is the structured answer that addresses all three with a single programme.

Australian regulatory direction

The Australian Government's National AI Plan (December 2025) confirmed there will be no standalone AI Act — AI is governed through existing law, sector regulators and the National AI Centre's voluntary guidance instead. APRA, ASIC and the OAIC have each issued AI-specific guidance for the sectors they regulate, and government agencies already carry their own mandatory AI obligations. ISO 42001 maps directly onto that guidance, so implementing it now means the evidence exists whichever regulator — or customer — asks for it.

Enterprise procurement is asking

88% of organisations now use AI in at least one business function — but only 8% have a comprehensive governance framework in place. Large enterprise and government buyers know that gap exists, which is why standard vendor questionnaires (CAIQ, SIG Lite) now carry a dedicated AI section: model provenance, training data rights, who reviews AI outputs. Without a documented AI Management System, you respond with vague assurances. With ISO 42001, you respond with auditable evidence — and you win the comparison against vendors who don't have either.

EU AI Act supply chain reach

If you supply software, services, or AI-enabled products into Europe — or work with EU-domiciled enterprise customers — the EU AI Act reaches you regardless of where you're incorporated. AI literacy, the prohibitions, general-purpose AI rules and the Article 50 transparency duties already apply; high-risk (Annex III) obligations, including conformity assessment, were deferred a further 16 months to December 2027, so the first obligations are already in force while the heaviest tranche is still ahead. ISO 42001 is the fastest path to demonstrating alignment and avoiding contractual exposure either way.

Where the requirement actually stands

AI governance has moved from something buyers might ask about to something they do. One tranche of EU AI Act obligations is already live; the one that carries the heaviest documentation burden lands in December 2027.

Already in force

Already being asked

EU AI Act prohibitions and AI literacy (Feb 2025), general-purpose AI rules (Aug 2025) and transparency duties (Aug 2026)
AI sections in standard vendor questionnaires (CAIQ, SIG Lite)
APRA, ASIC and OAIC sector guidance in effect
Insurers asking how AI use is governed at renewal
Contractual AI warranties appearing in enterprise MSAs

What this needs:

Evidence you can show today

Lands December 2027

The high-risk tranche

Annex III high-risk obligations, deferred but not withdrawn
Risk management across the full system lifecycle
Data governance, logging and human oversight evidence
Technical documentation assessable by a third party
An AIMS takes 8–12 weeks; the register behind it takes longer

What this needs:

A programme starting now

Not sure which tranche you're in? Run your own AI systems through the classifier — most organisations find the answer is mixed, and the scope of the programme follows the tiering rather than the other way round.

What an AI Management System actually contains

An AIMS is not a policy document. It's a live, auditable system of controls, registers, and processes that demonstrates your AI is being governed responsibly on an ongoing basis. Six components.

Model inventory & risk tiering

A complete register of every AI system in use — purpose, vendor, version, data inputs, decision impact. Includes third-party tools (Copilot, OpenAI, vendor ML), internally developed automation, and AI embedded in products. Risk-tiered so governance effort is proportionate.

AI risk & impact assessments

Structured assessment of AI-specific risks — bias, drift, misuse, opacity, third-party dependency. Each high-risk system gets a documented impact assessment with safeguards and residual risk sign-off. Linked to Privacy Act DPIAs where AI processes personal information.

Human oversight & escalation

Defined decision thresholds for when AI output requires human review, approval, or override. Escalation paths, dispute handling procedures, and accountability assignment — practical and auditable, not theoretical.

Monitoring & performance tracking

Ongoing monitoring of model quality, drift, bias indicators, and incidents. Periodic review cadence by risk tier. Incident log maintained. Audit trail demonstrating continuous oversight rather than point-in-time compliance theatre.

Policy, roles & training

AI governance policy covering acceptable use, prohibited applications, data quality obligations, and third-party AI oversight. Roles and responsibilities assigned. Training requirements proportionate to role and AI exposure.

