# AI6, MBIE and ISO 42001 Side by Side > An AI governance framework for Australian and New Zealand businesses: AI6, MBIE's responsible AI guidance and ISO/IEC 42001 in one table, and what to do first. - Canonical: https://sentrysolutions.ai/ai-governance/framework # An AI governance framework for Australian and New Zealand businesses. Australia's AI6 practices and New Zealand's MBIE guidance mapped against ISO/IEC 42001 in one table, then what a business of 20 to 200 people actually does first. General information, not legal advice. [The mapping](#mapping) [What to do first](#first-steps) The short answer Australia and New Zealand each have voluntary national guidance on governing AI: the Guidance for AI Adoption (AI6), with six essential practices, and MBIE's Responsible AI Guidance for Businesses, built on the OECD AI Principles. Both describe the same ground as ISO/IEC 42001, the certifiable international standard: someone accountable, an understanding of impacts and risks, transparency, testing and monitoring, and human control. A business working in both countries can build one framework that satisfies all three, then seek ISO/IEC 42001 certification if customers ask for proof. ## AI6, MBIE guidance and ISO/IEC 42001, mapped Eleven themes, and where each document deals with them. Where a cell says “not a separate practice”, the theme is still relevant; the document just does not give it a heading of its own. Theme AI6 practice (Australia) MBIE guidance section (NZ) ISO/IEC 42001 clause area Purpose and context Not a separate practice Understanding your 'why' for AI Clause 4, context of the organisation Accountability 1\. Decide who is accountable Governance and accountability: Assembling a team Clause 5, leadership Legal obligations and privacy Not a separate practice; existing law applies Compliance and legal obligations; Privacy Clause 4, context of the organisation Impact on people 2\. Understand impacts and plan accordingly Risk management (stakeholder impact assessment); Engagement and consultation Clause 6, planning Risk 3\. Measure and manage risks Risk management Clauses 6 and 8, planning and operation Records and skills Not a separate practice Recordkeeping; Skills and knowledge building Clause 7, support Suppliers and security Not a separate practice Procurement; IT + Cybersecurity Clause 8, operation Transparency 4\. Share essential information Transparency; Feedback and complaints Clause 7, support Data and model quality 5\. Test and monitor Fit-for-purpose data; Legal and ethical data; Model efficacy Clauses 8 and 9, operation and performance evaluation Human oversight 6\. Maintain human control Human-in-the-loop decision-making; Use of GenAI outputs Clause 8, operation Review and improvement 5\. Test and monitor Understanding your 'why' for AI (continuous monitoring and improvement) Clauses 9 and 10, performance evaluation and improvement This is our mapping at the level of themes, not an official crosswalk. The practice names are from the [Guidance for AI Adoption on industry.gov.au](https://www.industry.gov.au/publications/guidance-for-ai-adoption); the section names are from the table of contents of [MBIE's Responsible AI Guidance for Businesses](https://www.mbie.govt.nz/business-and-employment/business/support-for-business/responsible-ai-guidance-for-businesses) (July 2025). The ISO/IEC 42001 column uses only the standard's top-level clause titles, not its text or its Annex A controls, so treat it as a pointer to where to look, not as the requirement itself. ## What the mapping tells you ### They agree on the core Accountability, risk, transparency, monitoring and human control appear in all three. Build those once and you have the centre of any framework a customer is likely to name. ### MBIE goes wider The New Zealand guidance gives procurement, security, privacy, skills and data quality sections of their own; none of the six AI6 practices is named for them. A business in both countries can use the MBIE headings as a checklist of what to cover. ### Only one is certifiable AI6 and the MBIE guidance are voluntary references. ISO/IEC 42001 is the one an accredited body can audit, and MBIE names it among the standards that support risk management. For the Australian side in detail, see [AI governance in Australia](https://sentrysolutions.ai/ai-governance/australia). For the standard, see [ISO 42001 explained](https://sentrysolutions.ai/iso-42001). ## What a 20 to 200 person business does first Seven steps, in order. Each one puts something on file that all three documents ask for, and none needs a consultant or a certification body to start. 01 ### Name one accountable owner One person with the authority to approve or stop an AI tool. It is the first practice in AI6, the first section of MBIE's guidance and the leadership clause of ISO/IEC 42001. 02 ### List every AI tool in use Claude, ChatGPT, Copilot, the AI inside your existing software and anything bought on a card, with an owner against each. You cannot assess what nobody has written down. 03 ### Move the work onto plans you control Work that touches customer or company data belongs on a business plan the organisation administers, not on personal accounts. 04 ### Write a one-page policy Approved tools, what may and may not go in, and who reviews output before it is sent, posted or paid. Short enough that people read it. 05 ### Score the risk of each use For each use on the list: who it could affect, what could go wrong, how likely, and the control that keeps it in bounds. Start with anything customer-facing. 