A free crosswalk from Australia's Guidance for AI Adoption (AI6) to ISO/IEC 42001: all
21 implementation practices, each mapped to the clauses and controls that meet it
and the document where it belongs, with a column for status and owner. Copy it or download
it as Word, no sign-up. It is honest about the 3 practices ISO 42001 only partly
covers, and PolicyMint can write it for your own AI systems.
Rather not fill it in yourself? Have
this one document generated in your branding instead -
the signup credits cover the first one. Card required to download that one; no charge today.
Generated from this page's structure, in an example company's branding
Free crosswalk
Free AI6 to ISO 42001 crosswalk
The complete AI6 crosswalk, free to copy from this page or download as an editable Word document.
No sign-up. Replace every [bracketed placeholder] with your own details, delete anything that
does not apply, and have it approved before you rely on it. The guide below
explains what each section has to contain and what an auditor checks.
Guidance for AI Adoption to ISO 42001 Crosswalk - Template
Maps the National AI Centre's six essential practices (AI6) to ISO/IEC 42001 and to the documents that meet them. Replace the bracketed placeholders, then fill in each status and owner.
[Organization] uses this register to show how its AI management system meets the Guidance for AI Adoption, published by the National AI Centre in October 2025. For each implementation practice it records the ISO/IEC 42001 clauses and controls that correspond to it, the document where [Organization] meets it, its current status and its owner.
1. Purpose and scope
The Guidance for AI Adoption is voluntary. It sets out six essential practices for responsible AI governance, with implementation practices under each. ISO/IEC 42001 is the certifiable standard for an AI management system. This register maps one to the other, so [Organization] can show where its AI management system already meets the guidance and see where it does not yet.
It covers [the AI systems in scope, for example a customer support chatbot and Microsoft 365 Copilot]. Parts of some practices are marked in the guidance as applying to developers; they apply to [Organization] only if it builds, trains or fine-tunes its own AI models.
2. How to read this register
Each table covers one essential practice. The ISO/IEC 42001 column lists the clauses and Annex A controls that correspond to each implementation practice; "(partial)" marks the three practices ISO 42001 only partly covers. The status of each practice is one of:
In place: documented and operating, with evidence
Partly in place: documented or operating, but not both, or not for every AI system
Planned: not yet in place, with an owner and a target date under Gaps and next steps
Not applicable: does not apply to [Organization], with the reason
3. Practice 1: Decide who is accountable
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
1.1 Accountable people
A named, competent person accountable for the AI management system and for each AI system, including third-party AI, testing and complaints.
5.1, 5.3, A.3.2
AI roles and responsibilities policy; AI management system policy
[status]
[owner]
1.2 Supply chain accountabilities
Who is responsible for what across the AI supply chain (developers, vendors, integrators), including monitoring, human oversight and reporting faults.
A.10.2, A.10.3, A.10.4
Third-party and customer relationships policy; supplier contracts
[status]
[owner]
1.3 AI literacy and training
Training needs assessed and met, for staff generally and for the people accountable for or overseeing each AI system.
7.2, 7.3, A.4.6
AI competence and training record; AI resources policy
[status]
[owner]
1.4 AI governance framework
An AI policy, processes and goals in line with strategy and the laws that apply, run as a management system that finds and fixes its own gaps.
4.1, 4.4, 5.2, 6.3, 10.2, A.2.2, A.2.4
AI management system policy; AIMS scope statement; corrective action register
[status]
[owner]
4. Practice 2: Understand impacts and plan accordingly
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
2.1 Identify and engage stakeholders
Who each AI system affects and how, including vulnerable groups, unwanted bias, personal information and decisions about people, assessed with input from those affected.
4.2, 6.1.4, A.5.2, A.5.4, A.5.5, A.9.4
AI system impact assessment procedure; AIMS scope statement
[status]
[owner]
2.2 Establish feedback and redress processes
Accessible ways for people to raise concerns, question or contest AI use and decisions, and have things put right.
A.3.3, A.8.3
Transparency policy; AI roles and responsibilities policy
[status]
[owner]
2.3 Monitor for systemic issues
Complaints and challenges reviewed across the organization to find and fix systemic problems.
