Built for Australia.
Not adapted for it.
CentryAI is an ISO/IEC 42001-based AI governance method, built for Australian law and the Guidance for AI Adoption.
Challenges in AI governance
The first step is knowing where AI is used: the systems you build, the AI products you buy, AI features in software you already own, and the tools your staff use.
Rapid technology change
AI advances outpace regulatory frameworks.
Algorithmic bias
Ensuring fairness across diverse populations.
Data privacy
Protecting sensitive information.
Skills gap
Limited expertise in AI ethics and governance.
One framework, built for Australia
Australia has no AI Act. Obligations come from existing law, so we combine the international standard with what you must actually comply with here.
| Layer | Source | How we use it |
|---|---|---|
| Structure | ISO/IEC 42001:2023 | The management system: scope, policy, risk method, Statement of Applicability, audit and improvement. Certifiable when you need it. |
| Australian obligations | Privacy Act (including automated decisions), consumer, anti-discrimination, WHS and sector rules | What you must comply with. Built into the AI Register, assessments and policies. |
| Australian practice | Guidance for AI Adoption (AI6); AI Ethics Principles | The six practices buyers ask about, and the values behind our policy and impact assessments. |
| Toolkit | NIST AI RMF and Generative AI Profile (AI 600-1) | Prompts for identifying risks, especially for generative and agentic AI. |
| Overlay | EU AI Act | Only when you sell into the EU or your AI is used there. |
Seven stages, one set of IDs
One rating scale and one set of IDs link every AI system, risk, control, action and incident, so results are consistent whoever runs the assessment.
| Stage | What happens | Key templates |
|---|---|---|
| 1 · Context and scope | Find every AI system, set scope and policies | AI Register and Scope; AI Policy; Acceptable Use Policy; Screening |
| 2 · Risk criteria | One rating scale tied to your risk appetite | Risk Criteria and Methodology; Risk Appetite Statement |
| 3 · Risk and impact assessment | Rate risks; assess impacts on people and privacy; check suppliers and automated decisions | Risk Register; AI System Impact Assessment; PIA; Supplier Assessment; ADM Readiness Check |
| 4 · Statement of Applicability | Choose ISO/IEC 42001 Annex A controls, linked to risks | Statement of Applicability |
| 5 · Risk treatment | Actions, owners and residual risk acceptance | Treatment Plan |
| 6 · Implementation | Lifecycle controls and transparency | Data, model and testing templates; AI System Information Sheet; Customer Summary |
| 7 · Monitor and improve | Indicators, incidents and review | Monitoring Specification; Incident Response Playbook |
The CentryAI approach
One standard-based method
ISO/IEC 42001 structure, one risk scale and one ID scheme.
Built for Australian law
The Privacy Act and the automated decisions duty, the Guidance for AI Adoption (AI6) and sector rules.
Proportionate
Three paths and system tiers: effort matches risk. Governance is embedded throughout the AI lifecycle, not bolted on.
Ready-to-use toolkit
Practical templates teams can actually use, delivered by CentryAI and partners the same way every time.
To empower organisations of all sizes to develop and deploy ethical AI through practical, actionable governance that bridges the gap between global principles and everyday implementation.
Ready to get started?
Book a 30-minute discovery call to confirm which path fits, or take the free 10-minute assessment first.