06 ### Decide what waits for a person Which actions AI may take on its own and which need a human to approve them. Record approvals at the time they are given. 07 ### Set a review date and keep it Three months out, review the register, the policy and anything that went wrong. That review is the habit an auditor later asks to see evidence of. For step four, our [one-page AI policy template](https://sentrysolutions.ai/ai-governance/ai-policy-template) is free to copy. Once the guardrails are in place, the [free AI automation frameworks](https://sentrysolutions.ai/frameworks) show what each department can safely hand to AI. Where Sentry AI fits ## We set it up on the AI you already use Sentry AI sets up the register, the policy and the decision trail on your own Claude or ChatGPT workspace, so the evidence builds as your team works. When ISO/IEC 42001 is the goal, we help with readiness; an accredited certification body, independent of us, does the audit. Our own ISO 42001 programme is underway, not complete. More on the service at [AI governance](https://sentrysolutions.ai/ai-governance). More on AI governance - [AI governance, the service, and the five working parts](https://sentrysolutions.ai/ai-governance) - [A free one-page AI policy template](https://sentrysolutions.ai/ai-governance/ai-policy-template) - [Guidance for AI Adoption (AI6): AI governance in Australia](https://sentrysolutions.ai/ai-governance/australia) - [AI risk management, with a worked risk register](https://sentrysolutions.ai/ai-governance/ai-risk-management) - [ISO 42001 explained, with the readiness checklist](https://sentrysolutions.ai/iso-42001) - [Free AI automation frameworks, by department](https://sentrysolutions.ai/frameworks) ## Frequently asked questions ### What is an AI governance framework? The set of working parts a business uses to decide which AI it uses, who is accountable for it, what could go wrong and how it is checked. In practice that means a policy, a register of AI tools with owners, a risk assessment per use, rules about what waits for a person, and records reviewed on a schedule. ### Which AI governance framework should an Australian or New Zealand business use? Start from your own country's guidance: the Guidance for AI Adoption (AI6) in Australia, MBIE's Responsible AI Guidance for Businesses in New Zealand. Both are voluntary and free. If a customer or tender asks for proof, ISO/IEC 42001 is the management system an accredited body can certify, and both guidance documents point towards it. ### Is the mapping on this page official? No. It is our mapping at the level of themes. The AI6 practice names and the MBIE section names are taken from the published guidance; the ISO/IEC 42001 column uses only the standard's top-level clause titles. Neither government has published a crosswalk in this form. ### Does a 20 person business need ISO 42001? Usually not at first. A small business gets most of the value from an owner, a list of AI tools, a one-page policy and a decision about what waits for a person. ISO/IEC 42001 becomes worth it when customers, tenders or regulators start asking for evidence rather than a statement. ### Is AI governance law in Australia or New Zealand? For everyday business use there is no AI-specific law in either country yet, and both governments' guidance is voluntary. Existing law, such as the Privacy Act in each country, still applies in full to work done with AI. This page is general information, not legal advice. ## Want the framework set up on the AI you already use? Take the free ISO 42001 readiness check to see where you stand. If the gaps are real, a short call covers what setting up the register, the policy and the decision trail involves for a business your size. [Take the readiness check](https://sentrysolutions.ai/iso-42001/readiness-check) [Book a call](https://calendly.com/james-sentry-ai) Ask an AI about this page [ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fsentrysolutions.ai%2Fai-governance%2Fframework%20and%20summarise%20what%20Sentry%20AI%20says%20about%20an%20AI%20governance%20framework%20for%20Australian%20and%20New%20Zealand%20businesses%2C%20mapping%20AI6%2C%20MBIE%20guidance%20and%20ISO%2042001.%20Cite%20the%20page.)[Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fsentrysolutions.ai%2Fai-governance%2Fframework%20and%20summarise%20what%20Sentry%20AI%20says%20about%20an%20AI%20governance%20framework%20for%20Australian%20and%20New%20Zealand%20businesses%2C%20mapping%20AI6%2C%20MBIE%20guidance%20and%20ISO%2042001.%20Cite%20the%20page.)[Perplexity](https://www.perplexity.ai/search/new?q=Read%20https%3A%2F%2Fsentrysolutions.ai%2Fai-governance%2Fframework%20and%20summarise%20what%20Sentry%20AI%20says%20about%20an%20AI%20governance%20framework%20for%20Australian%20and%20New%20Zealand%20businesses%2C%20mapping%20AI6%2C%20MBIE%20guidance%20and%20ISO%2042001.%20Cite%20the%20page.)[Google AI Mode](https://www.google.com/search?udm=50&q=Read%20https%3A%2F%2Fsentrysolutions.ai%2Fai-governance%2Fframework%20and%20summarise%20what%20Sentry%20AI%20says%20about%20an%20AI%20governance%20framework%20for%20Australian%20and%20New%20Zealand%20businesses%2C%20mapping%20AI6%2C%20MBIE%20guidance%20and%20ISO%2042001.%20Cite%20the%20page.) Opens the assistant with this page loaded: read it, summarise it, cite it.