The International Organization for Standardization (ISO) 42001 standard provides requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). Internal and external parties can use this international standard to assess an organisation’s ability to govern, develop, deploy, and manage AI systems responsibly while
addressing risks, ethical considerations, and regulatory obligations.
ISO/IEC 42001 is the world’s first internationally recognised standard for Artificial Intelligence Management Systems (AIMS). Achieving ISO 42001 certification demonstrates an organisation’s commitment to the responsible governance of AI, effective AI risk management, transparency, accountability, human oversight, and compliance with applicable legal, regulatory, and ethical requirements.
This package is tailored for organisations that have already implemented the Cyber Premium or Cyber Elite package and wish to establish or mature their Artificial Intelligence Management System, enabling the secure, ethical, and compliant adoption of AI technologies across the organisation.
ISO/IEC 42001 is an internationally recognised standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). It provides a framework for organisations to govern AI responsibly, manage AI-related risks, and ensure the ethical, transparent, and compliant use of artificial intelligence technologies.
AAchieving ISO/IEC 42001 certification demonstrates an organisation’s commitment to responsible AI adoption, effective AI governance, risk management, and compliance with emerging AI regulations and industry best practices. This service is tailored for organisations that have already implemented the Cyber Premium service and wish to strengthen their AI governance framework and enable the safe, ethical, and compliant use of artificial intelligence technologies.
Initial establishment and implementation of ISMS services and perform internal audit to achieve certification. This phase ensures that we have implemented the necessary security controls and practices from ISO 27001 Annex A, preparing for your ISO 27001 external audit.
Initial establishment and Implementation of the Artificial Intelligence Management System (AIMS), including AI governance frameworks, policies, procedures, risk assessments, controls, and internal audit activities to support certification readiness. This phase ensures that the organisation has implemented the necessary AI governance practices and controls required by ISO/IEC 42001, preparing for external certification assessment.
1. Gap Analysis
2. Implementation Roadmap
3. AI Risk and Impact Assessment
4. AI Policy and Procedure Development
5. Training
6. AI Risk Treatment and control implementation
7. Internal Audit
8. External Audit
Continuous Compliance & AI Governance: Ongoing maintenance, AI risk assessments, governance reviews, monitoring activities, internal audits, and continual improvement services to ensure ongoing compliance with ISO/IEC 42001 requirements and successful re-certification every three years.
1. Post-Certification Monitoring
2. AI Governance & Control Updates
3. AI Risk Management Support
4. Compliance Reporting
5. Continuous compliance Support
6. Surveillance Audit
7. Re-Certification Audit
This package requires the use of the GRC tool. Vanta and Darta accelerates the ISO/IEC 42001 certification journey by simplifying AI governance, risk management, compliance monitoring, and audit readiness activities through a single integrated platform. Vanta seamlessly integrates with your Microsoft Cloud environment, leveraging the security, compliance, and governance controls already established through the Cyber Premium or Cyber Elite package.
GRC Tool provides a centralized view of your Artificial Intelligence Management System (AIMS), enabling organisations to manage AI risks, monitor compliance obligations, maintain governance documentation, collect audit evidence, and demonstrate responsible AI practices. Through automation and continuous monitoring, Vanta helps reduce administrative effort while supporting ongoing compliance with ISO/IEC 42001 and emerging AI regulatory requirements.
Determine organisational context, interested parties, applicable requirements, proposed AIMS scope and boundaries. Identify the organisation’s role for in scope AI systems and establish the initial AI system and use-case inventory. Assess current practices against ISO/IEC 42001 and identify gaps and areas of non-conformance.
How is this achieved?
Develop the organisation-specific implementation plan, milestones, owners, dependencies and delivery schedule. Establish executive accountability, AIMS ownership, governance forum, RACI and document plan
How is this achieved?
AEstablish risk and impact methods and criteria. Assess AIMS risks and opportunities, system-level risks, potential impacts on individuals, groups and society, and regulatory, contractual, security, privacy, fairness, transparency, reliability and misuse concerns.
