Boards, clients and procurement teams are asking organisations to show how AI is governed — and from 10 December 2026, the Privacy Act requires certain organisations to disclose their automated decision-making. We start by assessing how AI is actually used and governed in your organisation, against ISO/IEC 42001 and the other requirements that apply. If you then want it, we implement the Artificial Intelligence Management System (AIMS) that turns that question into evidence you hold — as a separate engagement.
An AI Management System is the solution, not the reason. Organisations come to us with a business objective — and the AIMS is what delivers it.
Show clients, boards and the public that AI use is deliberate and accountable — with evidence, not assurances.
Answer AI due-diligence questions in tenders and vendor reviews without scrambling to assemble something credible.
Build the management system properly the first time, so a certification audit has a working system to examine rather than a set of documents. See ISO 42001 certification — process, timeline and cost.
Identify where AI could produce biased, inaccurate or harmful outcomes — before those outcomes reach a client.
Keep pace with obligations you have already signed up to, and with expectations that are moving quickly.
Replace tool-by-tool improvisation with one set of rules that applies wherever AI is used.
ISO/IEC 42001:2023 AIMS gap assessments — baseline review of your current AI governance position
AI governance policy and procedure development — AI use policy, risk register, data handling rules
Full AIMS implementation — end-to-end project from gap analysis to readiness review
Ongoing AIMS management — quarterly reviews, policy updates and continuous improvement
BSI-certified ISO/IEC 42001 Lead Implementer — trained to build and run an AIMS, not only to audit one
Relevant for healthcare, legal, finance, government contractors and any business using AI on client data
Plain-language documentation — no jargon, no unnecessary complexity
Serving businesses across Australia — remote and on-site delivery available nationwide
Our two services address two distinct situations. Read the profile that matches your organisation.
Your team is using ChatGPT, Copilot, or AI features in your CRM, email or accounting tools. There are no formal controls, no policy, and no one has checked what data is being shared or what happens when the AI gets something wrong. You need clarity — fast.
You are asking:
"Is my team using AI safely?" · "Are we exposing client data?" · "What happens if it gets something wrong?"You are an operations manager, IT manager or enterprise leader deploying AI across teams, working with AI vendors, or operating in a regulated environment. You need to know who owns AI decisions, what is permitted, and how to demonstrate responsible AI use to clients, regulators and procurement partners — including government.
You are asking:
"Who owns AI in our organisation?" · "What are we allowed to do?" · "How do we demonstrate safe usage to clients and government?"ISO/IEC 42001:2023 is the first international standard specifically designed for Artificial Intelligence Management Systems. Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it provides organisations with a structured framework for governing how AI is developed, deployed and used responsibly across their operations. The standard is the AI equivalent of ISO 27001 for information security — it establishes the policies, procedures and controls that demonstrate your AI use is intentional, documented and accountable.
The framework is built around the concept of an Artificial Intelligence Management System, or AIMS. An AIMS is not a piece of software — it is a documented management system that defines how your organisation identifies AI-related risks, sets objectives for responsible AI use, implements controls to manage those risks and continuously reviews and improves its approach. The AIMS sits alongside your existing management systems and can be integrated with ISO 27001, ISO 9001 or other frameworks your organisation already operates.
For Australian organisations, the relevance of ISO/IEC 42001 is growing quickly. AI, automated and increasingly autonomous (agentic) systems are now embedded in everyday business operations — from automated email responses and AI-assisted customer service to AI-driven analytics, hiring tools and clinical decision support. Each of these applications carries governance obligations: obligations to your clients, to employees whose data is processed, to regulators and, increasingly, to procurement teams at larger organisations and government agencies who are beginning to require evidence of responsible AI governance from their suppliers.
ISO/IEC 42001 follows the same high-level structure (Annex SL) used by ISO 27001 and ISO 9001, which means organisations familiar with those standards will recognise the approach. The standard requires your organisation to establish context — understanding the internal and external factors that affect your AI use, identifying interested parties and their expectations, and defining the scope of your AIMS. It then requires you to assess AI-related risks, set objectives and implement controls to address those risks.
