An AI governance framework for Australian and New Zealand businesses.
Australia's AI6 practices and New Zealand's MBIE guidance mapped against ISO/IEC 42001 in one table, then what a business of 20 to 200 people actually does first. General information, not legal advice.
The short answer
Australia and New Zealand each have voluntary national guidance on governing AI: the Guidance for AI Adoption (AI6), with six essential practices, and MBIE's Responsible AI Guidance for Businesses, built on the OECD AI Principles. Both describe the same ground as ISO/IEC 42001, the certifiable international standard: someone accountable, an understanding of impacts and risks, transparency, testing and monitoring, and human control. A business working in both countries can build one framework that satisfies all three, then seek ISO/IEC 42001 certification if customers ask for proof.
AI6, MBIE guidance and ISO/IEC 42001, mapped
Eleven themes, and where each document deals with them. Where a cell says “not a separate practice”, the theme is still relevant; the document just does not give it a heading of its own.
| Theme | AI6 practice (Australia) | MBIE guidance section (NZ) | ISO/IEC 42001 clause area |
|---|---|---|---|
| Purpose and context | Not a separate practice | Understanding your 'why' for AI | Clause 4, context of the organisation |
| Accountability | 1. Decide who is accountable | Governance and accountability: Assembling a team | Clause 5, leadership |
| Legal obligations and privacy | Not a separate practice; existing law applies | Compliance and legal obligations; Privacy | Clause 4, context of the organisation |
| Impact on people | 2. Understand impacts and plan accordingly | Risk management (stakeholder impact assessment); Engagement and consultation | Clause 6, planning |
| Risk | 3. Measure and manage risks | Risk management | Clauses 6 and 8, planning and operation |
| Records and skills | Not a separate practice | Recordkeeping; Skills and knowledge building | Clause 7, support |
| Suppliers and security | Not a separate practice | Procurement; IT + Cybersecurity | Clause 8, operation |
| Transparency | 4. Share essential information | Transparency; Feedback and complaints | Clause 7, support |
| Data and model quality | 5. Test and monitor | Fit-for-purpose data; Legal and ethical data; Model efficacy | Clauses 8 and 9, operation and performance evaluation |
| Human oversight | 6. Maintain human control | Human-in-the-loop decision-making; Use of GenAI outputs | Clause 8, operation |
| Review and improvement | 5. Test and monitor | Understanding your 'why' for AI (continuous monitoring and improvement) | Clauses 9 and 10, performance evaluation and improvement |
This is our mapping at the level of themes, not an official crosswalk. The practice names are from the Guidance for AI Adoption on industry.gov.au; the section names are from the table of contents of MBIE's Responsible AI Guidance for Businesses (July 2025). The ISO/IEC 42001 column uses only the standard's top-level clause titles, not its text or its Annex A controls, so treat it as a pointer to where to look, not as the requirement itself.
What the mapping tells you
They agree on the core
Accountability, risk, transparency, monitoring and human control appear in all three. Build those once and you have the centre of any framework a customer is likely to name.
MBIE goes wider
The New Zealand guidance gives procurement, security, privacy, skills and data quality sections of their own; none of the six AI6 practices is named for them. A business in both countries can use the MBIE headings as a checklist of what to cover.
Only one is certifiable
AI6 and the MBIE guidance are voluntary references. ISO/IEC 42001 is the one an accredited body can audit, and MBIE names it among the standards that support risk management.
For the Australian side in detail, see AI governance in Australia. For the standard, see ISO 42001 explained.
What a 20 to 200 person business does first
Seven steps, in order. Each one puts something on file that all three documents ask for, and none needs a consultant or a certification body to start.
Name one accountable owner
One person with the authority to approve or stop an AI tool. It is the first practice in AI6, the first section of MBIE's guidance and the leadership clause of ISO/IEC 42001.
List every AI tool in use
Claude, ChatGPT, Copilot, the AI inside your existing software and anything bought on a card, with an owner against each. You cannot assess what nobody has written down.
Move the work onto plans you control
Work that touches customer or company data belongs on a business plan the organisation administers, not on personal accounts.
Write a one-page policy
Approved tools, what may and may not go in, and who reviews output before it is sent, posted or paid. Short enough that people read it.
Score the risk of each use
For each use on the list: who it could affect, what could go wrong, how likely, and the control that keeps it in bounds. Start with anything customer-facing.
Decide what waits for a person
Which actions AI may take on its own and which need a human to approve them. Record approvals at the time they are given.
Set a review date and keep it
Three months out, review the register, the policy and anything that went wrong. That review is the habit an auditor later asks to see evidence of.
For step four, our one-page AI policy template is free to copy. Once the guardrails are in place, the free AI automation frameworks show what each department can safely hand to AI.
Where Sentry AI fits
We set it up on the AI you already use
Sentry AI sets up the register, the policy and the decision trail on your own Claude or ChatGPT workspace, so the evidence builds as your team works. When ISO/IEC 42001 is the goal, we help with readiness; an accredited certification body, independent of us, does the audit. Our own ISO 42001 programme is underway, not complete. More on the service at AI governance.
More on AI governance
Frequently asked questions
What is an AI governance framework?
The set of working parts a business uses to decide which AI it uses, who is accountable for it, what could go wrong and how it is checked. In practice that means a policy, a register of AI tools with owners, a risk assessment per use, rules about what waits for a person, and records reviewed on a schedule.
Which AI governance framework should an Australian or New Zealand business use?
Start from your own country's guidance: the Guidance for AI Adoption (AI6) in Australia, MBIE's Responsible AI Guidance for Businesses in New Zealand. Both are voluntary and free. If a customer or tender asks for proof, ISO/IEC 42001 is the management system an accredited body can certify, and both guidance documents point towards it.
Is the mapping on this page official?
No. It is our mapping at the level of themes. The AI6 practice names and the MBIE section names are taken from the published guidance; the ISO/IEC 42001 column uses only the standard's top-level clause titles. Neither government has published a crosswalk in this form.
Does a 20 person business need ISO 42001?
Usually not at first. A small business gets most of the value from an owner, a list of AI tools, a one-page policy and a decision about what waits for a person. ISO/IEC 42001 becomes worth it when customers, tenders or regulators start asking for evidence rather than a statement.
Is AI governance law in Australia or New Zealand?
For everyday business use there is no AI-specific law in either country yet, and both governments' guidance is voluntary. Existing law, such as the Privacy Act in each country, still applies in full to work done with AI. This page is general information, not legal advice.
Want the framework set up on the AI you already use?
Take the free ISO 42001 readiness check to see where you stand. If the gaps are real, a short call covers what setting up the register, the policy and the decision trail involves for a business your size.
Ask an AI about this page
Opens the assistant with this page loaded: read it, summarise it, cite it.