ISO 42001 certification in Australia.
What certification involves, who in Australia can certify you and how to check, a realistic path from readiness to audit, and how the standard fits the AI6 guidance and the coming Australian Standards for AI. We help with readiness; accredited bodies certify.
The short answer
An Australian business is certified to ISO/IEC 42001 by a certification body accredited for that standard. In Australia and New Zealand, accreditation comes from JAS-ANZ, whose register shows which bodies hold it. The body runs a Stage 1 audit of your documentation and a Stage 2 audit of the system in operation, then issues a three-year certificate. Expect four to nine months from a standing start. The voluntary Guidance for AI Adoption (AI6) covers the same ground and is aligned with ISO/IEC 42001, so AI6 work counts towards it. No Australian law requires the certificate today.
What certification involves
The detail of each step is on our certification process page. In short, four things are true of every ISO/IEC 42001 certificate.
A management system, not a product test
ISO/IEC 42001 certifies how an organisation governs the AI it builds or uses: policy, accountability, risk and impact assessment, controls, monitoring and improvement. It does not certify that a particular model is safe or accurate.
Two audits by an accredited body
Stage 1 reviews your documentation and readiness. Stage 2 samples records and interviews the people named in the system to check it is genuinely operating. Nonconformities are closed before the certificate is issued.
A three-year cycle
The certificate lasts three years, with surveillance audits, usually annual, in between and recertification at the end. The evidence has to keep accumulating, so the monitoring has to run as part of the work.
A scope you choose
A business unit, a product or a set of AI systems, provided the boundary is defensible. A scope that leaves out the AI your people actually use will not survive Stage 2 questioning.
A realistic path from readiness to audit
Six phases. The first four are readiness and are where nearly all the time goes; the last is the audit. Each phase also covers one or more of the AI6 practices, so an Australian business following the guidance is already partway along.
| Phase | What you produce | AI6 practice it also covers |
|---|---|---|
| 1. Find the AI and set the scope | An inventory of every AI tool and agent in use, an owner for each, and a draft scope. | 1. Decide who is accountable |
| 2. Assess impacts and risks | An impact note per AI use, a risk register with treatments, and the Statement of Applicability against Annex A. | 2. Understand impacts and plan accordingly; 3. Measure and manage risks |
| 3. Write the policy and the controls | An AI policy staff can follow, disclosure where customers meet AI, and what waits for a person. | 4. Share essential information; 6. Maintain human control |
| 4. Run it and keep the records | Approvals, reviews and usage records, dated and retrievable, over a period long enough to sample. | 5. Test and monitor |
| 5. Internal audit and management review | Your own audit against the standard and a management review of the results, both before Stage 2. | All six, checked together |
| 6. Stage 1, then Stage 2 | An accredited certification body reviews readiness, then assesses the system in operation and issues the certificate once nonconformities are closed. | Beyond AI6: this is the step AI6 has no equivalent for |
The AI6 column is our mapping at the level of themes, not an official crosswalk. Practice names are from the Guidance for AI Adoption on industry.gov.au.
Not sure where you would start? The free ISO 42001 readiness check scores you against the clauses in five minutes and names the weakest ones.
Who can certify you in Australia
Certification bodies are accredited by an accreditation body, and in Australia and New Zealand that is the Joint Accreditation System of Australia and New Zealand, JAS-ANZ. A certificate carries the most weight when the body is accredited for ISO/IEC 42001 itself.
Intertek
Announced that it had been formally accredited by JAS-ANZ to certify to ISO/IEC 42001:2023. Intertek's release
A Good Certification Group
An Australian-owned certification body, reported as accredited by JAS-ANZ to certify organisations to ISO/IEC 42001:2023. techpartner.news
These are the two we could verify from a public source on 9 November 2026; others may hold the accreditation, and scopes change. Before you engage anyone, check the body and its 42001 scope on the JAS-ANZ register. Bodies accredited by another signatory to the IAF multilateral recognition arrangement are also widely accepted. Naming a body here is not a recommendation.