Audit-ready evidence

Evidence automated in Microsoft 365 — SharePoint registers, Purview audit trails, Power Automate workflows. Every control mapped to its ISO 42001 clause. On Checkpoint, a posture scan of your tenant proposes Statement of Applicability status for 10 Annex A controls directly from live Microsoft Graph signals — access to the systems, tooling and data an AI system depends on, operation monitoring, event logging, incident communication and supplier oversight. You confirm or dismiss every suggestion; nothing is written automatically. Evidence packs generated on demand for customer questionnaires, procurement reviews, and external audits.

AI governance is converging into one global expectation

Different regulators are taking different routes, but they're converging on the same underlying ask: know what AI you're running, who's accountable for it, and how you'd catch it going wrong. ISO 42001 is the one certifiable answer that satisfies all of them at once.

EU AI Act

The EU AI Act's extraterritorial reach means it applies to any AI system whose output is used in the EU, not just EU-headquartered companies. Transparency duties have applied since 2 August 2026 (AI literacy and the prohibitions since February 2025); the bulk of high-risk (Annex III) obligations were deferred a further 16 months, to December 2027. ISO 42001 provides the management-system backbone a conformity assessment expects to find already in place, whichever deadline applies to you.

US state AI laws & FTC enforcement

There's no single federal US AI law, but Colorado, California and a growing list of states have enacted AI-specific obligations, and the FTC has made clear that deceptive or unfair AI claims fall under its existing enforcement powers. An AI system register and documented human-in-the-loop controls are the evidence that answers both.

UK's principles-based approach

Rather than one AI-specific statute, UK regulators (ICO, FCA, CMA) apply existing sector rules to AI through five cross-cutting principles — safety, transparency, fairness, accountability and contestability. ISO 42001's governance structure maps cleanly onto all five, giving UK-regulated organisations one evidence set instead of a different answer for each regulator.

Australia's approach — voluntary, not mandatory

Australia deliberately chose not to legislate mandatory AI guardrails — the December 2025 National AI Plan governs AI through existing law and the National AI Centre's voluntary Guidance for AI Adoption (October 2025, which replaced the 2024 Voluntary AI Safety Standard) instead. Government agencies carry their own mandatory obligations, and the guidance's six essential practices — decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, maintain human control — map directly onto ISO 42001. With no local law forcing the issue, the real pressure is coming from enterprise procurement, insurers and EU-domiciled customers who ask for exactly this evidence today.

Who this is for

ISO 42001 is the right framework for organisations in one of these situations:

You're building AI into products

SaaS platforms with AI features, healthtech with diagnostic models, fintech with credit decisioning, govtech with automated processing. Your customers will ask how the AI is governed. ISO 42001 is your structured answer.

You sell into Europe or EU-linked customers

EU AI Act obligations are already applying in stages — AI literacy and prohibitions since February 2025, general-purpose AI rules since August 2025, transparency duties since August 2026 — and the high-risk (Annex III) obligations, with their conformity assessments, follow in December 2027. If you supply EU customers — directly or indirectly — your contracts are already requiring evidence of alignment, and will do so well before the December 2027 tranche. ISO 42001 is the most credible international standard for demonstrating it.

You're using AI internally at scale

Microsoft Copilot rolled out org-wide, vendor AI embedded across the tech stack, internal automation accumulating faster than oversight. ISO 42001 brings structure to what's already happening and surfaces shadow AI you didn't know was in use.

You're already ISO 27001 certified

You have an ISMS, you have governance discipline, you have audit muscle. Adding ISO 42001 on top of an existing ISO 27001 base is significantly cheaper and faster than starting from scratch — and it consolidates your management system rather than fragmenting it.

What your deliverables look like

Your AI Management System lives inside Microsoft 365 alongside your existing security and privacy controls. Here's what the Risk Register and the AIMS Statement of Applicability look like in Checkpoint, which keeps them as SharePoint lists in your own tenant.