How is this achieved?
Develop or adapt policies and procedures for responsible AI use, acceptable use, AI lifecycle and change, data governance, suppliers, human oversight, transparency, incidents and complaints, monitoring, communication, documented information, internal audit, management review, nonconformity and corrective action.
How is this achieved?
Deliver general responsible-AI awareness and role-based training for executives, governance personnel, AI system owners, developers, procurement, privacy, security, legal and risk functions, as applicable. Define competence requirements and retain evidence.
How is this achieved?
Select controls needed to treat identified risks and impacts. Compare the selected control set against Annex A, document applicability decisions, assign
control owners, implement treatments and collect operating evidence.
How is this achieved?
IConduct an objective and impartial internal audit of the scoped AIMS. Record findings, support corrective action, prepare management-review inputs and facilitate the formal management review before certification.
How is this achieved?
Support selection of an appropriately accredited certification body, Stage 1 documentation preparation, Stage 2 operating evidence, staff readiness, auditor coordination and remediation of findings.
How is this achieved?
Review AIMS objectives, KPIs/KRIs, evidence currency, risks, actions, incidents, complaints, exceptions and changes to AI systems, data, suppliers, intended use or jurisdictions.
How is this achieved?
Maintain policies, procedures, control ownership, the Statement of Applicability, governance records and operational controls as the organisation and technology environment change.
How is this achieved?
Maintain the AI risk and opportunity register, assess new or materially changed AI systems, refresh impact assessments where required, review treatments and residual risks, and assess supplier and data risks.
How is this achieved?
Provide the contracted advisory hours, GRC workflow support, evidence coordination, annual internal-audit and management-review support, policy updates and continual-improvement tracking.
How is this achieved?
Provide the contracted advisory hours, GRC workflow support, evidence coordination, annual internal-audit and management-review support, policy updates and continual-improvement tracking.
How is this achieved?
Prepare evidence, coordinate the certification body and support remediation for surveillance audits scheduled within the certification cycle.
How is this achieved?
Review the full AIMS, scope, risks, impacts, controls and evidence, and support the re-certification audit before certificate expiry.
How is this achieved?
IIn today’s digital landscape, technology underpins nearly every aspect of business operations, from team collaboration to customer engagement and revenue generation. However, this reliance on technology also increases the risk of cyberattacks. With the rise of remote work, the potential for both internal and external security breaches has grown, putting businesses at greater risk.
Since 2012, we have supported the Australian federal government, state governments, and large enterprises. In 2021, we expanded our services to small and medium-sized enterprises (SMEs), leveraging our experience in the public and enterprise sectors to enhance cybersecurity for SMEs. In 2024, we further expanded our services and support to the United States alongside Australia.
Our advanced professional services designed for government and large enterprises include a comprehensive cybersecurity uplift program, Penetration Testing, Security Solution Architecture and Implementation, Governance, Risk, Compliance (GRC): IRAP assessment, PSPF and ISM Advisory, ACSC Essential 8, ISO 27001 consultancy, SOC 2 consultancy, ISO 42001 consultancy, Business
Continuity and Disaster Recovery (BCDR), Incident Response, Digital Forensics, and Security awareness training.
For small and medium-sized businesses (SMBs), we understand the budget constraints many face. That’s why, in partnership with Microsoft, we provide cost-effective, high-quality Cyber Security Protection Packages, GRC Compliance Packages (ISO 27001, SOC 2, ISO 42001), and Secure AI Adoption Packages.
Supported by ACSC intelligence, Microsoft’s leading-edge technologies, and Vanta/Drata GRC tools, these packages are tailored to the unique needs of SMBs, delivering both value and comprehensive information security in the era of AI.
We are backed by leading security vendors and reputable associations to strengthen your cyber security. Our team of experts shares their knowledge and experience to provide you with the best solutions.
