What ISO/IEC 42001 readiness involves, and what it doesn't

ISO/IEC 42001:2023, adopted in Australia as AS ISO/IEC 42001:2023, specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). It applies to organisations that develop, provide or use AI.

What readiness work covers

Readiness means designing and operating the management system well enough that an accredited auditor can assess it. In practice that includes:

• Scope and applicability: which AI systems, business units and stakeholders are in scope.
• Policy, objectives and roles: an AI policy, governance charter and accountable owners.
• An AI system inventory: systems, owners, suppliers, models, datasets and integrations.
• Risk and impact processes: AI risk assessment and treatment, and AI system impact assessment.
• Controls: for data, models, providers, prompts, agents and third-party dependencies.
• Operations: monitoring, incidents, recordkeeping and corrective action.
• Evidence: an evidence register, internal evaluation and management review.

What it doesn’t include

Certification is issued by an accredited certification body, not by the organisation that helped you implement the system. A readiness partner can prepare you for audit. It cannot certify you.

Similarly, mapping your controls to ISO/IEC 42001, NIST AI RMF or Australian guidance is interpretive work. It is useful, but it is not a guarantee of compliance or a one-to-one equivalence between frameworks.

Complementary frameworks

ISO/IEC 42001 rarely stands alone. Useful companions include:

• NIST AI RMF 1.0 and its Generative AI Profile, organised around GOVERN, MAP, MEASURE and MANAGE.
• ISO/IEC 23894 for AI risk management and ISO/IEC 42005 for AI system impact assessment.
• Australian Essential AI practices, the Australian Government’s guidance for AI adoption.

Engineering evidence is governance evidence

The strongest AIMS evidence often comes from engineering: threat models, prompt-injection test results, retrieval access checks, agent audit logs and evaluation records. Connecting technical work to governance requirements avoids building the same evidence twice.