9.1, 10.2
AI monitoring and measurement record; corrective action register
[status]
[owner]
5. Practice 3: Measure and manage risks
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
3.1 Establish a fit-for-purpose risk management framework
An AI-specific risk framework with a stated risk tolerance, impact and risk assessment processes, and risks from suppliers included.
6.1.1, 6.1.2, 6.1.4, A.10.3
AI risk management policy; AI risk assessment and treatment methodology
[status]
[owner]
3.2 Assess AI system risks
A triage of which AI systems need more attention, then a documented risk assessment for each system and use case, bought or built.
6.1.2, 8.2
AI risk register; AI risk assessment and treatment methodology
[status]
[owner]
3.3 Implement controls for AI system risks
A treatment plan for each risk, controls in proportion to it, and a check that the controls worked.
6.1.3, 8.3
AI risk register; AI Statement of Applicability
[status]
[owner]
3.4 Monitor and report incidents
AI incidents tracked and reported to regulators or the public where required, including notifiable data breaches, and the lessons used.
A.8.4, 9.1, 10.2
Transparency policy; corrective action register; incident and data breach response plans
[status]
[owner]
6. Practice 4: Share essential information
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
4.1 Maintain an AI register
An up-to-date register of every AI system, built, bought or embedded in other software, with its owner, purpose, risks and reviews.
A.4.2, A.6.2.7
AI system inventory
[status]
[owner]
4.2 AI system transparency and explainability
People told when and how AI is used, and what its capabilities, limits and risks are, in terms they can understand.
A.8.2, A.8.5, A.6.2.7
Transparency policy; AI system life cycle and development policy
[status]
[owner]
4.3 Supply chain transparency
The technical and testing information needed from AI suppliers obtained, problems reported back to them, and both written into contracts.
A.10.3, A.10.4, A.8.2
Third-party and customer relationships policy; supplier contracts
[status]
[owner]
4.4 AI-generated content transparency
Labelling or disclosure of AI-generated content, in proportion to the risk. ISO 42001 has no control written for this; transparency is its nearest home.
A.8.2, A.8.5 (partial)
Transparency policy
[status]
[owner]
7. Practice 5: Test and monitor
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
5.1 Pre-deployment testing
Acceptance criteria and tests for the intended use before an AI system goes live, supplier test results requested, and deployment signed off by its owner.
A.6.2.4, A.6.2.5, A.10.3
AI system life cycle and development policy
[status]
[owner]
5.2 Monitor system performance
Metrics and monitoring for each AI system after deployment, matched to its risks, with regular performance reviews.
A.6.2.6, 9.1
AI system life cycle and development policy; AI monitoring and measurement record
[status]
[owner]
5.3 Conduct additional testing proportionate to risk
Further safety evaluation, independent review or auditing for higher-risk systems. ISO 42001 does not require independent testing; the risk treatment decides when it is needed.
A.6.2.4, 6.1.3 (partial)
AI system life cycle and development policy; AI risk register
[status]
[owner]
5.4 Implement robust data and cybersecurity measures
Data governance, privacy and cybersecurity extended to AI: data rights, quality and provenance, the Australian Privacy Principles, and AI-specific security risks.
A.7.2, A.7.3, A.7.4, A.7.5, A.7.6, A.4.3, A.2.3
Data management for AI policy; privacy policy; information security controls
[status]
[owner]
8. Practice 6: Maintain human control
Practice
What it expects
ISO/IEC 42001
Where it is met
Status
Owner
6.1 Maintain human oversight and control
Human oversight through the life of each AI system, the means to intervene, and training for the people who oversee it.
A.9.2, A.9.3, A.9.4, A.6.2.6, 7.2
AI management system policy; AI system life cycle and development policy; AI competence and training record
[status]
[owner]
6.2 Decommission when appropriate
Criteria and an owner for retiring an AI system, a plan that keeps critical services running, and its data extracted, returned or deleted. ISO 42001 has no control written for decommissioning; the life cycle policy is its home.
