Western Australia operates autonomous industrial systems at a scale found almost nowhere else. Haul trucks running without drivers across Pilbara pits, autonomous drill rigs, driverless heavy rail moving ore to port, and processing plant increasingly optimised by models rather than by setpoints.
Almost all of it is directed from Perth. Operations centres in the CBD and West Perth supervise equipment more than a thousand kilometres north, which means the accountability question is not abstract here. When a model changes a haul cycle or defers a maintenance intervention, the person answerable is in an office and the consequence is in the Pilbara.
Nathan ISO Consulting implements AI management systems under ISO/IEC 42001:2023 for Western Australian organisations across resources operators and their technology suppliers, engineering services, health, government supply and agriculture technology.
Why ISO 42001 matters for Western Australian organisations
Autonomy raises a governance problem that ordinary enterprise AI does not. A recommendation engine producing a poor suggestion wastes time. An autonomous system operating on a live mine site produces physical outcomes, and the work health and safety duty applies to the decision regardless of whether a human or a model made it. Very few operators can currently state who authorised a particular model version into production or what it was validated against.
Vendor assurance is the commercial driver. Operators are asking technology suppliers how AI in their products is governed, and the questions are more specific than the security questionnaires that preceded them. A supplier answering with a policy document rather than an assessed governance position increasingly loses ground.
The third driver is the privacy regime that arrived in July 2026. Western Australian public entities now operate under Information Privacy Principles for the first time, and those obligations reach contracted providers. Where AI processes personal information for an agency, the two frameworks interact in ways nobody in this market has dealt with before.
What a consultant should not claim about Australian AI rules
No AI statute has been enacted. The high-risk guardrails proposed in late 2024 did not become law. Commonwealth guidance published in October 2025 replaced the earlier voluntary standard with a shorter set of essential practices and remains guidance rather than legislation. The instruments that actually bind you are already in force: work health and safety duties where AI influences site operations, privacy law at federal level and now at state level, consumer protection, and anti-discrimination law. Anyone selling certification on the basis of imminent AI legislation is describing a proposal that stalled.
Legal and regulatory compliance in Western Australia
| Obligation | How it reaches AI | WA relevance |
|---|---|---|
| Work Health and Safety Act 2020 (WA) | The primary duty applies where AI influences decisions affecting worker safety, regardless of who or what decided | Autonomous haulage, drilling, equipment control, fatigue and scheduling systems |
| WHS (Mines) Regulations 2022 | Mine-specific duties extend to systems influencing operations on site | Models directing or informing activity at mining operations |
| Privacy and Responsible Information Sharing Act 2024 (WA) | Information Privacy Principles govern agency personal information used in or produced by AI | Suppliers delivering AI-enabled services to WA public entities |
| Privacy Act 1988 and the APPs | Personal information used to train, prompt or evaluate a model remains personal information | Private sector operators, health providers, consumer-facing businesses |
| Automated decision-making disclosure | Privacy policies must disclose significant automated decisioning, grace period ending 10 December 2026 | Employment screening, credit and eligibility decisions |
| Anti-discrimination law | Discriminatory model outputs create exposure under federal and state law | Recruitment, rostering, insurance and service allocation |
| Australian Consumer Law | Overstated AI capability claims are misleading representations | Technology suppliers marketing AI features to operators |
| EU AI Act | Applies to organisations placing AI systems on the European market | WA technology and equipment exporters |
Perth and regional WA coverage
| Location | Activity | AI governance driver |
|---|---|---|
| Perth CBD and West Perth | Remote operations centres, resources head offices, engineering | Models directing autonomous equipment and scheduling at distant sites |
| Subiaco and Osborne Park | Mining technology vendors, software, analytics | Operator vendor assurance questions and product-embedded models |
| Technology Park and Bentley | Research, sensing, geoscience technology | Model development, validation practice and data provenance |
| Murdoch and QEII precinct | Hospitals, medical research, health technology | Clinical decision support and patient information governance |
| Government precincts | Departments, agencies and contracted providers | New state privacy obligations interacting with automated processing |
| Kwinana and Henderson | Processing, marine and defence engineering | Process optimisation models and controlled information handling |
| Pilbara operations | Autonomous haulage, drilling, driverless rail, port loading | Physical consequence, safety duty, model authorisation and version control |
| Goldfields | Underground and open pit mining, processing | Ventilation, ground control monitoring and equipment optimisation models |
| Regional agriculture | Broadacre cropping, sensing, machinery guidance | Yield modelling, guidance systems and water allocation |
Autonomy makes the accountability question concrete
In most industries the hard question about AI governance is theoretical: who would be responsible if an output turned out to be wrong. In Western Australian resources it is operational, because equipment moves. A haul truck operating autonomously, a rail consist running without a driver, or a drill rig executing a pattern all act on decisions that originated somewhere in a chain running from a vendor through a control room to the site.