Checkpoint risk register: summary tiles for open, high and above-appetite risks, then each risk with its category, CIA impact, inherent and residual score, review date, treatment progress, owner and status — Checkpoint, demo tenant with sample data. Open this screen in the demo

Checkpoint Statement of Applicability for ISO 42001: AI management system controls with scope, status, cross-framework mappings, owner, assurance and evidence — Checkpoint, demo tenant with sample data. Open this screen in the demo

10 of the 38 Annex A controls above are proposed automatically from a Checkpoint posture scan of your Microsoft 365 tenant — the rest (AI policy content, impact assessments, design documentation) are process controls no live signal can honestly evidence, so they stay self-reported.

A typical 10-week implementation

Compressed for organisations with a single AI use case, extended for complex environments. Most mid-market engagements complete in 8–12 weeks.

Weeks 1–2

Discover & inventory

AI audit across the organisation, model inventory including third-party tools, risk tiering, gap assessment against ISO 42001 clauses.

Weeks 3–6

Policy & risk framework

AI governance policy, roles and responsibilities, risk and impact assessment methodology, human oversight model, Privacy Act / DPIA integration.

Weeks 7–9

Controls & evidence

SharePoint AIMS infrastructure, monitoring workflows, incident logging, evidence automation in Microsoft 365, internal audit preparation.

Weeks 10+

Audit-ready

Internal audit, corrective actions, customer-facing evidence pack, operational handover. External certification pursued where formal certification is the objective.

Common questions

Answered plainly. If you have a question not covered here, the fastest way to get a real answer is a 30-min call.

How long does it take?

8–12 weeks for most Australian mid-market organisations. Single-AI-use-case engagements can complete in 6–8 weeks. Organisations already certified to ISO 27001 have a significant head start and typically finish faster.

What does it cost?

Fixed-price, ranging $18k–$100k depending on company size and number of AI systems in scope. Organisations already ISO 27001 certified typically see 30–40% lower cost due to shared management system structure.

Do we need a dedicated AI governance platform?

No. We build inside your existing Microsoft 365 environment, on Checkpoint — our own console, included in the engagement. SharePoint registers, Purview audit trails, Power Automate workflows. Some third-party GRC platforms have started releasing AI modules but they're immature and add annual licence cost. M365-native is the more durable approach.

What AI systems does this apply to?

All AI in your organisation — third-party tools like Microsoft Copilot or OpenAI APIs, vendor ML models embedded in your tech stack, internally developed AI, and AI embedded in products you sell. Risk-tiered so governance effort matches actual risk.

Does this cover the EU AI Act?

ISO 42001 is closely aligned with the EU AI Act and provides a strong foundation for compliance. For Australian organisations supplying EU customers, ISO 42001 is the fastest path to demonstrating alignment — the first obligations (AI literacy, prohibitions, general-purpose AI rules, transparency duties) already apply, though high-risk system obligations, including conformity assessment, were deferred to December 2027.

Can we combine with ISO 27001 or ISO 27701?

Yes — and we recommend it. ISO 42001 uses the same Annex SL structure, so policy, risk, evidence, and audit infrastructure can be shared. Combined engagements typically reduce total cost by 30–40% versus sequential delivery.

Do we need formal external certification?

No — and for many organisations, formal certification isn't the right objective. ISO 42001 can be implemented and maintained as an internal governance framework without pursuing external certification. The evidence, documentation, and governance structure still satisfy enterprise procurement requirements and provide a defensible posture for regulators. We build whichever path fits your situation: internal governance only, or the full certification route with an accredited certification body.

What's our responsibility vs our AI vendor's?

Your obligation under ISO 42001 covers how you select, deploy, monitor, and govern AI systems — including third-party tools. Your vendor is responsible for the model itself. You are responsible for the use case, the oversight, and the impact on people affected by the output. The model inventory and risk assessment process makes this distinction explicit for every AI system in scope — so there are no grey areas when procurement or a regulator asks.