A.6.1.3, A.6.2.6 (partial)
AI system life cycle and development policy
[status]
[owner]
9. Gaps and next steps
Every practice that is Partly in place or Planned has an action here, with an owner and a target date.
Practice
Action
Owner
Target date
[for example 4.4]
[for example Label AI-generated images in marketing material]
[role]
[date]
[practice]
[action]
[role]
[date]
10. Review
[role] reviews this register [annually], and also when the National AI Centre updates the guidance, when [Organization] adopts a new AI system, and when it starts building or training its own models.
This crosswalk is PolicyMint's own reading of the Guidance for AI Adoption against ISO/IEC 42001:2023. It is a starting point, not legal or audit advice: check it against your own systems before you rely on it.
The guide
The six practices, and where each lands in ISO 42001
6
sections
3
with real wording
6
questions you will be asked
4
failure modes
half a day
to write it yourself
The Guidance for AI Adoption is Australia's national guidance for responsible AI governance,
published by the National AI Centre in October 2025. It sets out six essential practices,
often called AI6, and comes in two versions: Foundations, for organizations starting out,
and the implementation practices, with the detail this crosswalk maps.
The guidance says its implementation practices draw on and align with standards including
ISO/IEC 42001, but its own crosswalk maps them to the 2024 Voluntary AI Safety Standard
instead. Below is each practice, what it asks, and where the crosswalk puts it. The
3 that ISO 42001 only partly covers carry the crosswalk's own wording for that row.
1
Decide who is accountable
What it must contain
A senior owner for AI governance, an AI policy, a named person for every AI system, training for those people, clear accountability across the AI supply chain, and a governance framework the policy grows into.
Where it lands in ISO 42001
Leadership and roles (clauses 5.1 and 5.3, control A.3.2), competence and awareness (7.2 and 7.3), supplier and customer responsibilities (A.10) and the management system itself (4.4). This is the practice ISO 42001 covers most completely.
2
Understand impacts and plan accordingly
What it must contain
Know who each AI system affects, paying particular attention to vulnerable groups; give people a way to report problems and contest AI decisions; and watch that feedback for systemic issues.
Where it lands in ISO 42001
The AI system impact assessment (6.1.4 and A.5), external reporting for the people affected (A.8.3), and monitoring and corrective action (9.1 and 10.2). Contestability is where most ISO 42001 sets are thinnest: the standard asks for a way to report, the guidance asks for redress.
3
Measure and manage risks
What it must contain
Screen AI systems for risk, assess each system and use case, apply controls in proportion to the risk, and investigate and report incidents.
Where it lands in ISO 42001
AI risk assessment and treatment (6.1.2, 6.1.3, 8.2 and 8.3) and the AI Statement of Applicability. The guidance's triage step belongs in the risk methodology, and its incident reporting in A.8.4 and corrective action.
4
Share essential information
What it must contain
Keep an AI register, tell people when they are dealing with AI, explain what it can and cannot do, be transparent across the supply chain, and be clear about AI-generated content.
Where it lands in ISO 42001
The AI system inventory (A.4.2), information for interested parties (A.8) and supplier relationships (A.10). Content labelling is the gap: ISO 42001 has no control written for it.
Wording that works
Labelling or disclosure of AI-generated content, in proportion to the risk. ISO 42001 has no control written for this; transparency is its nearest home.
Marking it partial, rather than claiming transparency policy covers it, gives it its own action and keeps the rest of the crosswalk credible.
5
Test and monitor
What it must contain
Ask suppliers for proof of testing, test before deployment, monitor after it, extend data governance and cybersecurity to AI, and test harder where the risk is higher.
Where it lands in ISO 42001
Verification, deployment and monitoring in the AI life cycle controls (A.6.2.4 to A.6.2.6), data for AI systems (A.7) and monitoring (9.1). Independent testing is the gap.
Wording that works
Further safety evaluation, independent review or auditing for higher-risk systems. ISO 42001 does not require independent testing; the risk treatment decides when it is needed.
It ties the guidance's higher bar to a decision the management system already makes, so independent testing happens where the risk assessment says, not everywhere or nowhere.
