ISO 42001 Certification in South Australia

ISO 42001 Certification is the formal recognition issued by an independent certification body confirming that an organisation’s Artificial Intelligence Management System conforms to the requirements of ISO/IEC 42001:2023. The ISO 42001 standard is the first international standard specifically designed to provide requirements for establishing, implementing, maintaining, and continually improving an AIMS within an organisation.

The standard addresses how organisations govern AI systems across their lifecycle, manage AI-related risks and impacts, define responsibilities for AI oversight, and integrate AI governance into their broader management system. Certification is issued following a structured ISO 42001 certification audit in which an independent certification body collects and evaluates objective evidence of conformity against the standard’s clauses and Annex A controls.

Scope and Application of ISO/IEC 42001:2023

ISO/IEC 42001:2023 applies to any organisation that develops, provides, or uses AI systems as part of its operations, regardless of size or sector. The standard is structured around a management system framework using the High-Level Structure (HLS) common to ISO management system standards. It covers clauses addressing organisational context, leadership, planning, support, operation, performance evaluation, and improvement.

This structure enables organisations that already hold certifications against standards such as ISO 27001 or ISO 9001 to integrate AIMS requirements into their existing management system architecture. The ISO 42001 standard introduces AI-specific requirements including AI policy, AI risk assessment, AI impact assessment, AI system lifecycle considerations, data governance, transparency obligations, human oversight mechanisms, and documented information demonstrating operational control over AI systems.

The scope of ISO 42001 Certification is defined by the applicant organisation and documented in a scope statement identifying the AI systems, organisational units, processes, and locations covered by the AIMS. Annex A of ISO/IEC 42001:2023 provides a catalogue of AI-specific controls that organisations select based on their AI context, risk profile, and impact assessments.

A Statement of Applicability documents which Annex A controls are included in scope, which are excluded, and the justification for each determination. The ISO 42001 certification audit evaluates whether the organisation’s AIMS is implemented in accordance with the defined scope, whether Annex A controls are appropriately applied, and whether the management system demonstrates the capacity for continual improvement in AI governance.

ISO 42001 Standard Requirements and Key Controls

The ISO 42001 standard establishes requirements across nine management system clauses (Clauses 4 through 10) and a structured Annex A control set. Clause 4 requires the organisation to understand its context, including internal and external factors relevant to AI governance and the needs of interested parties such as regulators, customers, and affected individuals. Clause 5 addresses leadership, requiring top management to demonstrate commitment to the AIMS through policy endorsement, role assignment, and resource allocation.

Clause 6 covers planning, including AI risk assessment methodology, AI impact assessment processes, and the establishment of measurable AI governance objectives. Clause 7 addresses support requirements including competence, awareness, communication, and documented information management relevant to AI systems and their governance.

Annex A of ISO/IEC 42001:2023 organises AI-specific controls across domains including policies for AI, internal organisation responsibilities, AI resources, AI system impact assessment, AI system lifecycle controls (encompassing design, development, testing, deployment, monitoring, and decommissioning), data management, information for interested parties, and use of AI supplied by external parties.

These controls address practical AI governance obligations such as ensuring transparency and explainability of AI outputs, defining human oversight responsibilities, establishing processes for AI system performance monitoring and incident response, and managing third-party AI dependencies. During an ISO 42001 compliance assessment, the certification auditor evaluates documented evidence demonstrating that selected Annex A controls are implemented and operating effectively within the defined AIMS scope.

The ISO 42001 certification audit process in South Australia follows a structured sequence of defined stages, each with specific objectives, activities, and outputs. The process is governed by ISO/IEC 17021-1 requirements for management system certification bodies and applies consistently across all organisations seeking ISO 42001 Certification in South Australia, regardless of industry sector or organisational size.

Each stage produces documented outputs that inform the subsequent stage and ultimately contribute to the certification committee’s independent decision on whether to issue, maintain, suspend, or withdraw certification.

The ISO 42001 certification audit process commences with an application review in which CertPro examines the applicant organisation’s defined AIMS scope, the AI systems and processes included within that scope, and the organisational context relevant to ISO 42001 compliance. During this stage, CertPro assesses whether any impartiality risks exist that could affect the independence of the audit, determines the competencies required of the audit team based on the organisation’s sector and AI use cases, and establishes the audit program covering Stage 1 and Stage 2 activities.

