The BcomOne Source of Authority Library is the controlled collection of standards, legislation, regulatory requirements, recognised frameworks, guidance and organisation-specific requirements that BcomOne can draw on to work out which requirements may apply to an organisation, and to analyse the evidence from its investigation. It is not a universal checklist. Only the sources that apply to your organisation shape your assessment and its findings.
A finding that says "AI security is inadequate" cannot be checked, challenged or acted on. BcomOne is designed so that every material finding names the requirement it was tested against, where that requirement comes from, the version in force on the assessment date, and the evidence examined. The library is where those sources are held, versioned and controlled.
The library's structure, categories and applicability method are defined and controlled. They are being built into BcomOne, informed by Bcom's first assessments. This page describes that design. It does not claim that every part is automated today.
A standard, law, framework or guidance document is in the library because it may apply to some organisations. It is used in your assessment only if your organisation's context makes it applicable, and the reasons for that are recorded.
The library sits at the top of a chain that ends with a decision made by your people, not by software.
| Element | What it is | What it is not |
|---|---|---|
| Sources of authority | The standards, laws, regulator publications, frameworks, contracts and policies that may set requirements for an organisation | A list that applies to everyone |
| BCOM AGF | Bcom's own methodology: the control objectives and evidence expectations an assessment is analysed against, and the method for any separate implementation engagement | A standard, a law or a certification scheme |
| BcomOne | The platform Bcom uses to investigate, hold evidence and record decisions | A certifier, or a decision-maker for your organisation |
| Bcom Services Pty Ltd | The service provider. Bcom conducts the assessment with BcomOne and oversees each investigation. Implementation or remediation, if you want it, is a separate engagement | The owner of your governance decisions |
| Your organisation | The decision-maker. Your authorised people decide what is accepted, treated or changed | A passive recipient of a verdict |
The AGF framework page explains the methodology itself. This page covers the sources it works from.
Each source answers two questions before it is included: when would it apply to an organisation, and what evidence would it actually test? A source that cannot answer both is not added, however well known it is.
| Source | What it is | When it applies | What evidence it tests |
|---|---|---|---|
| ISO/IEC 42001:2023 | Requirements for an AI management system (AIMS) | In every BcomOne Assessment. It is a core assessment authority whose requirements are never weakened or negotiated: what varies is applicability, organisational scope, the evidence and the result | The management system in practice: policy, roles, AI inventory, risk and impact assessment, objectives, monitoring, internal review and improvement records |
| ISO/IEC 23894:2023 | Guidance on AI risk management | When AI risk management is in scope | The organisation's AI risk process: criteria, identification, assessment, treatment and review. Reported as guidance, not as a certifiable requirement |
| ISO/IEC 38507:2022 | Guidance on the governance implications of an organisation's use of AI, for its governing body | When the governing body's oversight of AI is in scope | How the board or executive oversees AI: accountability, delegations, reporting. Reported as guidance |
| BCOM AGF | Bcom's own implementation and governance methodology | In every engagement, as the method | Not tested as an external requirement. Findings cite the external source; the AGF control is shown as Bcom's interpretation |
| Source | What it is | When it applies | What evidence it tests |
|---|---|---|---|
| Privacy Act 1988 (Cth) and the Australian Privacy Principles | Commonwealth privacy law | When the organisation is an APP entity | How personal information is collected, used, disclosed, secured and sent overseas where AI and automated systems are involved, and what the privacy policy and notices say about it |
| APP 1.7–1.9 — automated decisions | Privacy-policy transparency about decisions made or substantially assisted by computer programs, commencing 10 December 2026 | When an APP entity has arranged for a computer program to make a decision, or to do something substantially and directly related to making it, using personal information, and the decision could reasonably be expected to significantly affect an individual's rights or interests | Which systems meet that test, and whether the privacy policy describes the kinds of personal information used and the kinds of decisions. Before 10 December 2026 this is reported as an upcoming requirement, not a current gap |
| OAIC guidance | The privacy regulator's published guidance, including its APP 1.7–1.9 transparency resources and the updated APP Guidelines chapter on APP 1 (both 30 September 2026) | Where it addresses the processing in question | How practice compares with the regulator's guidance, reported as guidance |
Automated decision-making is not limited to AI. The Act refers to a computer program, so a rules engine, a scoring spreadsheet or a workflow automation can meet the test. Our guide to the Privacy Act ADM obligation sets out the test in full.
