ISO/IEC 42001 or responsible AI certification. Which fits a small business

What ISO/IEC 42001 is

ISO/IEC 42001:2023 is a management system standard for AI. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system, in the same family as ISO 9001 for quality and ISO/IEC 27001 for information security.^[1][2] Standards Australia announced its adoption on 16 February 2024, and the Australian text, AS ISO/IEC 42001:2023, is an identical adoption of the international standard.^[3][1]

The requirements cover policy, leadership, planning, support, operation, performance evaluation and improvement. Planning includes AI risk assessment and treatment and an AI system impact assessment process. Performance includes internal audit and management review. Annex A sets out reference control objectives and controls, and Annex B gives implementation guidance for each of them.^[1]

Nothing in the standard is reserved for large organisations. Standards Australia's guide for Australian business describes it as applicable to any organisation, regardless of size, type and nature, that provides or uses products or services that use AI systems.^[2] It also shares the harmonised structure of other ISO management system standards, so an organisation that already runs ISO/IEC 27001 or ISO 9001 can align the two.^[1]

Who certifies against ISO/IEC 42001

The standard sets requirements. It does not itself certify anyone. Standards Australia puts it this way: an organisation may adopt the standard for internal conformance or seek third-party assessment through appropriate conformity assessment bodies, and certification arrangements are outside the scope of the text.^[1]

In Australia and New Zealand, the bodies that audit and certify management systems are themselves accredited by JASANZ, the Joint Accreditation System of Australia and New Zealand, which was established by treaty between the two governments in 1991 and provides independent accreditation of conformity assessment bodies.^[4] One certification body announced JASANZ accreditation for ISO/IEC 42001 in July 2025.^[5]

We do not publish a cost or a timeframe for ISO/IEC 42001 certification. Both depend on the scope of the management system being audited, and certification bodies quote on that scope.

What Responsible AI certification is

Responsible AI certification assesses how an Australian business governs its use of AI. The reference point is the eight Australian AI Ethics Principles, which are voluntary principles published by the Department of Industry, Science and Resources, together with the Responsible AI Pledge in our Certification Rules.^[6] It is granted to a business for its practices. It is not an assessment of a particular AI product, model or system.

There are three cumulative tiers. Commit requires a signed Pledge and the questionnaire answered in full. Embed adds a Responsible AI Policy that the business states is implemented across its operations. Govern adds a governance framework covering risk management, oversight roles, impact assessments and accountability. An independent human assessor reviews the evidence, may ask for a video call, and the tier is determined by that assessment rather than chosen by the applicant. The published scope sets out what is checked at each tier and how each answer is assessed.

It operates as a certification trade mark scheme under published Certification Rules, which is a different mechanism from accredited management system certification. Certification lasts 12 months, and every certified business is listed on a public register.

Side by side

The table compares the two on the points a small business usually needs to weigh. Our own column restates the scope page, how certification works and the pricing page.

Where the two meet

The two sit in the same landscape and point at the same Australian reference material. Standards Australia's guide says ISO/IEC 42001 is not a replacement for an organisation's existing frameworks and guidelines but a complementary document, and that in Australia it complements existing frameworks and guides including Australia's AI Ethics Principles.^[2]

The National AI Centre's Guidance for AI Adoption is the other common thread. Its implementation guidance sets out six essential practices and asks organisations to assign accountability for the operation of the AI management system, which is the language of a management system standard.^[7] Responsible AI certification maps its questionnaire to the same six practices on the scope page, with what is covered and what is not covered under each one. That map is a statement of what relates to what. It is not a conformance claim.

Where each one fits

The useful question is what you are being asked for, and by whom.

• A customer or tender names ISO/IEC 42001. Then that is the answer. No other certification stands in for conformance with a named standard.
• You already run an ISO management system. ISO/IEC 42001 shares the harmonised structure of ISO/IEC 27001 and ISO 9001, and Standards Australia notes that organisations can align it with existing ISO programs.^[1]
• You have many AI systems and teams to coordinate. In the Standards Australia guide, Professor Lyria Bennett Moses of UNSW describes certification as particularly helpful in larger organisations, with all the systems, processes and policies that need to be coordinated.^[2]
• You are a small team using AI tools. The Commit tier of Responsible AI certification was designed as an entry point for a business at this stage. It reviews the governance you have, starting with a signed Pledge and a completed questionnaire, and it does not require a management system to be in place first.
• You want something a customer can check. A Responsible AI certification is listed on a public register with its tier and the business's questionnaire responses, subject to the redactions the Rules allow, so a customer can read what was assessed.

These are not exclusive. A business can hold both, and you can note any ISO or other certification you already hold when you apply. A small business that starts with the Australian principles and later needs a certified management system will still need that system audited by a conformity assessment body.

Both also have edges. Neither one tests an AI product, and neither one decides what a particular law requires of you. The scope page describes this as where certification stops and other assurance begins, and the certification overview summarises what a certified business receives.

Questions people ask