Most operators can describe that chain informally. Very few have it documented in a way that answers the questions asked after an incident: which model version was in production, what it was validated against, who authorised the change, what monitoring would have detected drift, and what the operator on shift could actually have overridden.
We start Western Australian engagements in the operations centre rather than the technology function, because that is where the systems making decisions are visible and where the people who supervise them already know what the machine is doing on their behalf.
Our delivery model in Western Australia
Cataloguing comes before any policy is drafted, and it runs longer in this state because the capability is buried in equipment fleets, supplier platforms and monitoring subscriptions rather than sitting in a repository someone can query. Every system is then placed as something you built, something you supply, or something you merely operate, which settles the control set that applies. Governance structure follows, along with the impact assessment method, risk criteria spanning bias, drift, explainability and misuse, oversight that survives a thousand kilometres of separation, and supplier assurance terms written into how you procure.
Genuine assessor experience in AI management remains uneven, the market being young. We identify bodies that have actually assessed one rather than listing the capability, settle terms and dates, and complete readiness through internal audit and a recorded review. Both stages attended.
These environments change faster than anything else we maintain. Inventory is rebuilt on a defined cycle, impact assessments revisited whenever a model is retrained or a vendor pushes an update, and Commonwealth guidance monitored so the framework does not drift from the published position.
Your deliverables
Where Perth ISO 42001 projects go wrong
Who certifies you, and where we fit
We implement. An accredited body certifies.
Nathan ISO Consulting builds and implements management systems. We do not issue certificates, and no legitimate consultancy does. Your certificate comes from an independent certification body accredited by JAS-ANZ, the accreditation authority appointed jointly by the Australian and New Zealand governments. Accredited bodies operate under impartiality rules that prohibit them from certifying a system they helped build, which is precisely why the two roles are separate. Our job is to get you audit-ready, help you select the right accredited body, and stand alongside you through assessment.
Which accredited body you engage, on what terms and to what timetable, is work we take off you, matched against scope, sector and the audit approach that fits how you operate. Both assessment stages are attended by our people, and resolving whatever gets raised belongs to us rather than arriving as a list once the assessor leaves. Check one thing yourself first: that the JAS-ANZ register lists the body as accredited for your particular scope. Certificates from unaccredited providers cost little and take days, and procurement teams reject them regularly enough that the check pays for itself.
FAQ'S
No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.
A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.
Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.
No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.
No AI statute exists and the 2024 high-risk proposals stalled. Obligations reach artificial intelligence through instruments already operating: work health and safety duties, privacy law at both federal and state level, consumer protection and anti-discrimination law.
It does. The primary duty concerns ensuring health and safety so far as is reasonably practicable, and nothing in it distinguishes between a decision made by a person and one made by a system. Mine-specific regulations add further duties on site.
Usually it does, provided it forecasts or advises rather than simply alarming against a set point. This category is missed more often than any other in Western Australian catalogues, precisely because it was purchased as a monitoring subscription.
It has to be genuine rather than nominal. The question is what the operator can actually stop, within what timeframe, and with what information available. Assessors test that directly rather than accepting an assertion that a human is in the loop.
Because after an incident the first questions concern which version was running, what it was validated against and who authorised it. Without that record the investigation cannot establish whether the system behaved as approved.
No. It certifies that the organisation governs AI responsibly across the lifecycle, addressing accountability, risk, impact and oversight. Model performance is a separate engineering question the certificate does not speak to.
It can. State privacy obligations arrived in July 2026 and reach contracted providers, so where your AI processes agency personal information both frameworks apply. The agreement terms determine what you have taken on.
If you hold one, that is the sensible foundation. The clause architecture matches and your governance, audit and review processes are already running, so what remains is a fraction of a standalone implementation.
Fourteen to twenty-four weeks. Resources clients sit at the longer end because inventory work spans equipment fleets, vendor platforms and remote sites rather than being centrally recorded anywhere.
Most governance work happens with Perth-based teams, with site attendance where equipment interaction and control system behaviour need to be understood in person rather than described from an operations centre.
Start in the operations centre
Our first question is which systems are making or shaping decisions across your operation, including anything inside equipment fleets or vendor platforms nobody classified as AI. The supervisors usually know before the register does.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving