ISO/IEC 42001:2023
Information technology — Artificial intelligence — Management system
The international standard for governing artificial intelligence. If a client, a tender or your board has asked how your organisation controls what its AI does, this certificate is the answer — issued after an independent audit.
In Plain Terms
What is ISO/IEC 42001?
It is a management system standard. It says nothing about which AI model you should use, what accuracy you should reach, or which vendor to buy from. What it asks is whether your organisation has a deliberate, written, reviewed way of deciding how AI gets chosen, deployed and watched — and who is answerable when it gets something wrong.
If you already hold ISO 9001:2015 or ISO/IEC 27001:2022, you know the shape: policy, risks, responsibilities, records, internal audit, management review. What changes is what goes inside each of those.
Why is ISO/IEC 42001 important?
AI now makes or shapes decisions that people used to make — who gets shortlisted, what price someone is offered, which claim is reviewed, which case is escalated. When one of those goes wrong, “the system decided it” has never been an answer a client, a regulator or a court accepts.
Until 2023 there was no agreed way to show you had governed those decisions properly. Every organisation invented its own, and nobody could compare them. ISO/IEC 42001:2023 settled that: one set of requirements that an independent certification body can audit you against. That is what changes a claim about your AI into evidence about it.
Why Certify
Benefits of ISO/IEC 42001:2023 Certification
Six reasons Australian organisations are getting certified.
A client or tender asked
The most common reason. An enterprise client, a government tender or a parent company wants to know how your AI is governed. The certificate answers it without a document pack.
AI helps make your decisions
If AI shapes hiring, pricing, credit, triage or eligibility, someone will eventually ask who is accountable for those decisions. This is the answer to that question.
It lines up with Australia's AI guardrails
The Australian Government's Voluntary AI Safety Standard is aligned with ISO/IEC 42001:2023, so the certificate is recognised evidence rather than your own word.
You bought the AI, you did not build it
Most certified organisations use AI rather than develop it. A vendor's tool inside your business is still your responsibility, and it sits inside your scope.
Very few hold it yet
ISO/IEC 42001:2023 was published in December 2023. Holding it still says something, which will not be true for long.
It covers the business, not one tool
Certification is of how your organisation decides, monitors and controls AI — so it does not expire when you change model or vendor.
What It Covers
Key Requirements of ISO 42001:2023
What an auditor will ask to see. If you already hold ISO 9001:2015 or ISO/IEC 27001:2022, the shape of this will be familiar.
Industries
Who Needs ISO/IEC 42001:2023?
Any organisation that develops, deploys, or is significantly impacted by AI systems. Particularly relevant for:
Simple & Clear
Our ISO/IEC 42001:2023 Certification Process
From application to certificate. Six steps, and you always know which one you are in.
Application
Submit your application to initiate the certification process.
Certification Agreement
A formal agreement will be shared for your review and signature prior to commencement.
Stage 1 Audit
A thorough review of your documentation, processes, and overall readiness against the applicable standard.
Stage 1 Audit Report
A detailed report outlining findings, observations, and recommended actions will be shared with you.
Stage 2 Audit
An on-site or remote assessment evaluating the implementation, effectiveness, and conformity of your management system.
Final Report & Certification
Upon completion of the Stage 2 audit, a comprehensive report will be issued. Any identified nonconformities must be addressed before certification is formally granted.
Pricing
How Much Does ISO 42001 Certification Cost in Australia?
ISO 42001:2023 certification costs vary based on your organisation's size and complexity. UCS provides transparent, competitive quotes — no hidden fees, no surprises.
Nationwide Service
ISO 42001 Certification Across Australia
UCS provides accredited ISO/IEC 42001:2023 certification to businesses in every major Australian city and regional areas nationwide.
FAQ
ISO 42001 Certification — Common Questions
Answers to the most common questions about ISO/IEC 42001:2023 certification in Australia.
What is ISO 42001, in one sentence?