6
Maintain human control
What it must contain
Human oversight matched to how autonomous and high-stakes each system is, points where a person can pause, override or shut it down, training for the people overseeing it, and a plan to retire a system without losing a critical service.
Where it lands in ISO 42001
Responsible and intended use (A.9.2 to A.9.4) and operation and monitoring (A.6.2.6). Decommissioning is the gap: ISO 42001 has no control written for it.
Wording that works
Criteria and an owner for retiring an AI system, a plan that keeps critical services running, and its data extracted, returned or deleted. ISO 42001 has no control written for decommissioning; the life cycle policy is its home.
It names the three things a retirement plan needs, and where they live, so a system can be switched off without a scramble.
Nobody certifies against the guidance, but customers' AI questionnaires, boards and ISO 42001
auditors ask the questions it raises. Each of these is answered by a row of the crosswalk and
the document it points to.
?
Do you follow Australia's Guidance for AI Adoption?
Satisfies
This crosswalk: each practice, where you meet it, its status and owner, and an action for every gap.
Fails
"We are working towards ISO 42001," with nothing to show which practices that covers.
?
Which AI systems do you use, and who is accountable for each?
Satisfies
An AI register naming every system, including AI built into other software, each with a named owner.
Fails
A list of the tools IT bought, missing the AI features switched on inside them.
?
How can someone question a decision your AI made?
Satisfies
A published way to raise a concern or contest an outcome, a person who responds, and a record of what was done.
Fails
A generic contact form that never mentions AI.
?
What testing happened before this went live?
Satisfies
Acceptance criteria for the intended use, the results, the supplier's evidence and a sign-off by the system's owner.
Fails
"The vendor says it is accurate."
?
How would you stop it if it went wrong?
Satisfies
A documented way to pause, override or switch off each system, who may do it, and what keeps the service running meanwhile.
Fails
Nobody is sure who has the admin login.
?
Where does your ISO 42001 work not cover the guidance?
Satisfies
The three partial practices, marked as such, each with its own action.
Fails
A claim that certification covers everything.
Failure modes
Where AI6 mappings go wrong
!
Mapping six headings instead of 21 practices
The six essential practices are headings. The implementation practices under them are what a customer or assessor reads, and two practices under one heading can land in different parts of ISO 42001. Map each one, or the crosswalk says less than it seems to.
!
Assuming ISO 42001 covers all of it
It covers most of the guidance, not all. Labelling AI-generated content, independent testing for higher-risk uses and decommissioning have no control of their own. Mark them partial and give each an action, rather than letting a certificate stand in for them.
!
Saying you comply
The guidance is voluntary and nobody certifies against it, so a compliance claim overstates what anyone can check. Saying where you meet each practice, and where you do not yet, is honest and can be verified.
!
Copying developer practices into a user's register
The guidance marks some parts for developers: model and system cards, sharing technical details downstream, safety evaluations of model capabilities. If you only use third-party AI, those parts sit with your suppliers, and your job is to ask for their evidence. Saying so is more credible than claiming work you do not do.
From crosswalk to audit-ready
The documents the crosswalk points to
A crosswalk is only as good as the documents in its last column. Most rows land in a handful
of them: the AI policy, the AI risk assessment and impact assessment, the AI system inventory,
and the life cycle and transparency policies. The free
AI policy,
AI risk assessment and
AI impact assessment templates cover
three of them, and if your AI suppliers are part of the picture, the
AI vendor security addendum
covers the supply chain rows from the contract side.
The same tables, written for your organization: each practice described for the AI you actually
build or use, developer-only parts handed to your suppliers if you only buy AI, each status taken
from what you tell us and marked for confirmation where we cannot know it, and an action for every
gap. It carries your branding and exports to Word, PDF or Excel. The cover in the hero and the
page below are that output, generated for an example company.
One page of the generated document, for an example company. The trial produces the whole
document, not a sample.
Where the guide says [role] or [system], the document says yours; where PolicyMint
cannot know a fact, it asks rather than guesses.
