ISO 42001 readiness in Australia.

Annex A adds AI-specific controls in Table A.1, grouped under control objectives, selected against the AI risk assessment and the AI system impact assessment and recorded in a Statement of Applicability. The standard defines that statement as documentation of all necessary controls with justification for their inclusion or exclusion, and records that an organisation may not require every control Annex A lists, and may add controls of its own. The requirements apply to any organisation that provides or uses products or services utilising AI systems, regardless of size, type and nature. The clause-by-clause requirement, and the evidence a stage-two audit samples against each one, is set out in ISO 42001 requirements clause by clause, and the audit evidence.

The management system starts with an AI policy that states what the organisation permits, by whom, and under what oversight, and a system inventory that names every AI system in use or under development, from a customer-facing chat assistant to a model embedded inside a product, plus every third-party AI tool a team has adopted without anyone recording it.

Each system in that inventory is risk-assessed on its own terms. A statement that the organisation manages AI risk in general does not survive an auditor asking which system, used for what, assessed against which criteria. Where a system affects people, an impact assessment covers what that effect could be: a safety outcome, a decision that touches someone's rights, an output nobody checked before it reached them. Controls follow from both: over the AI life cycle from design to retirement, over the data the systems are trained or run on, over third-party and supplier AI, and over the human oversight built into each automated action. Monitoring closes the loop after deployment, tracking performance and drift and feeding incidents back into the risk register.

ISO/IEC 42001:2023 defines it as a formal, documented process by which the impacts on individuals, groups of individuals and societies are identified, evaluated and addressed. The standard carries it in three places. Clause 6.1.4 requires the process to be defined. Clause 8.4 requires it to be performed, at planned intervals and when a significant change occurs, with the results retained as documented information. Annex A.5, assessing impacts of AI systems, holds the controls that support it. That split is what an audit tests: a defined process with no performed assessment answers clause 6 and leaves clause 8 with nothing to sample.

The Australian Government published the Voluntary AI Safety Standard in September 2024: ten guardrails covering accountability and governance, a risk management process, protecting AI systems and data governance, testing and monitoring, human oversight, informing end users about AI-enabled decisions, interactions with AI and AI-generated content, a way for people affected to challenge the use or the outcome, disclosure to other organisations across the AI supply chain about data, models and systems, record-keeping, and stakeholder engagement.

In October 2025 the Department of Industry, Science and Resources published the Guidance for AI Adoption, six essential practices it describes as updated and simplified guidance that evolves the standard. Both are voluntary and self-assessed. There is no accredited audit and no certificate.

The guardrails were written to align with international standards including ISO/IEC 42001, and the overlap is substantial. An AI policy and accountable roles satisfy the governance guardrail, the risk assessment and treatment work satisfies the risk management guardrail, the system inventory and monitoring work satisfies testing and monitoring, and the human oversight controls satisfy the guardrail written for exactly that. An organisation that only needs to answer the Voluntary AI Safety Standard gets there through the same gap-analysis method, without certification-body cost. An organisation pursuing ISO 42001 certification gets the guardrails covered as part of the readiness work. Each guardrail, and the ISO/IEC 42001 clauses it maps onto, is covered in The Voluntary AI Safety Standard's 10 guardrails.

Certification-body fees, where certification is the target, are separate, paid to the certification body directly, and recur on an annual and three-year cycle.

Send a brief to info@blackshard.com.au with the AI systems you have in mind, who is asking for ISO 42001 or the Voluntary AI Safety Standard, and your target date.