For South Australian organisations operating in specialised sectors such as defence, healthcare, or energy, audit team composition is determined to include relevant domain knowledge appropriate to the AI systems within scope.

The Stage 1 ISO 42001 audit evaluates the organisation’s documented AIMS against the requirements of ISO/IEC 42001:2023. The Stage 1 audit examines mandatory documented information including the AI policy, AI risk assessment records, AI impact assessment records, the Statement of Applicability, AI system lifecycle documentation, and evidence of internal audit and management review activities.

The auditor determines whether the documented AIMS addresses all applicable clause requirements and Annex A controls within scope, identifies areas where documentation is incomplete or does not demonstrate conformity with the ISO 42001 standard, and communicates findings to the organisation prior to scheduling Stage 2. The Stage 1 audit report documents the areas reviewed, findings identified, and the determination regarding readiness to proceed.

The Stage 2 ISO 42001 certification audit evaluates whether the implemented AIMS conforms to the requirements of ISO/IEC 42001:2023 in practice. This stage involves the collection and evaluation of objective evidence demonstrating that AI governance controls documented in the AIMS are implemented and operating effectively.

Evidence examined during the ISO 42001 audit includes records of AI risk assessments, AI impact assessment outputs, AI system testing and validation records, training and competence records, communication and transparency documentation, monitoring and performance records, internal audit reports, management review minutes, and records of corrective actions. The auditor evaluates control design and operating effectiveness across the organisation’s AI system lifecycle, assessing whether controls address identified AI risks and impacts in the manner described by the AIMS documentation.

Nonconformities identified during the Stage 2 ISO 42001 audit are classified and communicated to the organisation in the audit report. The organisation is required to submit a corrective action response addressing identified nonconformities before the certification committee proceeds to a certification decision.

The audit report documents the evidence reviewed, the controls assessed, the findings identified, and the auditor’s recommendation to the certification committee. The committee independently reviews the audit report and all associated evidence before making the final determination on whether ISO 42001 Certification in South Australia will be issued to the applicant organisation. This independent committee review structure ensures the certification decision reflects objective conformity assessment rather than commercial considerations.

ISO 42001 Certification is issued for a three-year certification cycle, during which the certified organisation undergoes annual surveillance audits to verify ongoing conformity with ISO/IEC 42001:2023. Surveillance audits assess whether the AIMS continues to operate in conformity with the standard, whether identified nonconformities from previous audits have been effectively addressed, and whether the organisation’s AI governance framework remains appropriate to its evolving AI context.

Changes to the organisation’s AI systems, scope, or operational environment that may affect AIMS conformity are reviewed during surveillance activities. At the conclusion of the three-year cycle, a recertification audit evaluates the AIMS in full, and a new certification decision is made based on the evidence collected during that review.

• ✓Application Review and Audit Program Determination
• ✓Stage 1 Audit: Documentation and Readiness Review
• ✓Stage 2 Audit: Evidence Collection and Control Effectiveness Evaluation
• ✓Surveillance Audits and Certification Validity

ISO 42001 compliance requires organisations to establish, implement, maintain, and continually improve an Artificial Intelligence Management System that satisfies the clause requirements of ISO/IEC 42001:2023 and applies appropriate Annex A controls. The ISO 42001 certification audit evaluates the extent to which the organisation’s AIMS fulfils these requirements through documented policies, risk and impact assessment processes, operational controls, performance monitoring mechanisms, and structured management review activities.

The scope of certification is determined by the organisation and must be clearly defined to reflect the AI systems, functions, locations, and processes included within the AIMS boundary.

ISO 42001 compliance requires organisations to maintain specific documented information demonstrating that the AIMS is designed and operating in conformity with ISO/IEC 42001:2023. Mandatory documented information includes the AI policy endorsed by top management, records of AI risk assessments identifying AI-related risks within the defined scope, records of AI impact assessments evaluating the potential impacts of AI systems on individuals and society, the Statement of Applicability documenting selected and excluded Annex A controls with justifications, AI system lifecycle documentation, internal audit reports, and management review records.

The ISO 42001 audit evaluates the completeness, accuracy, and currency of this documented information as part of assessing overall conformity with the standard.

Additional documented information evaluated during the ISO 42001 certification audit includes records demonstrating competence of personnel involved in AI system development, deployment, and governance; communication records demonstrating that relevant information about AI systems is made available to affected parties; records of AI system performance monitoring and incident response; and evidence of continual improvement activities within the AIMS.