Real ISO 42001 results

AI governance delivered as part of one management system — from scratch, or on top of an ISO 27001 ISMS you already hold.

Healthcare / AI10 weeks

ISO 42001 + ISO 27701 + Essential Eight ML2 for a Health AI SaaS Platform

A Sydney health SaaS platform with Azure OpenAI clinical documentation features needed ISO 42001 AI governance alongside Essential Eight ML2 and ISO 27701 privacy certification to qualify for state health system procurement. All three delivered as a single integrated management system in 10 weeks.

✓ ISO 42001 certified first-time pass✓ AI system inventory + risk assessments for 3 AI systems✓ 2 state health system contracts unlocked

Read case study →

Already ISO 27001 certified20 weeks

Building an AIMS on an Existing ISMS — Healthcare Technology

A healthcare technology provider already certified to ISO 27001 was contractually required to add ISO 42001 AI governance and ISO 27701 privacy within a fixed 20-week deadline. Extending the existing management system — rather than starting two new ones — met the date.

✓ ~50% of AIMS clauses already in place✓ New effort concentrated in Annex A✓ Contractual deadline met

Read case study →

Why Compliance365

Nobody else gives you a live EU AI Act classifier tied to your actual AI inventory.

Every AI governance platform will sell you a policy template. Checkpoint — the console included with this engagement — auto-classifies every AI system in your register against Article 5, Annex III and Article 50 the moment you document it, and shows you exactly which ISO 42001 controls it evidences and which EU AI Act obligations apply. Not a static PDF matrix you fill in once before audit and never open again — live, and it updates the moment the system changes.

Try the classifier on the right with a real AI system you use today. It's the same engine, not a marketing simplification of it.

365Free tool · No sign-up

Is your AI system high-risk under the EU AI Act?

Tick everything that applies. Every question maps to one specific clause of Article 5, Annex III or Article 50 — nothing here is a vague judgement call. Instant tier, plain-English obligations.

Suggested tier: Minimal

Screening aid based on our reading of the EU AI Act — not legal advice. Confirm borderline or high-stakes classifications with counsel.

This exact engine tracks every AI system in your inventory automatically, tied straight to ISO 42001 evidence, inside Checkpoint.See Checkpoint in action

Related frameworks

ISO 42001 integrates directly with the rest of your management system. Most clients combine it with ISO 27001 and ISO 27701 for shared evidence and reduced total cost.

ISO 27001 (Information Security)ISO 27701 (Privacy)SOC 2 Type II Essential Eight

Keep reading — ISO 42001

Guides, checklists and case studies

ISO 42001 software: CheckpointRun it yourself in your own Microsoft 365 Free M365 posture scanLive scored report in 60 seconds ISO 42001 (AI governance) checklistAssess your AI management system AI governance readiness guideWhat ISO 42001 asks for The ISO 42001 playbookAI governance without the theatre ISO 42001 vs NIST AI RMF vs EU AI ActHow the frameworks map together What a good AI system inventory looks likeWhere most AIMS programmes are weakest The ISO 42001 policy packWhat you actually need — and what to leave out ISO 42001 reportsThe six reports an AIMS needs to produce AI vendor risk assessmentA faster answer than full certification Your security questionnaire now asks about AIWhy, and how to answer it

365Free scoping tool

Get a realistic scope in 30 seconds

Three questions. Instant estimate including the third-party platform licence costs you'll avoid. No sign-up.

Which framework do you need?

Company size

Timeline pressure

Pick one from each row to unlock

Free monthly digest

Get the monthly Australian compliance digest

Practical updates on ISO 27001, Essential Eight, Privacy Act and AI governance — delivered once a month. No spam, unsubscribe any time.

Ready to put AI governance on the record?

A free 30-minute call will tell you whether ISO 42001 is the right framework for your AI exposure, what the fastest path to readiness looks like, and what it would cost. No sales pitch. If you don't need it yet, we'll tell you.

Book a free 30-min call Take the 15-min assessment