ISO/IEC 42001:2023, the NIST AI Risk Management Framework and Australia’s Guidance for AI Adoption are the three AI governance frameworks Australian businesses actually have to choose between in 2026. They do different jobs. ISO/IEC 42001:2023 is a certifiable management system standard. NIST AI RMF is a free voluntary risk framework. The Guidance for AI Adoption is the Australian government’s stated expectation.
This page compares all three on cost, certification, audit evidence, model risk coverage and Australian regulatory weight, then gives a recommendation by business type. We implement all three across our Perth and Western Australian client base. If the open question is who should do the work rather than which framework to adopt, our map of AI governance providers in Australia sets out who sells what across four tiers of the market.
For most Australian small and mid-market businesses, start with the Guidance for AI Adoption (GfAA). It is free, aligns with the Australian government’s stated position, and produces a defensible baseline in eight to twelve weeks.
Move to ISO/IEC 42001:2023 when you sell to enterprise or government buyers who run supplier due diligence, because it is the only one of the three that can be independently certified.
Use NIST AI RMF when you need depth without certification cost, particularly if you already run NIST CSF 2.0 for cyber security.
Mature programmes use all three, with one as the anchor and the others as references. The decision is which framework leads, not which single framework you adopt.
| Dimension | ISO/IEC 42001:2023 | NIST AI RMF | Australia GfAA |
|---|---|---|---|
| Type | International management system standard | Voluntary US government framework | Voluntary Australian government guidance |
| Published | December 2023 | January 2023 | October 2025 |
| Issued by | ISO and IEC | US National Institute of Standards and Technology | Department of Industry, Science and Resources, and the National AI Centre |
| Independently certifiable | Yes, by an accredited body | No | No |
| Cost to adopt | $50,000 to $150,000 in Australia, including consulting and audit fees | Free framework, internal effort to apply | Free framework, light implementation |
| Time to implement | Nine to fifteen months cold, six to nine months with ISO 27001 in place | Three to six months for a first full assessment cycle | Eight to twelve weeks for a baseline |
| Produces audit evidence | Yes, certification plus continuous improvement record | Yes, assessment outputs, but self-attested | Limited, alignment statement only |
| Model risk coverage | Controls across the AI lifecycle | Strongest of the three, via Map, Measure and Manage functions | Principles-level only |
| Australian regulatory weight | High with procurement and insurers | Moderate, recognised but not local | Highest, this is the local regulator’s stated expectation |
| Main limitation | Heavy investment, slow to implement | No certification, requires interpretation | Shallow depth, insufficient for complex programmes |
ISO/IEC 42001:2023 is an AI management system standard published in December 2023. It is the first international standard written specifically for managing artificial intelligence inside an organisation.
The useful mental model is ISO 27001, the information security management standard many enterprises already hold. ISO/IEC 42001:2023 borrows the same structure. It defines an AI management system, sets out how an organisation plans, operates, evaluates and improves that system, and supplies controls mapped to AI-specific risks across the lifecycle.
In practice ISO/IEC 42001:2023 requires a documented set of policies, procedures and controls covering how an organisation develops, procures, deploys and uses AI. It demands a defined scope, an AI risk assessment methodology, controls for fairness, transparency, accountability and data quality, and a continuous improvement cycle that produces evidence of ongoing operation.
Microsoft’s Supplier Security and Privacy Assurance (SSPA) program, through Data Protection Requirements version 10, added Section K covering AI. For suppliers delivering AI that Microsoft classifies as sensitive use, ISO/IEC 42001:2023 certification is required with no alternative assessment path offered.
For other AI suppliers in the Microsoft ecosystem, ISO/IEC 42001:2023 can be submitted instead of an independent Section K assessment, which makes it the cheapest route through the program. Microsoft has itself certified Azure AI Foundry, Microsoft 365 Copilot and Security Copilot to the standard.
This matters well beyond direct Microsoft suppliers. Any Australian partner delivering Copilot configuration, custom Azure AI workloads or AI-driven services to enterprise and government clients now works inside an ecosystem where the AI procurement standard is set by Microsoft rather than by Australian law. Cascading procurement requirements are how a voluntary standard becomes a commercial necessity. We traced how far that requirement reaches down the Australian AI supply chain in a separate piece.