| Source | What it is | When it applies | What evidence it tests |
|---|---|---|---|
| ISO/IEC 27001:2022 | Requirements for an information security management system (ISMS) | When the organisation operates or claims an ISMS, is certified, or must meet it by contract or policy, and an AI system depends on the controls in question | Evidence for the controls an AI system relies on, such as access to the data it processes. This is evidence against a security baseline, not an ISMS audit or a certification opinion |
| ISO/IEC 27002:2022 | Guidance on information security controls | As a control reference, where ISO/IEC 27001 or the organisation's security policy applies | Used to describe a control precisely, not as a separate certification requirement |
| ISO/IEC 27005:2022 | Guidance on information security risk management | Where the organisation's security risk process forms part of an AI risk finding | How security risks arising from AI use are identified and treated |
| Essential Eight and the Essential Eight Maturity Model | A cybersecurity baseline of mitigation strategies, with maturity levels, published by the Australian Signals Directorate (current maturity model: November 2023) | When the organisation uses it, is required to (for example by government policy or contract), or its security requirements make it applicable | The mitigation strategies an AI system depends on, such as restricting administrative privileges or multi-factor authentication. A cybersecurity baseline, not an AI governance standard |
| Other ASD guidance | Other Australian Signals Directorate publications on cyber.gov.au | Only where a specific publication addresses a control an AI system depends on | Evidence for that control, as the publication describes it |
The ISO/IEC 27000 series is a family of standards, not a single assessable standard, so each standard is listed separately with its own purpose. A security finding always starts from the AI requirement it arises under. For example: an AI system processes sensitive client information and privileged access is weak. The finding cites the AI management requirement and each applicable access-control requirement, whether from the organisation's ISO/IEC 27001 control environment, the Essential Eight, its own security policy or legislation. It does not say "AI security inadequate". Read more on how ISO/IEC 42001 and ISO/IEC 27001 relate.
| Source | What it is | When it applies | What evidence it tests |
|---|---|---|---|
| Guidance for AI Adoption | Australian Government guidance (not a legal requirement) from the National AI Centre (Department of Industry, Science and Resources), published 21 October 2025 in two parts (foundations, and implementation guidance) setting out six essential practices. The Government describes it as evolving the Voluntary AI Safety Standard and Australia's AI Ethics Principles | Where the organisation has adopted it or chooses to align; reported as guidance, never as a requirement | How practice compares with the six practices: accountability, understanding impacts, managing risks, sharing essential information, testing and monitoring, and maintaining human control |
| Australia's AI Ethics Principles | Eight voluntary principles published by the Department of Industry, Science and Resources in 2019. The Government says its Guidance for AI Adoption evolves them; the library keeps them as a separate, versioned source | Reported as voluntary principles where the organisation has adopted them or chooses to align | How practice compares with the principles the organisation has adopted |
| National framework for the assurance of artificial intelligence in government | A framework agreed by Australian, state and territory governments in June 2024 for assuring their own use of AI. It lists standards such as AS ISO/IEC 42001 as examples governments should align to where practical | When the organisation is an Australian government entity, or a supplier whose contract requires alignment | Government AI assurance practice |
| Policy for the responsible use of AI in government | Australian Government policy from the Digital Transformation Agency (version 2.0, effective 15 December 2025) | When the organisation is an entity the policy binds (non-corporate Commonwealth entities, except the defence portfolio and the national intelligence community; corporate Commonwealth entities are encouraged to apply it), or a supplier bound to it by contract | Accountability, transparency statements, use case registers and AI impact assessments |
These are not automatically obligations on private Australian organisations. They apply only where the organisation's status or its contracts make them apply. See AI impact assessments in Australian Government.