The depth and specificity of documentation required varies with the organisation’s AI use cases, the sensitivity of data processed by AI systems, the potential impact of AI decisions on individuals, and the regulatory context applicable to the organisation’s sector. For South Australian organisations operating AI systems that process personal information under the Australian Privacy Act 1988, documentation addressing data governance within the AI lifecycle is a significant component of the ISO 42001 audit scope.

ISO/IEC 42001:2023 requires organisations to establish and implement a systematic AI risk assessment process that identifies risks associated with the development, deployment, and operation of AI systems within the defined scope. The AI risk assessment evaluates the likelihood and consequence of identified risks, considers risks to individuals, organisations, and society arising from AI system behaviour, and documents the risk treatment decisions made by the organisation.

Risk treatment measures are implemented as AIMS controls, and their effectiveness is evaluated during the ISO 42001 certification audit. The auditor examines whether the organisation’s risk assessment methodology is appropriate to its AI context, whether assessments are conducted at planned intervals and when significant changes occur, and whether risk treatment decisions are documented and implemented.

AI impact assessment is a distinct requirement of ISO/IEC 42001:2023, addressing the potential impacts of AI systems on individuals, groups, and society beyond organisational risk. AI impact assessments consider factors including fairness, bias, transparency, explainability, privacy, safety, security, and the broader societal effects of AI system outputs and decisions.

For South Australian organisations deploying AI systems in high-stakes contexts — such as clinical decision support in healthcare, automated compliance monitoring in financial services, or predictive maintenance in critical infrastructure — AI impact assessment documentation is a substantive area of evaluation during the ISO 42001 compliance assessment. The certification auditor examines whether impact assessments are conducted for AI systems within scope, whether findings are documented, and whether identified impacts are addressed through appropriate AIMS controls.

Annex A of ISO/IEC 42001:2023 provides a structured reference set of AI-specific controls that organisations evaluate for applicability based on their AI context, risk assessment outcomes, and impact assessment findings. The Annex A control domains address policies for AI governance, internal organisational roles and responsibilities for AI, AI resources (including data, computing infrastructure, and human expertise), AI system impact assessment processes, AI system lifecycle management, data governance practices for AI, information obligations to affected parties, and management of AI systems supplied by third parties.

Organisations select applicable controls, document exclusions with justifications, and record these determinations in the Statement of Applicability. The ISO 42001 certification audit evaluates the Statement of Applicability for completeness and assesses evidence of control implementation across all applicable Annex A domains within the certified scope.

• ✓Documentation Requirements for ISO 42001 Compliance
• ✓AI Risk Assessment and AI Impact Assessment Requirements
• ✓Annex A Controls and Statement of Applicability

ISO 42001 Certification in South Australia delivers independently verified assurance that an organisation’s Artificial Intelligence Management System conforms to the requirements of ISO/IEC 42001:2023. For organisations operating across South Australia’s diverse industry sectors, this independently issued certification provides objective evidence of AI governance maturity that supports enterprise procurement processes, regulatory due diligence, and stakeholder assurance obligations.

The certification credential is issued following a structured, evidence-based ISO 42001 certification audit and represents an objective assessment of conformity — not a self-declared claim.

• ✓Independent third-party verification of AIMS conformity against ISO/IEC 42001:2023 by a Licensed CPA Firm
• ✓Objective evidence of AI governance maturity for enterprise procurement and vendor assurance reviews
• ✓Structured ISO 42001 audit methodology covering AI risk assessment, AI impact assessment, and Annex A control effectiveness
• ✓Recognition in Australian Government and enterprise supplier qualification and vendor due diligence processes
• ✓Ongoing surveillance oversight confirming sustained AIMS conformity across the three-year certification cycle
• ✓Demonstration of ISO 42001 compliance to regulators, customers, and affected parties in regulated sectors
• ✓Internationally recognised credential supporting cross-border AI governance requirements in Asia-Pacific, Europe, and global markets
• ✓Alignment with Australian AI governance developments, including the National AI Strategy and Privacy Act obligations

South Australian organisations supplying AI-enabled products and services to enterprise and government customers increasingly encounter AI governance requirements embedded in procurement frameworks and vendor qualification processes. Enterprise customers conducting third-party risk management reviews of AI suppliers evaluate governance documentation, risk management practices, transparency obligations, and control frameworks governing AI system behaviour.

