ISO 42001 and AI Governance for NZ Businesses
ISO/IEC 42001 is the international standard for an AI management system: the policies, risk assessments and controls that decide how your business uses AI. OxygenIT is ISO 42001 certified, so we build your AI governance from a system we run ourselves and are audited on, not from a template.
OxygenIT is ISO 42001 and ISO 27001 certified, as at 12 May 2026. We are based at 7 Horner Street, Papanui, Christchurch 8053, and work with NZ businesses of roughly 20 to 200 staff.
Updated November 2026. Reviewed by Tim Clarkson
Not ready yet? Check whether you are ready first
What the governance service covers
An ISO 42001 AI governance service builds the management system that controls how your business uses artificial intelligence. ISO/IEC 42001 is the international standard for that system. It asks you to decide who is accountable for AI, record which AI tools are in use and what data they touch, assess the risk of each one, set controls, and review them on a schedule. As at 12 May 2026, OxygenIT is ISO 42001 and ISO 27001 certified, so the system we build is the same kind we are audited on. Read more about the OxygenIT team. We will tell you plainly if alignment is enough and certification is not worth the cost for you. For a New Zealand business of roughly 20 to 200 staff, the practical starting point is usually three documents: an AI policy, an AI register and a risk assessment. From there you either run the system aligned to the standard or prepare for a certification audit by an accredited body.
An AI management system is the set of policies, roles, risk assessments and controls a business uses to decide which AI tools it allows, how they are used and when they are reviewed. Our guide explains what AI governance means in more detail.
Who it is for
NZ businesses of roughly 20 to 200 staff that use AI tools, or plan to, and want clear rules and owners for them. If you are unsure it applies to you, read whether a small business needs ISO 42001.
What is included
- AI use register
- Governance gap summary
- Responsibility map
- Implementation roadmap
What you need first
An executive owner for AI governance: one senior person who can make decisions about AI and sign off the policies.
How it starts
It starts with a 15-minute call about how your business uses AI today. If governance is the right next step, we then scope the work with you.
Step 1 of 3
Establish AI ownership and current use
Governance starts with a list of every AI tool used for work, from AI features inside the software you already pay for to apps staff signed up for themselves. For each one we record what it does and what business data it touches, then assign a named owner. Uses that nobody approved go on the register too, because leaving them out gives you false comfort. Finding that unapproved use is the job of shadow AI discovery and control, and what it finds feeds straight into the register. This step also sets the scope of the AI management system: which parts of the business and which tools it covers.
Who is accountable for AI in your business?
One senior person should be accountable for AI across the business, and each AI tool should have a named owner. ISO/IEC 42001 expects top management to lead the AI management system, so accountability cannot sit with IT alone. Tool owners decide how their tool is used, what data goes into it and when it is reviewed.
What this step produces
- Scope of the AI management system
- AI use register
- Responsibility map
Step 2 of 3
Review governance gaps and priorities
With the register in place, we compare how you govern AI today against what ISO/IEC 42001 asks for: a policy, clear roles, risk assessment, controls and regular review. We assess each AI use for risk, based on what it does and the data it touches. The result is a gap summary showing where you already meet the standard, where you fall short and which gaps carry the most risk. We then agree priorities with you, so the highest risks come first, not every gap at once. If alignment is the goal, the priorities reflect that. If certification is the goal, they reflect what an accredited certification body will look for at audit.
What this step produces
- AI risk assessment
- Governance gap summary
Step 3 of 3
Develop policies, controls and evidence
This step turns the priorities into the policies, controls and evidence that run your AI management system. It usually starts with writing an AI policy: which tools are approved, what data may go into them and who signs off new ones. Policies and controls are agreed with you, then checked in an internal review before you rely on them. Every next action is documented with an owner, so the system keeps running after the project ends. Preparing for certification by an accredited certification body is optional, and only worth it if your customers or contracts ask for it.
Implementation roadmap
- Agree policies and controls
- Run an internal review
- Document next actions
- Optional preparation for certification by an accredited certification body
Deliverables, exclusions and certification boundaries
Here is what you receive, what is not included and what we need from you, so you can see where our work stops and the certification body starts.
