The demand for ISO 42001 in Australia is not coming from regulators. It is coming from procurement.

Somewhere in your last few enterprise deals, a security questionnaire grew an AI section. How do you govern AI use? What controls apply to the models in your product? Who is accountable when the output is wrong? These questions are now standard in vendor reviews and government tenders, and they are difficult to answer convincingly with a policy document and good intentions.

ISO/IEC 42001:2023 is the world's first certifiable AI management system standard, adopted in Australia as AS ISO/IEC 42001:2023. Nathan ISO Consulting builds AI management systems for Australian organisations that develop AI, embed it in products, or simply use it heavily enough that governance has become a commercial question.

What ISO 42001 certifies, and what it does not

This distinction is worth being clear about early, because it is the source of most confusion in the market.

It is a governance certification, not a product certification. That is precisely what makes it answerable in a procurement questionnaire, because the buyer is asking how you run the thing, not whether your model scores well on a benchmark.

Where Australian AI rules actually stand

A lot of AI governance content written for the Australian market is out of date, and it is out of date in a specific and misleading direction. It tells readers to prepare for mandatory AI guardrails. Those were proposed and never legislated.

That does not mean AI is unregulated in Australia. It means your obligations arrive through laws that were already there.

Privacy Act 1988 and the Australian Privacy Principles. Personal information used to train, prompt or evaluate AI is still personal information. Automated decision-making transparency obligations come out of their grace period on 10 December 2026.

Australian Consumer Law. Misleading representations about what an AI product does are misleading representations, and the same prohibitions apply.

Anti-discrimination legislation. A model that produces discriminatory outcomes in employment, credit or service provision creates exposure under existing federal and state law.

Work health and safety duties. Where AI is used in operational decisions affecting worker safety, the primary duty applies as it always has.

Sector-specific regulation. APRA, ASIC, the TGA and others apply existing frameworks to AI-driven activity within their remit rather than waiting for new AI-specific law.

The EU AI Act, for exporters. Australian organisations placing AI systems on the European market face conformity assessment obligations there, with substantial penalties, regardless of the position at home.

The practical consequence is that ISO 42001 in Australia is a commercial and risk decision rather than a compliance obligation. That is a better reason to do it, and a considerably more honest one than implying a regulator is about to knock.

Three roles, three different projects

The standard applies across the AI supply chain, and where you sit in it changes the work substantially. Most organisations occupy more than one of these positions and have never mapped which is which.

Shadow AI is the risk nobody has scoped

Ask a room of employees whether they use AI at work and you will hear one answer. Look at what is actually happening and you will find a different one. Staff paste client information into consumer chatbots, run drafts through translation tools, and use AI features embedded in software the organisation never assessed for that purpose.

This is a governance problem before it is a security problem, and it is one of the more common reasons organisations come to us. An AIMS gives you a defensible position: an inventory of approved tools, a route for staff to request new ones, use policies that reflect what people actually need to do, and monitoring that tells you when the picture changes.

Banning AI does not work. Every organisation that has tried it has discovered the usage simply moved somewhere it could not see.

What the standard requires

ISO/IEC 42001:2023 follows the same high-level structure as ISO 9001, ISO 27001 and ISO 45001, so if you hold any of those the shape will be familiar. Clauses 4 to 10 cover context, leadership, planning, support, operation, evaluation and improvement. Annex A adds 38 AI-specific controls across nine categories:

● Policies related to AI

● Internal organisation and accountability

● Resources for AI systems, including data, tooling and human resources

● Assessing impacts of AI systems on individuals and society

● AI system lifecycle management

● Data for AI systems

● Information for interested parties, including transparency to users

● Use of AI systems, including responsible use policies

● Third-party and customer relationships

The AI system impact assessment is the control that carries the most weight in practice, and it is the one Australian buyers most often ask to see evidence of.

How Nathan ISO Consulting assists

Why organisations choose Nathan

We tell you the truth about Australian AI regulation. There is no AI Act and the mandatory guardrails did not pass. Selling ISO 42001 on the threat of imminent regulation is both inaccurate and unnecessary, because the procurement case is strong enough on its own.

We start with an inventory, not a policy. An AI policy written before anyone has listed what AI the organisation actually uses is a document about an imagined company.

We integrate rather than duplicate. If you hold ISO 27001, a large proportion of the governance, risk and audit machinery is already built. We extend it instead of running a parallel system.

We treat shadow AI as in scope. Most AIMS projects quietly ignore the tools staff use without permission. Those are precisely the ones creating exposure.

We write impact assessments that a buyer would accept. The AI impact assessment is what enterprise procurement asks to see. It needs to be substantive, not a form with the risk field set to low.

We handle the EU AI Act question honestly. If you sell into Europe, ISO 42001 helps but does not discharge conformity assessment obligations there. We will tell you where the gap sits rather than implying the certificate closes it.

Where we work

AI governance work runs almost entirely remotely, which suits a client base concentrated in technology precincts but not confined to them.