ISO 42001 certification in Australia: JASANZ, AIMS accreditation, the Privacy Act and CPS 234

Why Australian organisations pursue ISO/IEC 42001

The question usually comes from a buyer. Enterprise customers adding AI features to their procurement questionnaires, offshore parents asking every subsidiary for the same AI governance evidence, and software vendors selling AI products into regulated sectors all want something stronger than a responsible-AI statement on a website. An accredited certificate gives them an independent audit of how AI systems are assessed, controlled and monitored.

For Australian SaaS and analytics firms selling abroad, the certificate travels with the product and shortens due diligence. For banks, insurers and superannuation funds, the pull is internal as much as external: boards want to know which models make or shape decisions about customers, who owns each one and what happens when it drifts. For the full case, see the ISO/IEC 42001 benefits guide.

JASANZ, Global ACI and checking an AIMS certificate

The Australian Government describes JASANZ as providing independent accreditation of conformity assessment bodies across more than a hundred sector schemes. JASANZ states that it accredits the organisations that certify management systems and does not certify them itself.

What makes ISO/IEC 42001 different is how recently accreditation arrived. Certification bodies now have to meet ISO/IEC 42006, published in 2025, on top of ISO/IEC 17021-1, and accreditation bodies worldwide only began granting AIMS accreditations from late 2025. Whether a given certifier holds JASANZ accreditation for ISO/IEC 42001, or holds it through an overseas accreditation body instead, is something to confirm body by body. Ask for the accreditation certificate and schedule, then match the standard named on it against the accreditation body's own register. The guide to choosing an ISO/IEC 42001 certification body covers the questions to put in writing.

Since 1 January 2026, cross-border recognition of accreditation has run through Global ACI, which replaced the IAF and ILAC arrangements. If the certificate must satisfy customers abroad, check the accreditation body's standing on the Global ACI list first.

Local practice that changes the AIMS project

Personal information in training data and outputs

Where your AI systems handle personal information about individuals and your organisation is covered by the Privacy Act 1988, the Notifiable Data Breaches scheme applies: eligible breaches likely to cause serious harm must be notified to affected people and to the OAIC. Your AIMS should connect the data records required under Annex A.7 and the incident communication in A.8 to that breach process, so one event is not handled twice by two teams. The AI system impact assessment guide shows where privacy effects enter the assessment.

APRA-regulated entities

CPS 234 already requires APRA-regulated entities to classify information assets by criticality and sensitivity, including those managed by third parties, and to notify APRA no later than 72 hours after becoming aware of a material information security incident. A model hosted by a vendor is exactly that kind of asset. Build the AIMS supplier controls under A.10 on the CPS 234 third-party assessments you already run rather than beside them.

Models built overseas

Many Australian organisations use models trained and hosted by providers elsewhere. The certification body will still expect your role for each system to be stated, supplier responsibilities agreed and the impact assessment completed for your use. Ask providers for their system documentation early, because the impact assessment cannot be finished without it.

Trans-Tasman groups

Because JASANZ serves both countries, a group with Australian and New Zealand entities can plan one AIMS scope across both, audited by one certifier. Confirm with that body how it samples sites and systems before the Stage 1 date is set.

Local items to check, and where

How Sterling works in Australia

ISO/IEC 42001 engagements for Australian clients are led from our Sydney office, working with your data science, product, legal and procurement people, with 8,100+ client engagements in 60+ countries behind the team. Sterling does not certify; an independent, accredited certification body audits your AIMS and decides.

ISO/IEC 42001 in Australia: questions buyers ask