Cyber security · AI governance
ISO 42001 readiness and AI management system consulting in Australia
A register of your AI and automated decisions, a gap assessment against ISO/IEC 42001, and the governance the new Privacy Act transparency rules assume you already have. Led by consultants who have run security and governance functions, with an offshore team that carries the documentation at a sensible cost.
Why this matters now
From 10 December, your privacy policy has to name the decisions your software makes
New Privacy Act rules, APP 1.7 to 1.9, commence on 10 December 2026. From that date, every APP entity must disclose in its privacy policy the decisions a computer program makes, or substantially informs, about people, where those decisions could significantly affect someone's rights or interests. The Office of the Australian Information Commissioner released its final guidance on 30 September 2026.
The rule is read broadly. It covers rule-based tools and configured software, not only AI. A human signing off does not take a decision out of scope if the program substantially shaped it. And the obligation sits with your business, not your vendor, including AI you procured and tools staff use day to day. The OAIC can issue infringement notices for a privacy policy that falls short.
To comply, you first have to know every system that makes or informs those decisions. That register is the first thing an ISO 42001 readiness exercise produces. The Privacy Act does not require ISO 42001; it requires disclosure. But the work that makes disclosure accurate is the work ISO 42001 asks for, and it gets you ahead of the AI standards and regulation still to come. Our plain-English guide to the 10 December obligation covers the detail.
What ISO 42001 is
The standard, in plain terms
ISO/IEC 42001:2023 is the international standard for an AI management system, usually shortened to AIMS. It is the AI-governance counterpart to ISO 27001. Certification means an accredited third party has confirmed you have a working system for identifying the risks of the AI you build or use, deciding how to treat them, applying controls, and checking those controls keep working. It is a certificate about the management system and the governance it operates, not a stamp on a particular model.
In Australia it is voluntary. Certification is issued by an accredited certification body. Coder Trove is a consultancy, and we prepare you for the audit and support you through it; we do not issue certificates, and no consultancy should claim to.
Who needs it in Australia
The usual trigger is commercial or regulatory. An enterprise or government procurement team asks how you govern AI. A customer's third-party risk process scores it. You are preparing for the 10 December automated-decision transparency obligation and want the register and governance behind it. Or you build or resell AI features and want to show customers they are managed responsibly. Organisations that already hold ISO 27001 are often most of the way there, because the management-system backbone is shared.
How we run it
From the first register to certification, and what happens after
AI and automated-decision register
We build the list: every AI and automated system that makes or substantially informs decisions about people, what it decides, whether a person reviews it, what personal information it uses, and who owns it. One to three weeks. This is also what you need for the Privacy Act disclosure.
Gap assessment
We compare what you have against ISO/IEC 42001 and produce a costed, sequenced plan. This is also the point to fix the scope: which systems, which business units, which AI uses are in.
Management system design
AI policy, risk assessment method, risk register, human-oversight rules, roles and accountability, and the records the standard expects, written for your organisation in the words your people use, with a named owner for each.
Controls and evidence
The technical and process controls around your high-impact systems: access, logging, monitoring, data handling and review gates. Delivered by our engineers or specified for your team, with evidence kept as it accrues.
Operate and internal audit
The system has to be seen running before Stage 2. We run the internal audit independently of the people who built the system and facilitate the management review so leadership's decisions are recorded the way the standard requires.
Certification support (optional)
Where you want to certify, we prepare you for the Stage 1 and Stage 2 audits, attend both, manage findings and corrective actions, and stay through surveillance. A readiness-only engagement aimed at the Privacy Act obligation stops before this step.
Timeline and cost
How long ISO 42001 takes and what it costs in Australia
For an organisation with a contained AI footprint and reasonable practice, four to eight months from gap assessment to certification readiness is realistic. Organisations with an existing ISO 27001 management system and a small AI footprint are often ready for Stage 1 in around three months. A readiness-only engagement, aimed at the 10 December obligation rather than a certificate, is shorter again.