The core documentation required by an AIMS includes an AI use policy, an AI risk register, documented processes for evaluating and approving AI systems before deployment, records of AI system performance and incidents, and a programme of regular review and improvement. For most Australian small and medium businesses, this documentation does not need to be complex — it needs to be accurate, proportionate to your actual AI use and consistently maintained. Bcom develops this documentation in plain language, tailored to your specific operations, so it is genuinely useful rather than a compliance exercise that sits in a folder and is never read.
Two distinct services depending on where your organisation is on the AI governance journey.
For businesses already using AI — ChatGPT, Copilot, CRM AI, automated workflows — without formal controls or oversight. Fast, practical, low-friction — results in days, not months.
We map how AI is actually being used across your real operational workflows — not a theoretical risk model. Every tool, every process, every team member interaction with AI is documented and assessed against practical governance criteria.
We identify where AI is being misused, where sensitive data may be exposed, and where incorrect AI outputs could create liability. This includes reviewing how staff interact with AI tools, what data is being fed into them, and what happens when outputs are wrong.
The outcome is a clear Assessment Report: what the evidence supports, where the gaps are against ISO/IEC 42001 and the other requirements that apply, and what evidence is still needed — each finding traceable to its evidence and its source. Closing the gaps is a separate engagement if you want it (Service 2).
For organisations that need a structured, documented AI governance system — including enterprise environments, government contractors and organisations working with AI vendors. ISO/IEC 42001 aligned — scalable from SME to enterprise.
We establish your Artificial Intelligence Management System structure: defining AI usage boundaries, drafting your AI use policy, AI risk register, system evaluation procedures and data handling rules. Aligned to ISO/IEC 42001 and tailored to your actual operations — not generic templates.
Translating risk findings into structured controls, ownership and operational practices. We implement governance processes that define who owns AI decisions, what is permitted, how AI systems are approved before deployment, and how incidents are managed. Includes staff briefing and vendor coordination where required.
Retainer-based service: quarterly AIMS reviews, policy updates as your AI use evolves, incident response support, continuous improvement planning and annual readiness assessments. Equivalent to a virtual AI governance officer — ensuring your AIMS stays current as AI systems, including agentic and autonomous ones, and regulations change.
We hold the BSI ISO/IEC 42001 Lead Implementer qualification, issued by the British Standards Institution — the UK national standards body and an accredited certification body for the standard. It is the implementer-level qualification: training in how to build and run an AIMS, not only how to audit one.
We work with businesses across Australia and understand the specific industries, client relationships and regulatory context that Australian organisations operate in. Our AIMS implementations are practical, proportionate and relevant to your sector.
We write AIMS documentation that your team can actually read and follow. No legal jargon, no generic templates copied from other industries. Every policy and procedure is written for your specific business and the AI and automated systems you actually use.
Because we also provide IT support, cybersecurity and AI implementation services, we understand your full technology environment. Your AIMS is built to integrate with your existing systems, not bolt on as a separate compliance exercise.
ISO/IEC 42001 is designed to be scalable. We implement it in a way that is proportionate to your actual AI use and business size — not an enterprise-grade compliance programme for a ten-person business.
Obligations are already arriving with dates attached: the Privacy Act's automated decision-making transparency requirement commences 10 December 2026, and Commonwealth agencies are working to their own AI policy timetable. Organisations that build the management system now answer those requirements from records they already keep, instead of assembling something under deadline.
Bcom provides ISO/IEC 42001 AI governance and AIMS implementation services to businesses throughout Australia. Whether you operate a medical practice in Melbourne, a legal firm in Sydney, a financial services business in Brisbane or a technology company in Perth, we can deliver an AIMS implementation that is appropriate for your industry, your client base and your specific AI use.