ISO 42001 Certification in South Australia provides suppliers with an independently issued credential that satisfies these requirements through an objective, third-party ISO 42001 audit process. Procurement teams and vendor assurance functions can rely on the independently issued certificate as evidence that the supplier’s AIMS has been evaluated by a competent, independent certification body against the international standard for AI management systems — without requiring the enterprise customer to conduct its own detailed AI governance review.

South Australia’s defence and aerospace sector provides a specific example of how ISO 42001 Certification supports vendor qualification. Defence prime contractors and government agencies procuring AI-enabled defence systems, autonomous capabilities, or AI-assisted decision support tools require suppliers to demonstrate verified AI governance frameworks as part of supplier qualification and ongoing assurance activities.

ISO 42001 Certification issued by a Licensed CPA Firm following an independent ISO 42001 certification audit provides the objective assurance that defence procurement frameworks require. Similarly, mining and resources companies deploying AI for autonomous operations, predictive maintenance, and geological analysis increasingly require AI supplier certification as part of their third-party risk management obligations — making ISO 42001 Certification in South Australia a commercially relevant credential for technology suppliers to these sectors.

ISO 42001 Certification provides South Australian organisations with a structured, internationally recognised framework for demonstrating responsible AI governance to regulators, affected individuals, and the broader public. Australian AI governance developments — including the Australian Government’s voluntary AI Ethics Principles and ongoing regulatory reform discussions — create expectations for organisations deploying AI systems to demonstrate accountability, transparency, and risk-proportionate governance.

ISO 42001 compliance, independently verified through a certification audit conducted by a Licensed CPA Firm, demonstrates that the organisation has established a systematic AI management framework. This framework addresses those expectations through documented policies, risk and impact assessment processes, and operational controls. Organisations operating in regulated sectors such as financial services, healthcare, and energy can reference their ISO 42001 Certification as evidence of structured AI governance in regulatory communications and reporting obligations.

• ✓Enterprise Procurement and Vendor Assurance
• ✓Regulatory Alignment and Responsible AI Governance

ISO 42001 Certification in South Australia is relevant to a broad range of industries and organisations that deploy, develop, or procure AI systems as part of their operational activities. South Australia’s industry composition includes several sectors where AI adoption is accelerating, regulatory scrutiny of AI systems is increasing, and enterprise customers or government agencies require independently verified AI governance frameworks as a condition of supplier engagement.

The following sector-specific considerations illustrate how ISO 42001 compliance and the ISO 42001 standard apply across South Australia’s key industries.

Defence, Aerospace, and Advanced Manufacturing

South Australia is home to a substantial concentration of defence and aerospace capability, including organisations involved in naval shipbuilding, defence electronics, autonomous systems, and advanced manufacturing. AI systems deployed in these environments support functions including autonomous vehicle navigation, predictive maintenance for critical defence assets, AI-assisted manufacturing quality control, and supply chain optimisation.

Organisations supplying AI-enabled capabilities to the Australian Defence Force or to defence prime contractors are subject to stringent governance and assurance requirements that increasingly include AI-specific controls. ISO 42001 Certification in South Australia provides defence and aerospace suppliers with an internationally recognised credential demonstrating independently verified AIMS conformity, supporting supplier qualification processes administered by defence procurement agencies and prime contractors. The ISO 42001 audit addresses AI lifecycle controls, human oversight mechanisms, transparency and explainability requirements, and risk management processes relevant to high-consequence AI deployments in defence contexts.

South Australia’s advanced manufacturing sector deploys AI for process optimisation, predictive quality management, computer vision inspection, and automated production planning. Manufacturers supplying automotive, aerospace, and resources industries operate within customer-driven quality and governance frameworks that require documented evidence of AI system controls.

ISO 42001 Certification supports advanced manufacturers in demonstrating that their AI systems are governed by a documented AIMS addressing data quality, model validation, performance monitoring, and human oversight. The independent ISO 42001 certification audit evaluates whether manufacturing AI applications are managed within a conformant AIMS framework, providing customers with verified assurance of AI governance maturity without requiring them to individually assess each supplier’s AI systems.

