Triodian and ISO/IEC 42001: our own position
Draft for Damian's decision (13 November 2026). Nothing here is published until the dates and the choice below are confirmed. Once confirmed, the statement in section 2 goes on
/licensing(or/about) and replaces the Draft row in the security answer pack, section 11.
1. What a client is asking
A risk or procurement lead who sees ISO/IEC 42001:2023 in our apps will ask whether Triodian, as a supplier, runs its own AI management system to the standard, and whether it is certified. Today the honest answer is: not yet, and no date has been set. A dated position answers the question even before certification.
Two facts bear on the dates:
- Certification bodies accredited for ISO/IEC 42001 already exist in Australia. JAS-ANZ runs an AI Management System Scheme, and has accredited at least four certification bodies under it (the first in 2025). The earlier note in the review, "once a certifier accredited under 42006 is available in Australia", is out of date: one is available now.
- ISO/IEC 42006:2025 is the standard accreditation bodies use to assess those certifiers. It is not something Triodian is certified against.
2. Draft statement (option A, recommended)
Triodian and ISO/IEC 42001. Our apps help clients record AI governance in the terms of ISO/IEC 42001:2023, and we hold ourselves to the same standard. From [1 April 2027] we run Triodian's own AI management system to ISO/IEC 42001:2023, with its scope, AI policy, risk and impact assessment, Statement of Applicability, internal audit and management review in place. We intend to seek certification from a JAS-ANZ-accredited certification body, with the stage 1 audit planned for [the second half of 2027]. We are not certified today. This statement is dated [date of approval] and we will update it at each step.
Scope to name when the statement is approved: the design, development and operation of the Triodian app suite and Triodian Start, and the advisory engagements run with them. The hardware tier would sit outside the first scope.
3. The other options
| Option | What we would say | What it costs | What it leaves open |
|---|---|---|---|
| A. Run to 42001 and seek certification (recommended) | Section 2 | Our own AIMS documents (most exist in draft in the apps' own outputs); an internal audit and a management review; certification fees for stage 1 and stage 2 and yearly surveillance | Nothing a client is likely to ask next |
| B. Run to 42001 without certification | "We run our AI management system to ISO/IEC 42001:2023 from [date]; we do not intend to seek certification at this stage" | The same internal work, no certification fees | A regulated client's supplier questionnaire may still mark the answer as a gap |
| C. No position yet | "Triodian is not certified to ISO/IEC 42001 and has not set a date" | Nothing now | The question comes back in every procurement |
4. What exists already, and what does not
| Clause | Have | Still to do |
|---|---|---|
| 4 Context and scope | The suite's own scope is stated in the README and the security answer pack | A written AIMS scope for Triodian itself |
| 5 Leadership, AI policy | Product principles on the website | A signed AI policy (A.2.2) |
| 6 Planning, risk and impact assessment | The apps produce these for clients; Triodian could run its own Board Direction and Use Assessment on itself | Run them on Triodian; a Statement of Applicability for the 38 Annex A controls |
| 7 Support, competence | Competence records now exist in the apps (ISO.6) | Records for Triodian's own people and its independent reviewer |
| 8 Operation | Development practice and release process | Written down as AIMS procedures |
| 9 Performance evaluation | The management review input pack (ISO.6, Risk Appetite) | An internal audit, then a first management review |
| 10 Improvement | The corrective-action register (10.2, Use Assessment) | Use it for Triodian's own nonconformities |
5. What we need from you
- The choice: A, B or C.
- For A or B: the start date for running the AIMS, and for A the planned window for the stage 1 audit.
- Where the statement goes on the website:
/licensing(beside the app-suite terms) or/about. - Whether counsel reads the statement before it goes on the website. It makes a forward-looking claim about Triodian, so we suggest counsel does.
Sources: JAS-ANZ, AI Management System Scheme; JAS-ANZ, first AI management system accreditation; A Good Certification Group accredited, September 2026.