Accredited for ISO/IEC 42001 specifically
Accreditation is granted standard by standard. A body accredited for ISO 9001 or ISO/IEC 27001 may not be accredited for 42001. Ask, then check the JAS-ANZ register yourself.
Independent of whoever prepared you
The body that audits you cannot be the firm that built your management system. If one firm offers both, look elsewhere.
Willing to audit 27001 alongside it
If you hold or are pursuing ISO/IEC 27001, an integrated audit shares document control, internal audit and management review.
How it fits AI6 and the Australian Standards for AI
The Guidance for AI Adoption, published on 21 October 2025 and often called AI6, is Australia's national reference for AI governance. It is voluntary, and its Implementation practices edition is aligned with ISO/IEC 42001. The difference is proof: AI6 is guidance you follow, while ISO/IEC 42001 is a management system an accredited body can certify. When a customer or tender asks for evidence rather than a statement, the certificate is what answers it.
On 15 July 2026 the Prime Minister announced a set of Australian Standards for AI and an Office of AI in the Department of the Prime Minister and Cabinet, with the standards expected to be legislated early in 2027. The release sets out rules for large data centres and AI training, and does not mention ISO/IEC 42001. Until the standards are published, nobody can say how they will interact with it. A management system built now gives you the inventory, the risk records and the decision trail that any future rule is likely to ask about.
This page is general information, not legal advice.
Where Sentry AI fits
We do readiness; accredited bodies certify
Sentry AI is not a certification body. We build and run the thing the audit inspects: the AI inventory, the risk and impact assessments, the policy, the approval trail and the monitoring that produces the evidence, on the Claude or ChatGPT workspace you already use. An accredited body, independent of us, does the audit. Our own ISO 42001 programme is underway, not complete. For the wider picture, see AI governance.
More on ISO 42001
- ISO 42001 explained, with the readiness checklist
- The free ISO 42001 readiness check: score yourself in five minutes
- How we run our own management system, with agents
- ISO 42001 certification in Australia and NZ
- ISO 42001 for Claude and Copilot rollouts
- ISO 42001 vs the NIST AI RMF
- AI governance, the service
Frequently asked questions
Who can certify an Australian business to ISO 42001?
A certification body accredited for ISO/IEC 42001. In Australia and New Zealand the accreditation body is JAS-ANZ, and its public register shows which bodies hold which accreditations. Intertek announced JAS-ANZ accreditation for ISO/IEC 42001 in July 2025, and A Good Certification Group was reported as accredited in September 2026. Check the register on the day you engage a body, because scopes change.
Is ISO 42001 required by law in Australia?
No. No Australian law requires ISO/IEC 42001 certification. The Guidance for AI Adoption is voluntary, and the Australian Standards for AI announced on 15 July 2026 are, on the government's own release, aimed at large data centres and AI training. Customers and tenders are what usually ask for the certificate.
How does ISO 42001 relate to the AI6 guidance?
They cover the same ground. The Guidance for AI Adoption sets out six practices and its Implementation practices edition is aligned with ISO/IEC 42001. AI6 is a reference point you follow; ISO/IEC 42001 is a management system an accredited body can certify. Work done for one counts towards the other.
Will the Australian Standards for AI replace ISO 42001?
Nothing published says so. The Prime Minister's release of 15 July 2026 announced Australian Standards for AI and an Office of AI in the Department of the Prime Minister and Cabinet, with the standards expected to be legislated early in 2027, and set out rules for large data centres. ISO/IEC 42001 is an international management-system standard, and the release does not mention it.
How long does it take to get from nothing to an audit?
Typically four to nine months from a standing start, and less if you already run ISO 27001. The audits themselves are short. The time goes on building the management system and running it long enough to have records a Stage 2 auditor can sample.
Can Sentry AI certify us?
No. Sentry AI is not a certification body. We help with readiness: the AI inventory, the risk and impact assessments, the policy, the decision trail and the monitoring that produces evidence. An accredited certification body, independent of us, does the audit and issues the certificate.
Want to know how far you are from Stage 2?
Take the free readiness check first. If the gaps are real, a short call will show you what building the management system involves for a business your size.
Ask an AI about this page
Opens the assistant with this page loaded: read it, summarise it, cite it.