Certification is what separates ISO/IEC 42001:2023 from the other two frameworks. An accredited body can audit an organisation and issue formal certification. No equivalent exists for NIST AI RMF or the Guidance for AI Adoption.
That certificate carries weight with enterprise buyers, regulators and insurers that voluntary internal frameworks do not. It is currently the closest thing to a globally recognised marker of AI governance maturity.
The trajectory is familiar. ISO 27001 certification became the default answer to cyber security questions in supplier due diligence over roughly five years. ISO/IEC 42001:2023 is on the same path for AI, and we expect Australian enterprise and government procurement teams to start asking within the next twelve months.
ISO/IEC 42001:2023 suits organisations that:
ISO/IEC 42001:2023 is a project, not a memo. A mid-market certification effort runs nine to fifteen months from a cold start and costs $50,000 to $150,000 in Australia once gap analysis, implementation consulting, audit fees and annual surveillance are counted. It is the wrong first step for a business with no existing management system discipline.
The NIST AI Risk Management Framework is a voluntary framework published by the US National Institute of Standards and Technology in January 2023 and updated since. It is free, and adopted across public and private sectors worldwide.
NIST AI RMF is built on four functions:
NIST AI RMF does not prescribe specific technical controls. It describes outcomes and the questions an organisation should be able to answer. That makes it flexible, but it also means the framework produces an assessment rather than an implementation.
The most common mistake Australian businesses make with NIST AI RMF is reading the framework, agreeing with the principles, and treating that as the work.
The value comes from running the four functions against every meaningful AI system in the organisation and documenting the outputs. That documentation is the evidence insurers, auditors and boards ask for. A framework you agree with produces nothing. A framework you have run produces an artefact.
NIST AI RMF also has the strongest model risk coverage of the three frameworks. The Map, Measure and Manage functions are built around identifying and quantifying risk in specific AI systems, which is precisely what model risk management requires. ISO/IEC 42001:2023 covers model risk through lifecycle controls. The Guidance for AI Adoption addresses it at principle level only.
NIST AI RMF pairs with technical control frameworks rather than replacing them. The NIST Cyber AI Profile, published as NIST IR 8596, and the underlying COSAiS control overlays are designed to sit underneath NIST AI RMF as the technical implementation layer.
The Cyber AI Profile is not an alternative to ISO/IEC 42001:2023 or the Guidance for AI Adoption. It adds AI-specific cyber security controls beneath whichever framework anchors the programme. Organisations adopting any of the three frameworks should track NIST IR 8596 as it moves from draft to final across 2026 and 2027.
NIST AI RMF suits organisations that:
The Guidance for AI Adoption (GfAA) was published in October 2025 by the Department of Industry, Science and Resources together with the National AI Centre. It replaced the Voluntary AI Safety Standard that had been in place since 2024.
The GfAA is the Australian government’s official position on what good AI adoption looks like. It is voluntary and non-binding. It is also the framework an Australian regulator, court or government procurement process will reference first when assessing whether an organisation acted reasonably with AI.
Its content is organised around practical guidance for different AI maturity levels and use cases, covering governance, risk assessment, data quality, transparency, human oversight, contestability and accountability. Anyone who has read NIST AI RMF or ISO/IEC 42001:2023 will recognise the shape, because all three address similar concerns from different angles.
Australia decided in December 2025 not to legislate AI through a standalone Act. The National AI Plan confirmed the country would rely on existing laws, sector regulators and voluntary guidance instead.
That decision moved the burden onto businesses. With no single mandatory framework to comply with, every organisation now sets its own AI governance baseline, and that choice gets inspected later by insurers underwriting cyber and professional indemnity policies, auditors reviewing controls that depend on AI, enterprise procurement teams running supplier due diligence, and regulators applying existing law such as the Privacy Act to AI-driven decisions.
The Guidance for AI Adoption is what those parties will measure you against, because it is the local government’s stated expectation. That is why it outranks the other two on Australian regulatory weight despite being the shallowest of the three.