| Sector | Examples | When it applies | What evidence it tests |
|---|---|---|---|
| Financial services | Applicable ASIC obligations and guidance, including ASIC Report 798 on AI governance arrangements | When the organisation holds an Australian financial services or credit licence | AI accountability, risk management, policies, oversight and third-party management |
| Government | Commonwealth, state and territory requirements | By jurisdiction and entity type | The requirements of the instrument that applies |
| Health | Applicable health-records, privacy and regulatory requirements | When the organisation handles health information or provides regulated health services | How AI and automated systems handle health information, against the applicable requirements |
| Employment and workplace | Applicable employment, anti-discrimination and workplace-surveillance requirements | When AI use affects employees, recruitment or workplace decisions | How those decisions are made and overseen, and what employees are told |
This category is built to grow. A new sector is added as new entries, each with its own rule for when it applies; the architecture stays the same. A café's assessment is never measured against ASIC's expectations of AFS licensees. An AFS licensee's assessment is.
The organisation's own AI, privacy, information-security, risk and procurement policies; supplier requirements; internal procedures; contractual and customer requirements; and other governance rules it has approved. These matter because the most direct question an assessment can ask is whether actual operation matches the organisation's own stated rules. Requirements drawn from these documents keep their exact location in the source document. They are held for that organisation only.
Rules decide. Recorded rules are applied to recorded facts about your organisation, never decided ad hoc or by an AI model. You confirm the facts; you cannot switch off a requirement that applies by declining it.
This section describes the method as designed. It is being built into BcomOne, informed by Bcom's first assessments (status, October 2026).
| Outcome | Meaning |
|---|---|
| Supported by evidence | The evidence examined supports the requirement being met. It is not a certificate of compliance |
| Gap | The evidence shows the requirement is not met, or met only in part |
| Insufficient evidence | There is not enough evidence to tell. The finding states what evidence is needed |
| Not applicable | The source or requirement does not apply to this organisation, and the reason is recorded |
| Upcoming requirement | The requirement starts after the assessment date, and is reported with its start date rather than as a current gap |
The specific requirement or control, its source of authority, what kind of source it is (law, regulator guidance, standard, framework, contract or your own policy), and the version that applied.
The records examined, each traceable to where it came from and when.
How the evidence compares with the requirement, produced by fixed rules rather than by an AI model.
What is missing, inconsistent or adequately evidenced.
What would settle a question that cannot yet be determined.
For example, an HR manager confirms that a recruitment system ranks applicants automatically before HR reviews the ranking. That use is analysed only against the sources that apply to this organisation and use case. Depending on the facts, these may include its own AI policy, the Privacy Act and the automated-decision requirements, applicable employment and anti-discrimination law, and ISO/IEC 42001 where AI management alignment is being assessed.
No finding is declared "compliant" or "non-compliant". Bcom's overseer can challenge a finding, add evidence or context, or require re-analysis. The overseer cannot rewrite a finding to change its conclusion; the re-analysed finding stays traceable to its evidence and its source.
Legislation, standards and regulator guidance change. Each library entry is a controlled record, so a finding made in October 2026 can still be traced, years later, to the requirement as it stood then.
| Each authority record holds | Why |
|---|---|
| Authority ID, name, type, issuer | What the source is, and what kind of source (law, guidance, standard and so on) |
| Jurisdiction and sector | Where and to whom it can apply |
| Version, publication date, effective date, end or superseded date, status | Which version applied on the assessment date, and whether a requirement is current or upcoming |
| Primary source | The official publication it was taken from |
| Applicability conditions | The recorded rule for when it applies |
| Requirement and control references | The section, principle or clause a finding cites |
| AGF mapping and assessment logic | How Bcom's methodology turns it into something testable |
| Last verified, and against what | When a named person last checked it against the primary source |
Entries are built from primary sources and checked by a named person before use. For ISO/IEC standards the library holds the identifier, clause references and Bcom's own interpretation, never the standard's text, which is copyright ISO/IEC and available from ISO or Standards Australia.