Costs fall into the same parts as any management-system standard. The ranges below are indicative market ranges for Australian organisations of 50 to 500 people, so that you can sanity-check any proposal, including ours.
| Cost line | Typical Australian range | What moves it |
|---|---|---|
| Consulting: register, gap assessment, management system build, internal audit, audit support | $20,000 to $60,000 | Number and complexity of AI systems, how much of an existing ISMS can be reused, how much your own team can carry |
| Readiness only: register and privacy-policy disclosure for the 10 December obligation | Lower end of the range above | Number of systems and business units in scope; whether you want the governance built or only the inventory |
| Certification body: Stage 1, Stage 2, then annual surveillance | Comparable to ISO 27001, set by audit days | Headcount, sites and systems in scope; choice of certification body |
| Technical remediation | Nil upward | Gaps in logging, access control and monitoring around high-impact systems; often small where Microsoft 365 or cloud-native tooling is already in place |
| Internal time | Roughly 0.2 to 0.4 of a full-time person for the programme | Who owns AI governance after the engagement, and whether that role exists before you start |
Ranges are indicative as at October 2026, exclusive of GST, and drawn from published Australian pricing and comparable ISO programmes. A fixed-price proposal follows a gap assessment or a scoping conversation.
Our approach
How Coder Trove runs an ISO 42001 programme
Led by practitioners
Consultants who have owned the risk
The practice is led by our Chief Information Security Officer and run by our Cyber Security Practice Manager. Our governance consultants have led cyber consulting practices, held CISO and CTO roles in government and the private sector, and hold CISM and OSCP certifications. They have presented to audit and risk committees and been audited themselves.
AI and security on one team
The people who build AI, governing it
Our AI practice builds agents, automation and retrieval systems for clients, so the engineers assessing your AI systems understand how they are built, where they fail and what evidence of control looks like in practice, not only on paper.
Documentation at the right cost
Senior judgement, offshore effort
A management system involves a large amount of structured writing, register maintenance and evidence collection. Our delivery centre in Ho Chi Minh City does that work under the direction of the Australian lead, which keeps the consulting line in the lower half of the range above without thinning out the senior time where it matters.
Related frameworks
ISO 42001, ISO 27001, the Essential Eight and the Privacy Act
Australian organisations rarely face one framework at a time, and the work overlaps more than the acronyms suggest.
ISO 27001 and ISO 42001
ISO 42001 shares its management-system structure with ISO 27001: context, leadership, planning, support, operation, evaluation and improvement. An organisation with an ISMS already has the backbone and most of the evidence habits. What ISO 42001 adds is AI-specific: the system register, AI risk assessment, human-oversight rules and accountability for AI decisions. Where you need both, we plan them together and collect evidence once.
Essential Eight and ASD Essentials
The Essential Eight and the new ASD Essentials guidance cover the security controls underneath: identity, patching, backups and the rest. ASD Essentials also adds guidance on AI-enabled systems and expects defined board accountability for cyber security, which lines up with what ISO 42001 asks for on the AI side.
Privacy Act automated decision-making transparency
The APP 1.7 to 1.9 obligation from 10 December 2026 requires disclosure, not certification. The register and governance an ISO 42001 readiness exercise produces are what make that disclosure accurate, and a readiness-only engagement is a common starting point that carries straight into full ISO 42001 later if you want it.
Common questions
ISO 42001 questions we are asked most
Do we need ISO 42001 to meet the new Privacy Act rules?
Is ISO 42001 mandatory in Australia?
We already have ISO 27001. How much is left?
How long does ISO 42001 take?
How much does ISO 42001 cost?
Who issues the certificate?
Can you just help us get ready for 10 December?
Start here
Tell us which systems make decisions about people, and who is asking
Thirty minutes with Marcel Rizzolo, director, to confirm scope, timeline and whether readiness or full certification is the right shape. A scoped proposal follows within a few business days. If you would rather write first, use the contact page.