ISO 42001 Certification in Australia: What It Takes, How Long, and Who Can Certify You

The question usually arrives in a tender or a security questionnaire: do you hold ISO/IEC 42001, and if not, when will you? For most Australian businesses it is the first time anyone has asked, and the standard reads like it was written for a company far bigger than theirs. It was not. It is a management system standard, the same family as ISO 27001 and ISO 9001, and the work scales with how much AI you build and use.

This is what certification actually takes, how long it runs, and who is allowed to sign it off.

What ISO 42001 certifies

ISO/IEC 42001:2023 sets out how an organisation manages its AI: who is accountable, how risks and impacts are assessed, which controls apply and how you show they are followed. A certificate says an accredited certification body has audited that management system and found it both designed to the standard and operating in practice.

It does not certify that a model is safe or accurate. It certifies that you know what AI you run, you have assessed what could go wrong, and you have controls you follow and can evidence. That is why it matters to buyers: it is a way to check governance without auditing every tool themselves.

The steps, from a standing start

1. Decide the scope. Which parts of the business, which AI systems, and which role you play for each: developing AI, providing it to others, or using it. A business that only uses Claude, ChatGPT or Copilot internally has a much narrower job than one shipping AI features to customers. A narrow first scope certifies faster, but it has to include the AI your people actually use, not only the AI you approved.

2. Find out what AI you run. This is where most of the early weeks go. An honest inventory almost always turns up tools nobody signed off: browser extensions, personal accounts, AI features switched on inside software you already pay for. Shadow AI is not a reason to delay; it is the first finding your system deals with.

3. Build the management system. An AI policy, named accountability, the AI inventory, a risk assessment and an AI system impact assessment for each system in scope, and a Statement of Applicability that says which Annex A controls apply and why. Then the controls themselves: approvals for new tools, supplier checks, monitoring, incident handling. If you want a starting point for the policy, our AI policy template is a one-page version written for this.

4. Run it, and keep the records. A Stage 2 auditor wants to see the system working, not a binder written last week. Approvals, reviews, supplier checks and incidents need to be dated and retrievable. This is the step you cannot rush, because evidence only accumulates with time.

5. Internal audit and management review. Audit your own system against the standard, then hold a management review of the results. A certification body expects to see both completed before Stage 2.

6. Stage 1 audit. The certification body reviews your documentation and readiness: is the scope sound, is the system designed to meet the standard, are you ready to be assessed in operation.

7. Stage 2 audit. The body samples records, interviews the people named in your system and checks practice against the documents. Where they part ways it raises nonconformities.

8. Close the findings and receive the certificate. Once nonconformities are closed, the certificate is issued for three years, with surveillance audits, usually annual, and recertification at the end.

How long it takes

Four to nine months is typical from a standing start. The audits themselves are short. What takes the time is steps 2 to 5: finding out what AI is really in use, writing a system that fits the business, and running it long enough that Stage 2 has something real to assess.

What moves you to the short end:

• An existing ISO 27001 or ISO 9001 system, so document control, internal audit and management review are already habits.
• A narrow scope: you use AI, you do not build it.
• Usage records and approvals that already exist, so evidence is a matter of pulling it rather than creating it.

What moves you to the long end: building AI into products for customers, many AI systems in scope (each needs its own risk and impact assessment), and a first inventory that turns up far more than anyone expected.

Who can certify an Australian business

Only a certification body that is accredited for ISO/IEC 42001 specifically. Accreditation is granted standard by standard, so a body accredited for ISO 27001 is not automatically accredited for 42001.

In Australia and New Zealand the accreditation body is the Joint Accreditation System of Australia and New Zealand, JAS-ANZ. In September 2026 A Good Certification Group was reported as accredited by JAS-ANZ for ISO/IEC 42001, among the first in the region. Others will follow, and some bodies certify Australian businesses under accreditation from another member of the international recognition arrangement, which is widely accepted. The register changes, so do not rely on a list in an article, including this one: ask any body you are considering which accreditation body accredits them for 42001, then check that body's own register yourself.

Two more questions worth asking a certification body before you sign:

• Who will actually audit us, and which AI systems have they assessed before? ISO/IEC 42006 sets out the competence a body needs to audit an AI management system.
• Can you run an integrated audit with our ISO 27001 surveillance? It saves days and keeps one set of records.

Where the cost comes from

We do not publish figures, and you should be sceptical of any that are not a written quote for your scope. The drivers are predictable: the number of people and sites in scope, the number of AI systems, whether you build or only use AI, whether an existing management system can be extended, and how much of the readiness work you do in house. The certification body's audit days are one part. The larger part, for most businesses, is the internal time to build and run the system.

Is it worth it now

Australia's direction is set. The government's Guidance for AI Adoption lays out six essential practices, and in July 2026 the Prime Minister announced an Office of AI to implement Australian Standards for AI, with legislation planned for early 2027. A business that runs a 42001 system already has most of what those practices ask for. If customers or tenders are asking now, certification is the clearest answer. If they are not, building the management system without certifying it yet still gets you most of the value.

The fastest way to see where you stand is the ISO 42001 readiness check: a short set of questions that shows which parts of the system you already have and which you would need to build. The full process, including what each audit looks for, is on ISO 42001 certification.