Guided reviewActual product
The one fact this document could not know stays highlighted in the document and the
export. The review explains what is needed and writes your answer in. Nothing is
invented. Fictional demo data.
Side by side
Filling it in yourself vs generating it
Scroll the table sideways to compare both routes.
Dimension
Filling it in yourself
Generating it with PolicyMint
The mapping
This page: all 21 practices mapped to ISO 42001, free.
The same mapping, with what each practice means for your own AI systems written in.
Status
You assess each practice and keep the evidence.
Set from what you tell us is already in place; anything we cannot know is marked for you to confirm.
Gaps
You write an action for each gap.
One action per gap, with an owner, consistent with your other documents.
Checking it
Nobody, until a customer or an auditor asks.
Three independent verifiers before you see it.
Making it look like yours
Your own formatting, headers and approval block.
Your logo and colors, exported to Word, PDF or Excel.
The documents it points to
The crosswalk names documents you still have to write.
They come from the same profile, so every reference is real. Your first document is free.
ISO 27001 documents
36
ISO 27001 documents
tiered by what you actually need
ISO 42001 documents
21
ISO 42001 documents
for AI management systems
Clauses and controls mapped
182
Clauses and controls mapped
every document cites the ones it satisfies
Verifiers per section
3
Verifiers per section
on a different model to the writer
AI6 and ISO 42001 FAQ
The questions people ask
Including whether the guidance is mandatory, and whether ISO 42001 certification covers it.
What is the Guidance for AI Adoption (AI6)?
The Guidance for AI Adoption is Australia's national guidance for responsible AI governance, published by the National AI Centre in October 2025. It sets out six essential practices, often called AI6: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It comes in two versions: Foundations, for organizations starting out, and the implementation practices, with the detail.
Is the Guidance for AI Adoption mandatory?
No. It is voluntary guidance. It does not replace the laws that already apply to AI, such as privacy and consumer law, or your existing data, privacy and cybersecurity frameworks, which the guidance expects you to keep and extend to AI.
How does AI6 relate to the Voluntary AI Safety Standard?
It is the first update to it. The 2024 Voluntary AI Safety Standard had ten guardrails; the Guidance for AI Adoption condenses them into six essential practices and widens the audience to developers as well as deployers. The National AI Centre publishes a crosswalk from the old guardrails to the new practices.
Does ISO 42001 certification mean we meet AI6?
Mostly. The National AI Centre says the implementation practices draw on and align with standards including AS ISO/IEC 42001:2023, and a working ISO 42001 management system meets most of them. Three are only partly covered: transparency for AI-generated content, additional testing in proportion to risk, and decommissioning. The crosswalk marks each so you can close them separately.
Is this an official crosswalk?
No. The National AI Centre's own crosswalk maps the guidance to the 2024 Voluntary AI Safety Standard, not to ISO 42001. This one is PolicyMint's reading of the implementation practices against ISO/IEC 42001:2023. It lists clause and control numbers only, never the standard's text.
Do we need ISO 42001 to follow the Guidance for AI Adoption?
No. The guidance stands on its own, and its Foundations version is written for organizations just starting with AI. ISO 42001 is the route when you want a certifiable management system or a customer asks for one; the crosswalk lets you work toward both at once.
Is this AI6 crosswalk free to download?
Yes. The complete crosswalk is on this page and as an editable Word document, with no sign-up and no card. Fill in each status and owner, and add an action for every gap. If you would rather have it written for your organization, with each practice described for your own AI systems, PolicyMint generates it and your first document is free; we ask for a card only when you download that one, and it is not charged.
How much does an ISO 42001 document set cost?
PolicyMint's Full ISMS / AIMS pack is a one-time A$350US$229£179€209 including GST and covers a complete certifiable ISO 42001 set of 21 finished documents, or a complete ISO 27001 set of 36. Each document is drafted from your own business profile, checked by three independent verifiers before you see it, and exported in your branding as Word, PDF and Excel. There is no subscription and credits are valid for 18 months. Your first document is free, card required.
Ready when you are
Stop staring at an empty
document set
Set up your business once. Get the documents you actually need, written for how you really operate, in your branding, checked before you see them.