No. A source is used only when your organisation's context makes it applicable. The reason a source applies, or does not, is recorded in your assessment.
No. An assessment reports evidence-backed findings against the requirements that apply. Certification against a standard such as ISO/IEC 42001 is issued by a certification body, not by BcomOne or Bcom. Whether you meet a legal obligation is a matter for your organisation and its advisers.
No. A BcomOne Assessment investigates how AI is actually used, analyses the evidence against ISO/IEC 42001 and the other sources that apply, and reports the gaps. If you then want help implementing or remediating, that is a separate Bcom Services engagement.
No. The Privacy Act refers to a computer program. Rules engines, scoring tools and workflow automation can meet the test as well as AI systems.
Not automatically. The Australian Government's AI policy binds the government entities it names, and the national assurance framework is addressed to governments. A supplier may take on obligations through a contract. That is recorded as a contractual requirement for that organisation.
No. It holds identifiers, clause references and Bcom's own interpretation. The standards themselves are copyright ISO/IEC.
Primary sources only: the publishers of the legislation, policy, guidance and standards named above.
| Source | Primary publisher |
|---|---|
| ISO/IEC 42001:2023, 23894:2023, 38507:2022, 27001:2022, 27002:2022, 27005:2022: titles, editions and status | ISO/IEC 42001 · ISO/IEC 23894 · ISO/IEC 38507 · ISO/IEC 27001 · ISO/IEC 27002 · ISO/IEC 27005 — International Organization for Standardization. Referenced by identifier and clause only; the text is copyright ISO/IEC |
| Privacy Act 1988 (Cth) | Privacy Act 1988 — Federal Register of Legislation |
| The Australian Privacy Principles | Australian Privacy Principles — Office of the Australian Information Commissioner |
| APP 1.7–1.9: the test, what the privacy policy must set out, and commencement on 10 December 2026 | Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Part 15 — Federal Register of Legislation |
| "Computer program" includes rules-based processes as well as AI; OAIC transparency resources | APP Guidelines, Chapter 1 (version 2.0, 30 September 2026) — OAIC · New resources on transparency for use of AI and automated decision-making — OAIC |
| OAIC guidance on AI products and generative AI | Guidance on privacy and the use of commercially available AI products · Guidance on privacy and developing and training generative AI models — OAIC |
| Essential Eight and its maturity model (November 2023) | Essential Eight maturity model — Australian Signals Directorate, cyber.gov.au |
| Guidance for AI Adoption (21 October 2025): issuer, two parts, six essential practices, and that it evolves the Voluntary AI Safety Standard and the AI Ethics Principles | Essential AI practices · Guidance for AI adoption: foundations · Guidance for AI adoption: implementation guidance — National AI Centre, ai.gov.au |
| Australia's AI Ethics Principles (2019), voluntary; and the publication date (21 October 2025) of the Guidance for AI Adoption and the Government's statement that it evolves the Voluntary AI Safety Standard and these principles | Australia's AI Ethics Principles — Department of Industry, Science and Resources |
| National framework for the assurance of AI in government: who it is for, and the standards it points to | National framework for the assurance of artificial intelligence in government — Department of Finance (Data and Digital Ministers Meeting) · Cornerstones of assurance (standards, "where practical") |
| Policy for the responsible use of AI in government: version, effective date, entities bound, exclusions | Policy for the responsible use of AI in government — Digital Transformation Agency · Implementation (who must apply it) |
| ASIC Report 798 and who it reviewed (AFS and credit licensees) | REP 798 Beware the gap: Governance arrangements in the face of AI innovation (29 October 2024) — ASIC |
Nothing on this page is legal advice. Whether a particular law or obligation applies to your organisation is a matter for your organisation and its advisers. An assessment records the facts and reasons on which applicability was decided, so they can be checked.
Every BcomOne Assessment starts there: your organisation's context, confirmed by you, and the sources that apply to it, with the reasons written down. The findings that follow are evidence-backed and measured against what actually applies.