Last updated
What is ISO/IEC 42001?
ISO/IEC 42001 is the international management-system standard for artificial intelligence. It gives an organisation a certifiable way to show it governs AI responsibly, assessing risks and impacts, controlling the AI lifecycle, and improving continually. It is the AI counterpart to ISO/IEC 27001, and it is becoming the thing that unblocks enterprise and government deals where "how do you manage AI risk?" now appears in the questionnaire.
What does readiness involve?
- Scoping. Which AI systems and processes the management system should cover, usually narrower than "everything", and getting that right saves months.
- Gap assessment. A structured review of your current practice against every clause and Annex A control, with a clear picture of what exists, what's partial and what's missing.
- Remediation roadmap. A prioritised, costed plan to close the gaps, policies, processes, risk and impact assessments, and technical controls.
- Impact assessments. Support building the AI system impact assessments the standard requires, aligned where relevant with the Australian Government's AI Impact Assessment expectations.
- Evidence through testing. Where a control claims your AI is secure, we can prove it with LLM penetration testing or red teaming, real evidence, not an assertion.
How does it fit with your other compliance work?
ISO/IEC 42001 shares its management-system backbone with ISO/IEC 27001, so if you're already certified there, much of the machinery, risk process, internal audit, management review, is reusable. We map controls across ISO 42001, the NIST AI RMF and the Australian Government AI Technical Standard so one programme of work satisfies several audiences. If you're weighing the frameworks, see ISO 42001 vs NIST AI RMF.
What do we receive?
- A scoping statement and a full gap assessment against ISO/IEC 42001.
- A prioritised, costed remediation roadmap to audit-readiness.
- Templates and support for AI risk and impact assessments.
- Any supporting technical testing needed to evidence controls, delivered by the same team.
What does it cost and how long does it take?
A gap assessment typically runs two to four weeks; full readiness is usually a few months of phased work. Fixed-fee, indicatively a gap assessment from AU$15,000, with full readiness programmes scoped individually, quoted within one business day of a scoping call.
FAQ
Frequently asked questions
How much does ISO 42001 readiness cost?
Readiness engagements are fixed-fee, quoted within one business day of a scoping call. Cost depends on the size of your organisation and how many AI systems fall in scope of the management system. Indicative pricing is published on this page.
What is ISO/IEC 42001?
ISO/IEC 42001 is the international management-system standard for artificial intelligence, published in 2023. It is to AI what ISO/IEC 27001 is to information security: a certifiable framework for governing how an organisation develops, deploys and oversees AI systems, covering risk assessment, impact assessment, lifecycle controls and continual improvement.
Is Ironbark Cyber a certification body?
No, and no consultancy can be, certification must come from an accredited certification body to stay independent. Ironbark Cyber does the readiness work: the gap assessment, the remediation roadmap and the technical testing that proves your AI controls actually work, so that when the auditor arrives you pass.
How does ISO 42001 relate to ISO 27001 and the NIST AI RMF?
ISO 42001 sits alongside ISO 27001 (information security) and reuses its management-system structure, so if you are already certified to 27001 much of the groundwork exists. The NIST AI RMF is a complementary, non-certifiable risk framework; we map between them so one body of work serves multiple stakeholders. Our comparison of ISO 42001 and the NIST AI RMF covers the differences.
Do we need penetration testing for ISO 42001?
The standard requires you to assess and treat AI risks, and demonstrating that credibly usually means testing. A readiness engagement identifies where technical testing, LLM pentesting, AI red teaming, is needed to evidence a control, and we can deliver that testing as part of the same programme.
How long does readiness take?
A gap assessment typically takes two to four weeks; closing the gaps to audit-ready depends on how much needs to change, and is usually a few months. We phase it so you always know what is left and what it costs.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.