It is the international standard for running AI responsibly, and the certificate is independent proof that your organisation does.
Do we actually need it?
It is not law in Australia. You need it when somebody asks — an enterprise client, a tender, a parent company, or a regulator wanting to know who is accountable for an AI-driven decision. If nobody has asked yet and AI does not shape decisions about people or money, it can wait.
Does it cover AI tools we bought from a vendor?
Your use of them, yes. Most organisations that certify are users of AI rather than builders of it. The vendor's own arrangements cover the vendor, not you.
What do we need to have ready?
An AI policy, a list of your AI systems, a record of what could go wrong with each and who it affects, named people accountable for AI decisions, and one internal audit and one management review already completed. Not planned — completed.
How long does it take?
Most prepared Australian organisations complete certification in 7 to 10 working days once the audit is scheduled. What decides the timeline is how ready your system already is, which is exactly what the Stage 1 audit establishes.
How much does it cost?
It depends on your size, how many AI systems are in scope and how many sites are involved, so there is no list price. UCS gives you a full quote within 3 to 4 hours of your enquiry.
What is the difference between ISO 42001 and ISO 27001?
ISO/IEC 27001:2022 is about keeping information secure. ISO/IEC 42001:2023 is about how AI decisions get made, watched and corrected. They answer different questions, and holding one does not cover the other.
Does the certificate mean our AI is safe?
No, and it is worth being clear about that. It certifies how your organisation governs AI, not the AI itself. A certified organisation can still ship a model that performs badly. What it cannot do is ship one without having governed the decision.
Who is ISO/IEC 42001 for?
Any organisation that develops, provides or uses AI. Size and sector do not matter. In practice most organisations that certify are users of AI rather than builders of it — if an AI tool sits inside your business, your use of it is what gets assessed.
Does this standard apply to all AI systems?
It applies to the AI systems you name in your scope, not automatically to everything you touch. You decide what the certificate covers, and the audit checks that the scope is honest. A scope naming two AI systems when the auditor finds five in use is the first thing that has to be resolved.
What is an artificial intelligence management system?
It is the policies, responsibilities, records and reviews your organisation uses to decide how AI gets built, bought, deployed and monitored. It is usually shortened to AIMS. The certificate is of that system, not of the AI itself.
What are the objectives of ISO/IEC 42001?
To make AI decisions deliberate rather than accidental: that risks are assessed before deployment rather than after an incident, that named people are accountable, that the effect on people outside your organisation is considered, and that problems are found by you rather than by a customer.
What are the main benefits of implementing ISO/IEC 42001?
Independent evidence you can hand to a client, a tender or a board instead of your own assurances. A defensible answer when someone asks who is accountable for an AI-driven decision. And one set of controls covering the AI you buy as well as the AI you build.
What types of standards does ISO have for AI?
Several, and only one of them can be certified. ISO/IEC 42001:2023 is the management system standard and the only one in the family you can hold a certificate against. ISO/IEC 23894:2023 on risk management, ISO/IEC 42005:2025 on AI system impact assessment and ISO/IEC 22989:2022 on terminology are guidance documents — useful while building your system, but no body can certify you to them. If anyone offers you a certificate against those, that is worth questioning.
Often Certified Together
Related Certifications
Many Australian businesses pair this standard with one of the certifications below.
Information Security Management Systems
Learn MorePrivacy Information Management Systems
Learn MoreInformation Technology Service Management
Learn MoreInnovation Management Systems
Learn MoreFurther Reading
- ISO/IEC 42001 Certification: A Complete Guide for Organizations
What ISO/IEC 42001 requires of an AI management system and how certification works.
- Documents Required for ISO/IEC 42001 Certification
The documented information an AI management system needs before the audit.
Ready to Get ISO/IEC 42001:2023 Certification?
Contact our team today for a free assessment and tailored quote. Most eligible businesses can achieve certification within 7–10 days.