Why ISO 42001 matters now
Procurement teams in financial services, government and health are starting to ask for ISO 42001 alignment in the same RFP fields they ask for ISO 27001. The first wave of certifications is happening; the second wave will be table-stakes. Australian organisations that align early will avoid the procurement-pain of late-2026.
The five-phase roadmap
Implementation phases
- Phase 1 — Context & scope (weeks 1–4). Define the AIMS scope, interested parties, AI policy and the AI risk methodology.
- Phase 2 — AI inventory & impact assessment (weeks 4–10). Catalogue AI systems, classify by risk tier, run AI Impact Assessments for high-risk systems.
- Phase 3 — Annex A control implementation (weeks 8–18). Implement and evidence the relevant controls across data, model, deployment and supplier lifecycle.
- Phase 4 — Internal audit & management review (weeks 16–22). First-pass internal audit, gap closure, management review with documented decisions.
- Phase 5 — Stage-1 & Stage-2 certification audit (weeks 20–26). Engage an accredited certification body; stage-1 documentation audit, stage-2 evidence audit, certification.
What Annex A actually requires
ISO 42001 Annex A defines 38 controls grouped under policies, internal organisation, resources, AI system impact assessment, AI system life cycle, data for AI systems, information for interested parties, use of AI systems and third-party relationships. Most controls map cleanly to extensions of an existing ISO 27001 ISMS — making the second standard easier than the first.
The AI Impact Assessment
The single biggest control to land well is the AI System Impact Assessment. It evaluates risks to individuals, groups, society and the organisation across a defined AI system’s lifecycle. Done well it parallels a Privacy Impact Assessment and feeds the AI risk register; done badly it becomes a documentation tax. Invest in the template.
SHORTCUT FOR AIMS OWNERS
Generate your ISO 42001 policy pack in one mission.
FORTE/CYBERx produces a 30+ page ISO 42001-aligned AIMS policy pack with editable sections, AI impact assessment template and Annex A control mapping.
Try the Policy Pack WizardFAQ
What is ISO/IEC 42001?
ISO/IEC 42001:2023 is the first global management-system standard for Artificial Intelligence — equivalent in structure to ISO 27001 for information security or ISO 9001 for quality. It defines the requirements for an AI Management System (AIMS).
Is it certifiable?
Yes. Accredited certification bodies are now offering ISO 42001 audits. Early certifications are concentrated in AI vendors, regulated industries and federal-procurement-exposed providers.
How long does implementation take?
For an organisation already running ISO 27001, plan for 4–6 months to certification-ready. Greenfield implementations typically take 9–12 months. Most of the effort is the AI risk assessment and impact assessment process — not documentation.
Should we certify, or just align?
Many organisations adopt the controls without seeking certification. Certify when customers, regulators or boards ask for third-party assurance; align when the governance value alone is sufficient.