The Guidance for AI Adoption replaced the Voluntary AI Safety Standard (VAISS) in October 2025. It also supersedes the September 2024 proposals paper on mandatory AI guardrails for high-risk settings, which the government effectively walked away from in late 2025.
Organisations that built AI governance on the VAISS should review their alignment against the GfAA, though the migration is generally light. Whether mandatory guardrails return depends largely on whether the Australian AI Safety Institute, launched in early 2026, identifies gaps that voluntary guidance cannot close.
The Guidance for AI Adoption is guidance, not a standard. It provides no certification path, prescribes no specific controls, and is not detailed enough to anchor a complete AI risk management programme in a complex enterprise.
For most Australian mid-market businesses the GfAA is a starting point rather than a destination. Organisations typically stay on it for twelve to eighteen months before stepping up to ISO/IEC 42001:2023 or the NIST stack.
Both NIST AI RMF and the Guidance for AI Adoption are free to download and use. Neither charges a licence or certification fee. Only ISO/IEC 42001:2023 carries direct cost, because certification requires an accredited external audit.
The real cost in all three cases is internal effort, not the framework. A GfAA baseline typically takes eight to twelve weeks of focused work. A first full NIST AI RMF assessment cycle runs three to six months depending on how many AI systems are in scope. ISO/IEC 42001:2023 runs nine to fifteen months from a cold start.
If cost is the binding constraint, the Guidance for AI Adoption gives the most defensible position per dollar for an Australian business, because it is free, fast, and the framework local regulators reference first. If audit evidence is the requirement and budget allows, ISO/IEC 42001:2023 is the only option that produces independently verified proof.
Five patterns cover most of the Australian mid-market.
An Australian SMB starting to govern AI should begin with the Guidance for AI Adoption. It is the lowest-friction way to establish a baseline aligned to Australian regulator expectations. Pair it with a shadow AI discovery exercise so the baseline reflects what staff are actually using rather than what leadership assumes.
An Australian business selling to enterprise or government buyers should take ISO/IEC 42001:2023 seriously now, before procurement teams begin asking. Certification takes nine to fifteen months, which means starting when the question arrives is starting too late.
An Australian business with a sophisticated AI programme and no procurement pressure should use NIST AI RMF with the Cyber AI Profile underneath. This gives maximum depth without certification cost, and suits professional services firms and internal product teams where AI is embedded in operations but not sold as a product.
An Australian business with clients in the United States or Europe needs either ISO/IEC 42001:2023 or NIST AI RMF depending on which market matters more. US and global enterprises increasingly reference NIST. European buyers increasingly reference ISO and the EU AI Act. The Guidance for AI Adoption alone will not satisfy either.
An Australian business already certified to ISO 27001 has a structural advantage, because the management system discipline exists already. ISO 27001 and ISO/IEC 42001:2023 share the same Annex SL structure, and an ISO 27001 certified organisation typically already meets around 60 to 70 percent of the foundational controls. The remaining gap is the AI-specific work: bias monitoring, model lifecycle governance, AI impact assessments and supplier-of-AI controls. That makes ISO/IEC 42001:2023 the default upgrade path for any ISO 27001 organisation running a meaningful AI programme.
Framing this as a choice between three frameworks is slightly misleading. Mature AI governance programmes run all three, with one anchoring the system and the others supplying references.
The pattern that works looks like this. ISO/IEC 42001:2023 sits at the top as the certifiable management system. NIST AI RMF supplies the operational risk discipline feeding into it. The NIST Cyber AI Profile provides technical security controls underneath NIST AI RMF. The Guidance for AI Adoption runs alongside, keeping the programme defensible against Australian regulator expectations.
Most Australian businesses are not at that maturity, and forcing the full stack in year one is the wrong move. The first question is which framework anchors the programme. The second is which frameworks you reference for specific gaps. The answer that fails is treating any of the three as a tick-box exercise.
Australia is more likely to mandate AI governance outcomes than any specific framework.