What you receive
- AI use register
- Governance gap summary
- Responsibility map
- Implementation roadmap
Not included and limits
- Independent certification, which is issued by an accredited certification body, not OxygenIT
- Certification audit fees
- Guaranteed certification outcome (never offered)
- Implementing technical controls outside agreed scope
What we need from you
- An executive owner for AI governance
- Access to people who use or buy AI tools
- Existing policies and any ISO 27001 documents
- Time to review and approve policies
Do you need certification or alignment?
You need certification only when a customer, contract or tender asks for independent proof that your AI governance has been audited. Otherwise, governance aligned to ISO 42001 gives you the same policy, register, risk assessment and named owner without the external audit. You can still move to certification later.
| Aligned to ISO 42001 | Certified to ISO 42001 | |
|---|---|---|
| What you get | Governance that follows the standard: policy, AI register, risk assessment, named owner | The same system, plus a certificate if the audit is passed |
| Who audits | No external audit, internal review | An accredited certification body, never OxygenIT |
| When it suits | No customer or contract asks for a certificate, but you want AI used safely and consistently across the business | Customers, tenders or contracts ask for independent proof, for example where a contract requires ISO 42001 certification |
| Role of OxygenIT | Builds and helps run the system | Prepares you for the audit and does not issue the certificate |
Cost depends on the scope you need, and our guide to AI governance cost in NZ explains what drives it. For the places governance tends to go wrong, read about common AI governance problems.
If certification does not pay for itself in your contracts, we would rather tell you so than sell it to you.
Frequently asked questions
Does OxygenIT certify my business to ISO 42001?
No. OxygenIT does not certify businesses, and no consultant can. Only an accredited certification body can issue ISO 42001 certification, after it audits your AI management system. OxygenIT builds the governance that audit looks at, and because we are ISO 42001 certified ourselves, we know what an auditor asks to see. If you are still deciding whether you need it, read about ISO 42001 for small businesses.
Is OxygenIT ISO 42001 certified?
Yes. OxygenIT is certified to ISO/IEC 42001:2023, certificate number 8536-4213-01, issued by Compass Assurance Services and valid until 12 May 2029. As at 12 May 2026, OxygenIT holds ISO/IEC 27001:2022 as well. Both certificates cover how OxygenIT itself runs, not the businesses we work with. You can check the details and download the certificate on our ISO 42001 certification evidence page.
Do we need certification, or governance aligned to ISO 42001?
You need certification only if a customer, contract or tender asks for it. Otherwise, governance aligned to ISO 42001 is usually enough. Both run on the same policy, AI register, risk assessment and named owner. Certification adds an external audit by an accredited certification body, and a certificate if you pass. Alignment skips the audit, and you can still certify later because the system is the same. Read whether a small business needs ISO 42001.
How does ISO 42001 relate to ISO 27001?
ISO 42001 sits alongside ISO 27001: ISO 27001 covers information security, and ISO 42001 covers how your business uses AI. Both follow the same management system structure. If you already run ISO 27001, much of your risk process, document control and internal audit carries across. If you do not, we start with the AI register and an AI policy. As at 12 May 2026, OxygenIT holds both, as our certification evidence shows.
What does AI governance cost?
AI governance cost depends on scope: how many AI tools you use, how much business data they touch, and whether you want governance aligned to ISO 42001 or full certification. We agree that scope with you before any work starts, so you know what you are paying for. Our guide to AI governance cost in NZ explains what drives it.
Where do we start if we do not know which AI tools staff use?
Start by finding out which AI tools staff actually use, before you write a policy. Without that list, a policy governs the tools you know about and misses the rest. Shadow AI discovery and control looks for the AI tools in use across your business, and what it finds becomes the first entries in your AI register. Asking staff is a useful start, but it misses tools people do not think of as AI.
Book a 15-minute call
Book a 15-minute call to work out whether you need alignment or certification, or call our sales line on 0800 242 206.
Or call 0800 242 206