Healthcare, Energy, Mining, and Financial Services

South Australia’s healthcare and life sciences sector is adopting AI for clinical decision support, medical imaging analysis, patient risk stratification, and administrative process automation. AI systems operating in clinical environments are subject to regulatory requirements under the Therapeutic Goods Administration framework and privacy obligations under the Australian Privacy Act 1988, in addition to clinical governance expectations set by hospital networks and health authorities.

ISO 42001 Certification provides healthcare AI developers and deployers with a structured framework for demonstrating responsible AI governance. The ISO 42001 audit evaluates AI impact assessment processes, transparency controls, human oversight mechanisms, and data governance practices applicable to health data processed by AI systems. Mining and resources organisations deploying AI for autonomous drilling, geological modelling, and operational safety monitoring similarly benefit from independently certified AI governance frameworks that satisfy enterprise customer and regulatory assurance requirements.

South Australia’s energy sector — encompassing conventional generation, renewable energy (including solar and wind), and grid management — is deploying AI for demand forecasting, grid optimisation, asset performance management, and renewable energy integration. Energy AI systems operating in critical infrastructure contexts are subject to governance expectations from the Australian Energy Market Operator (AEMO) and state energy regulators.

Financial services organisations in South Australia using AI for credit assessment, fraud detection, insurance underwriting, and customer analytics operate under APRA and ASIC requirements that include expectations for AI system governance and model risk management. ISO 42001 Certification for South Australian businesses in these sectors provides an independently verified credential demonstrating that AI governance frameworks satisfy structured, internationally recognised requirements aligned with the ISO 42001 standard.

Technology, SaaS, and AI Companies in South Australia

Adelaide’s technology ecosystem includes a growing community of SaaS providers, AI companies, cloud service providers, cybersecurity organisations, and software development firms that develop and operate AI-enabled products and services. These organisations frequently supply AI capabilities to enterprise customers in regulated industries including financial services, healthcare, defence, and government.

Enterprise procurement teams conducting vendor risk reviews of AI technology suppliers increasingly require independent ISO 42001 Certification as evidence that the AI supplier operates a conformant AIMS. ISO 42001 Certification that Adelaide-based technology organisations obtain through CertPro’s independent audit process provides this evidence through a structured, evidence-based ISO 42001 certification audit conducted by a Licensed CPA Firm. The certification credential is especially relevant for South Australian technology companies pursuing contracts with large enterprises, government agencies, or international customers requiring ISO 42001 compliance evidence as part of their supplier qualification process.

ISO/IEC 42001:2023 establishes a comprehensive AI governance framework that organisations implement through their AIMS. The ISO 42001 certification audit evaluates how effectively the organisation’s AIMS addresses AI governance obligations across key functional domains — including leadership and accountability, AI system lifecycle management, risk and impact assessment, data governance, human oversight, transparency and explainability, and continual improvement.

Each of these domains is assessed during the ISO 42001 audit through the review of documented evidence and the evaluation of control implementation across the certified scope.

Leadership Accountability and AI Policy

ISO/IEC 42001:2023 requires top management to demonstrate active accountability for the AIMS by endorsing the AI policy, assigning governance roles and responsibilities, allocating resources for AIMS operation, and participating in management review activities. The AI policy establishes the organisation’s commitments to responsible AI development and use, defines the governance principles applied to AI systems within scope, and communicates the organisation’s approach to AI ethics, risk management, and stakeholder engagement.

During the ISO 42001 certification audit, the auditor evaluates evidence of top management engagement with the AIMS, including management review records, resource allocation decisions, and leadership communications related to AI governance. The effectiveness of leadership accountability mechanisms is a foundational element of AIMS conformity assessment, as governance failures at the leadership level typically manifest across multiple Annex A control domains.

AI System Lifecycle Management and Data Governance

ISO/IEC 42001:2023 requires organisations to establish controls governing AI systems across their entire lifecycle — from initial design and data acquisition through model development, testing, validation, deployment, operational monitoring, and eventual decommissioning. Lifecycle controls address the governance obligations applicable at each stage, including data quality requirements, model validation processes, testing for fairness and bias, documentation of training data provenance, deployment authorisation processes, and procedures for responding to AI system performance degradation or unexpected behaviour.

The ISO 42001 audit evaluates whether lifecycle controls are documented, implemented, and operating effectively for the AI systems within the certified scope. Data governance controls within the AIMS address the quality, integrity, privacy, and security of data used to train, validate, and operate AI systems — with particular relevance for South Australian organisations processing personal information under the Australian Privacy Act 1988.