We also work with enterprise organisations, government contractors and businesses operating within regulated sectors or supplying to federal and state government agencies. These environments typically involve AI deployment across multiple teams, coordination with AI vendors and suppliers, and a higher level of regulatory and procurement scrutiny. Service 2 — AI Governance & Risk Implementation — is specifically designed for this context, providing the structured AIMS framework, vendor governance and accountability documentation that enterprise and government procurement partners require.
All AIMS work — including gap assessments, policy development and documentation review — can be delivered fully remotely or in a combination of on-site workshops and remote sessions. For businesses that prefer in-person engagement, we are available for on-site visits across Australia.
Effective 15 December 2025, the Australian Government's Policy for the Responsible Use of AI in Government (v2.0) set clear expectations for how agencies govern AI. We help agencies operationalise it — and help suppliers evidence their own AI governance when a Commonwealth buyer asks.
The updated policy on the responsible use of AI in government requires agencies to take a structured, accountable approach to AI. Agencies must designate accountable officials for AI, maintain an internal register of AI use cases, apply risk-based governance to each use case, and report high-risk uses to the Digital Transformation Agency (DTA). For in-scope use cases an AI impact assessment must be finalised before the solution is deployed. The policy binds non-corporate Commonwealth entities; corporate Commonwealth entities are encouraged, not required, to apply it.
Bcom helps public sector organisations operationalise these requirements. An AIMS gives you the documented structure the policy expects: clear ownership and accountable officials, an AI use case register and risk assessment process, controls for evaluating and approving AI before deployment, and a cycle of review and improvement. Rather than treating the policy as a compliance burden, we implement it as a practical governance system your teams can actually run.
The policy binds agencies, not their suppliers — but if you sell AI-enabled products or services into the Commonwealth, your buyer's obligations become your commercial reality. Supplier obligations arrive through the contract, not the policy. The DTA's model AI contract clauses are optional, but where a buyer adopts them, one option requires the seller to maintain an AI management system in accordance with ISO/IEC 42001:2023 and to evidence it on request within a short, specified window. That is the practical case for ISO/IEC 42001 for government suppliers: not a compliance tick, but a credible answer ready before the question arrives.
Sources for this section, so you can check them yourself: Policy for the responsible use of AI in government (DTA) · AI model clauses (BuyICT) · full source list.
Support for accountable officials — defining AI ownership, roles and decision rights across the agency
AI use case registers and risk assessment aligned to the AI assurance framework and Australia's AI Ethics Principles
ISO/IEC 42001 AIMS implementation to operationalise the responsible use of AI in government
Supplier assurance — helping government contractors demonstrate responsible AI governance in procurement
Practical explainers written for the questions organisations actually ask us — no jargon, no sales pitch.
Where your register, decisions, risks, obligations and evidence actually live — run by us, decided by you.
The standards, Australian law, regulator guidance and organisation policies a BcomOne Assessment can test against — and how applicability to you is decided.
What ASD, the AI Safety Institute and other Australian authorities have published on AI agents — and how ISO/IEC 42001 applies when AI acts, not just answers.
Commences 10 December 2026. The four-limb statutory test, the three disclosures required — and why it is not an "AI" rule.
Who is actually bound, the three dates that apply, what the assessment contains — and what it means if you supply government.
They are not alternatives. What each standard covers, where they overlap, and which one your situation calls for first.
The process from scope to Stage 2 audit, what actually drives cost and timeline, and whether you need the certificate at all.
The substance a credible policy has to cover — and the five mistakes that make one worthless.
BcomOne investigates how AI and automated systems are actually being used, analyses evidence against ISO/IEC 42001 and other applicable sources of authority, and identifies the gaps that need to be addressed. If you then want help implementing or remediating, that is a separate engagement — delivered by a BSI-certified ISO/IEC 42001 Lead Implementer, remotely or on site across Australia.
Tell us the situation and we will reply with a straight answer — not a brochure.