THE NOOMA WAITLIST IS NOW OPEN. Founding Members lock in 25% off. Permanently.
Lessons from a year working towards ISO/IEC 42001, from the AI policy to the Statement of Applicability
Twelve months ago, O-HR committed to ISO/IEC 42001 certification. We are now heading into internal audit, and the single most useful thing I can pass on is how much of AI governance comes down to a small set of documents, and to the people who keep them current.
ISO/IEC 42001:2023, usually shortened to ISO 42001, is the world's first management system standard for artificial intelligence. It was published in December 2023 and adopted by Standards Australia as AS ISO/IEC 42001:2023 in February 2024. It applies to any organisation that develops, provides or uses AI, which now describes most Australian businesses. It also follows the same high-level structure as ISO/IEC 27001, so if your organisation already holds security certification, the architecture will feel familiar. The AI-specific content is what is new.
Six AI governance documents did most of the work for us. They fall into two groups. Three describe the system. Three show it running.
1. AI Policy (Clause 5.2; Annex A.2.2 to A.2.4)
This is the foundation. It sets out the responsibilities of everyone in the organisation, how exceptions and risk acceptance are handled, and how it sits alongside the policies you already have rather than replacing them.
Our do's and don'ts are our own policy choices, not wording from the standard. They include only putting company data into approved tools, opting out of model training wherever possible, checking anything before publication for aggregation risk, and never treating AI output as infallible, particularly on security questions.
2. AI Risk and Impact Assessment Procedure (Clauses 6.1.2, 6.1.4 and 8.2 to 8.4)
The policy says what we value. The procedure is the tactical document that tests every new and existing AI tool against it. Each tool receives a risk assessment and an impact assessment, so we can show it sits within our risk appetite and our responsible AI principles. In most organisations this procedure is owned by security, compliance or privacy, with people leaders as essential contributors on impact.
3. Statement of Applicability (Clause 6.1.3)
This lists every Annex A control, states whether it applies, and explains why any control has been excluded. It is the document auditors open first, because it shows the reasoning behind the whole system in one place. A control left out without a defensible reason is a finding waiting to happen.
4. AI Inventory, or AI register (supports Clause 4.3 and Annex A.4.2)
A central register of every approved AI tool and the data each one is allowed to process. If a tool is not on the list, it does not receive company data. New tools are requested through the procedure, not picked up on a Tuesday afternoon because a colleague recommended them.
The standard does not use the word "inventory". But you cannot define the scope of your AI management system, or document your AI resources, without one. Of the six, this is the one most likely to fall behind reality, because new tools arrive faster than anyone updates a register. That is exactly why it matters.
5. Responsible AI Statement (Annex A.8.5)
One source of truth for customers, partners and other stakeholders. It explains, at a higher level than the internal documents, how we manage AI risk and protect data. If a client asks how we use AI, this is what they receive.
6. Reporting Pathway (Annex A.3.3 and A.8.3)
A clear way for our people to raise concerns about AI misuse, with a named contact, which in our case sits with the HR Manager. Annex A.8.3 makes the external side explicit: customers and other external parties need a way to report adverse impacts too, and where appropriate the pathway is referenced in customer and vendor contracts.
We deliberately avoided calling it a whistleblowing channel. In Australia, whistleblower protections under Part 9.4AAA of the Corporations Act 2001 (Cth) attach to specific disclosures, and an AI misuse report is not automatically one of them. The neutral term avoids implying protections that may not apply.
These six did the heavy lifting for us, but they are not everything the standard requires. Certification also calls for documented scope (Clause 4.3), AI objectives (6.2), monitoring and measurement results (9.1), internal audit (9.2), management review (9.3) and corrective action (10.2). The six give those later clauses something to measure.
A reminder while we are here, because it is the simplest control to forget: check the default settings on every AI tool your team uses. Switch off model training, limit how long your data is kept, and delete conversations you no longer need.
Training and retention are separate settings. Opting out of one does not change the other. We record each tool's retention settings in the AI Inventory alongside the data it is approved to process, so an auditor can see where data goes and how long it stays there. For organisations covered by the Privacy Act 1988 (Cth), this also supports the obligation in APP 11.2 to destroy or de-identify personal information once it is no longer needed.
Look again at the six AI governance documents and notice who carries them day to day. The policy needs to be understood and acknowledged. The do's and don'ts need training. The reporting pathway needs a named, trusted person. The impact assessment needs someone who understands what a tool does to the people on the receiving end of it. Accountability for all of it runs through people leaders.
In my experience, a policy holds only as long as someone in the business is answerable for how it is lived. Writing it is the easier half.
That is what a year of this work has made visible to us. AI governance has a technical layer, and it has a professional home in the practice of managing people.
Internal audit will show us where our documents and our day-to-day practice still part ways. That is what it is for.
A management system earns its name the first time it finds something you did not already know.
What documents does ISO 42001 require?
ISO/IEC 42001 requires documented information across the whole AI management system. That includes an AI policy (Clause 5.2), an AI risk assessment and AI system impact assessment process (Clauses 6.1.2 and 6.1.4), a Statement of Applicability (Clause 6.1.3), the scope of the system (4.3), AI objectives (6.2), and records of monitoring, internal audit, management review and corrective action (Clauses 9 and 10). Most organisations also keep an AI inventory, a responsible AI statement and a reporting pathway to show their controls working day to day.
Do small businesses need an AI policy?
Any business whose people use AI tools with company or customer data benefits from one. A short AI policy sets out which tools are approved, what data can go into them and who is accountable. ISO 42001 certification is voluntary, but the policy is the starting point whether or not you pursue it.
What is a Statement of Applicability in ISO 42001?
It lists every control in Annex A of the standard, states whether your organisation applies it, and gives the reason for any exclusion. Auditors usually review it first.
Is ISO 42001 recognised in Australia?
Yes. Standards Australia adopted it as AS ISO/IEC 42001:2023 in February 2024.
What is the difference between AI training and data retention settings?
Training settings control whether a vendor can use what you type to improve its models. Retention settings control how long the vendor keeps your prompts, files and conversations. They are separate, so switching off one does not change the other.
Related reading
International Organization for Standardization and International Electrotechnical Commission, Information Technology — Artificial Intelligence — Management System (ISO/IEC 42001:2023, December 2023) https://www.iso.org/standard/42001
Standards Australia, 'Standards Australia Adopts the International Standard for AI Management System, AS ISO/IEC 42001:2023' (Media Release, 16 February 2024) https://www.standards.org.au/news/standards-australia-adopts-the-international-standard-for-ai-management-system-as-iso-iec-42001-2023
Corporations Act 2001 (Cth) pt 9.4AAA https://www.legislation.gov.au/C2004A00818/latest/text
Privacy Act 1988 (Cth) sch 1 APP 11.2 https://www.legislation.gov.au/C2004A03712/latest/text