Start with the path that fits
Three paths to ISO/IEC 42001, plus a quick start for the Privacy Act automated decisions duty. Move up without redoing work.
Effort that matches your risk
Each path builds on the last. Fees are confirmed after a 30-minute discovery call, once we know which path fits and what is in scope.
ADM Readiness Check
Be ready for the Privacy Act automated decisions duty, which applies from 10 December 2026.
- Privacy Act APPs 1.7 to 1.9
- Find automated decisions that could significantly affect people
- Draft privacy policy wording
AI Governance Sprint
Credible AI governance for up to three AI systems. Ideal for 1 to 3 AI systems.
- AI Register and AIMS scope
- AI Policy and Acceptable Use Policy
- Risk register and treatment plan
- Impact and privacy assessments
- ADM check and supplier assessments
- Monitoring and incident plans
- 12 core ISO/IEC 42001 controls
- Report and customer summary
AIMS Build
A full ISO/IEC 42001 AI management system. For when customers ask detailed AI questions.
- Everything in the Sprint
- All applicable Annex A controls
- Statement of Applicability
- Internal audit and management review
Certification Readiness
Audit preparation for when certification is required, delivered alongside your accredited certification body.
- Full AI management system
- Pre-audit review
- Stage 1 and 2 audit preparation
- With your accredited certification body
CentryAI does not certify. Path C is delivered alongside your accredited certification body.
Start where you are
Most organisations with one to three AI systems start with the Sprint. Move up when your customers, systems or markets require it.
| ADM Readiness Check | Path A · Sprint | Path B · AIMS Build | Path C · Certification | |
|---|---|---|---|---|
| Best for | Anyone with decisions about people before 10 December 2026 | 1 to 3 AI systems | 3+ systems, or enterprise customers asking | Certification required |
| Scope | Automated decisions and privacy policy wording | Policies, register, assessments and 12 core controls | All clauses and applicable controls | Full AIMS run for one cycle |
| Key outputs | Decisions in scope; draft wording | Report and customer-ready summary | Statement of Applicability; internal audit and management review | Stage 1 and 2 audit preparation |
| Engagement | 1 to 2 weeks | 2 to 4 weeks | 3 to 6 months | 2 to 3 months |
Customer-ready AI governance in 2 to 4 weeks
Delivered by CentryAI and accredited partners using one tested method, the same way every time.
Foundation
Week 1. AI Register, risk criteria and policies.
Assess
Week 2. Risks, impacts, privacy and suppliers.
Treat
Week 3. Controls, monitoring and incident plan.
Report
Week 4. Executive read-out and customer summary.
Not sure which path fits?
The free 10-minute assessment suggests a path based on your answers. Or book a 30-minute discovery call and we will confirm which path fits and what is in scope.