Two pieces of legislation already point that way. Federal Privacy Act amendments taking effect in December 2026 require disclosure of substantially automated decisions. The Western Australian Privacy and Responsible Information Sharing Act, commencing 1 July 2026, brings automated decision-making under Information Privacy Principle 10.
Neither statute prescribes a framework. Both require organisations to demonstrate they have governed AI responsibly. ISO/IEC 42001:2023, NIST AI RMF and the Guidance for AI Adoption are the three recognised ways to demonstrate exactly that, which is why the choice matters even without a mandate.
For most Perth and Western Australian mid-market businesses, the practical entry point is the Guidance for AI Adoption, paired with a shadow AI discovery exercise and a defined risk tier methodology. We cover the discovery step in our AI assessment service. That produces a baseline in eight to twelve weeks that aligns with Australian regulator expectations and gives board, insurer and audit conversations something concrete to reference.
The discovery step matters more than most businesses expect. Across our first shadow AI audits at Australian mid-market businesses, the typical finding is twelve to fifteen AI tools in active use with the IT team aware of about three of them. A governance framework written against the three you know about does not govern the other nine or twelve. That is the reason we audit before writing policy, whichever framework anchors the programme.
Whichever framework leads, something has to keep operating it after the baseline is set. Policy review cycles, control drift, new tools arriving every quarter. For most of our clients that ongoing work runs inside a managed AI platform with the governance controls included as standard, rather than as an annual consulting revisit.
For businesses already holding ISO 27001, the upgrade path is ISO/IEC 42001:2023, started before procurement teams raise the question.
For businesses running a sophisticated internal AI programme, the NIST stack of AI RMF plus the Cyber AI Profile plus COSAiS provides depth without certification cost.
What we do not recommend is delay. Australia’s decision not to legislate AI directly did not remove regulatory pressure, it redirected it to procurement, insurance, audit and existing law. All four channels will ask the same question over the next twelve months, and “we use AI responsibly” will not survive any of those conversations.
No. Mature AI governance programmes use all three, with one as the primary anchor and the others as supporting references. The decision is which AI governance framework leads, not which single one you adopt. For most Australian businesses the question is which framework gives the best return on the initial investment given the business context.
No. There is no Australian legal requirement to hold ISO/IEC 42001:2023 certification, and adoption is voluntary. However, enterprise procurement teams, government buyers and large clients are beginning to ask about AI governance maturity, and certification is the most defensible answer currently available. Mandatory in practice differs from mandatory in law.
For an Australian mid-market business with an existing ISO 27001 programme, ISO/IEC 42001:2023 implementation typically runs six to nine months. Starting cold without an existing management system, plan for nine to fifteen months. The audit itself takes two to four weeks. The continuous improvement cycle then runs indefinitely.
Australia’s Guidance for AI Adoption is the cheapest defensible option. It is free to download, requires no certification fee, and a baseline can be established in eight to twelve weeks. NIST AI RMF is also free but demands more internal interpretation. ISO/IEC 42001:2023 is the only one of the three with direct cost, because certification requires an accredited external audit and typically runs $50,000 to $150,000 in Australia.
NIST AI RMF has the strongest model risk coverage of the three, because its Map, Measure and Manage functions are built around identifying and quantifying risk in specific AI systems. ISO/IEC 42001:2023 addresses model risk through lifecycle controls, which is thorough but less focused. Australia’s Guidance for AI Adoption covers it at principle level only. Read our AI governance service for how we assess model risk in practice.
The Guidance for AI Adoption was published in October 2025 and replaced the Voluntary AI Safety Standard that had been in place since 2024. The GfAA is broader in scope and reflects updated government thinking after the December 2025 decision not to legislate AI through a standalone Act. Organisations that built AI governance on the VAISS should review their alignment, but the migration is generally light.
The NIST Cyber AI Profile, published as NIST IR 8596, is the technical cyber security layer sitting underneath NIST AI RMF. It is not an alternative to ISO/IEC 42001:2023 or the Guidance for AI Adoption, it complements them by adding AI-specific cyber security controls. Organisations adopting any of the three frameworks should track NIST IR 8596 as it moves from draft to final across 2026 and 2027.