Human oversight mechanisms are a significant element of ISO 42001 compliance, particularly for AI systems making or influencing consequential decisions affecting individuals. ISO/IEC 42001:2023 requires organisations to define the degree of human oversight applied to AI system outputs, establish processes for human review of AI decisions where appropriate, and document the rationale for oversight design decisions based on AI system risk and impact profiles.

Transparency and explainability controls require organisations to communicate relevant information about AI systems to affected parties — including the nature and purpose of AI use, the basis for AI-generated outputs where disclosure is appropriate, and mechanisms for individuals to seek review or explanation of AI decisions affecting them. The ISO 42001 certification audit evaluates the implementation of these controls against the documented AIMS and the applicable Annex A control selections recorded in the Statement of Applicability.

ISO 42001 certified companies in South Australia maintain their certification status through ongoing conformity with ISO/IEC 42001:2023 and participation in the structured surveillance and recertification audit cycle administered by CertPro. Certification maintenance obligations apply from the date of initial certificate issuance and continue throughout the three-year certification validity period.

Organisations are required to notify CertPro of significant changes to their AIMS scope, AI systems, or operating context that may affect conformity with the ISO 42001 standard. This enables the certification body to determine whether additional audit activities are required to confirm continued conformity.

Conditions for Suspension and Withdrawal of Certification

ISO 42001 Certification may be suspended by the certification committee where the certified organisation fails to resolve significant nonconformities identified during surveillance audits within the required timeframe, where the organisation refuses to permit scheduled audit activities, or where evidence indicates that the AIMS has ceased to operate in conformity with ISO/IEC 42001:2023 in a material respect.

Suspension is a temporary status signalling active nonconformity that requires resolution before certification status can be restored. Withdrawal of certification occurs where suspended nonconformities remain unresolved, where the organisation voluntarily surrenders certification, or where the certification body determines that continued certification would be inconsistent with its obligations as an independent body. These provisions are governed by ISO/IEC 17021-1 requirements and applied uniformly across all ISO 42001 certified companies in South Australia, regardless of sector or organisational size.

Recertification Audit and Scope Changes

At the conclusion of the three-year certification cycle, ISO 42001 certified companies in South Australia undergo a recertification audit that evaluates the AIMS in full against ISO/IEC 42001:2023 requirements. The recertification audit scope includes all clauses, Annex A controls, and documented information within the certified AIMS scope, with particular attention to the effectiveness of continual improvement activities, the resolution of nonconformities identified during the preceding certification cycle, and any changes to the organisation’s AI context, systems, or governance framework.

Organisations that wish to extend their AIMS certification scope to include additional AI systems, organisational units, or locations may apply for a scope extension, which is evaluated through an additional audit activity. Scope reductions are processed through a formal scope change review. The recertification audit results in a new certification decision and, where conformity is confirmed, the issuance of a new certificate covering the subsequent three-year cycle.

ISO 42001 Certification is distinct from other management system certifications and AI governance frameworks in its specific focus on Artificial Intelligence Management Systems. Understanding how ISO/IEC 42001:2023 relates to complementary standards assists South Australian organisations in defining their certification and ISO 42001 compliance strategy.

The ISO 42001 standard does not replace ISO 27001 (information security), ISO 9001 (quality management), or sector-specific frameworks. Instead, it operates alongside them — addressing AI-specific governance obligations not fully covered by existing management system standards.

ISO 42001 and ISO 27001 Integration for South Australian Organizations

ISO/IEC 42001:2023 shares the High-Level Structure common to ISO management system standards, enabling South Australian organisations that hold existing ISO 27001 or ISO 9001 certifications to integrate AIMS requirements into their existing management system framework. Shared elements — including context of organisation analysis, leadership accountability structures, documented information management, internal audit processes, and management review activities — can be aligned across both management systems, avoiding unnecessary duplication of governance documentation and audit activity.

However, the ISO 42001 standard introduces AI-specific requirements — including AI risk assessment, AI impact assessment, AI system lifecycle controls, and Annex A AI controls — that are not addressed within the ISO 27001 information security framework. Organisations with existing ISO 27001 certification seeking ISO 42001 Certification in South Australia undergo an ISO 42001 certification audit that evaluates their AIMS specifically against the AI management system requirements of ISO/IEC 42001:2023, independent of their existing ISMS certification status.