No. ISO/IEC 42001:2023 is a voluntary, certifiable standard for an AI management system, and no law in the major markets requires it before you deploy an agent. It can still be worth adopting if customers ask for it. Just be clear about what it proves: that your organisation manages AI systematically, not that any particular agent is safe.
What does ISO/IEC 42001 require, in plain words?
It sets requirements for an AI management system, in the same family style as ISO/IEC 27001 for information security. Our entry on what ISO/IEC 42001 is covers it in full. In substance, an organisation must set an AI policy and objectives, assign roles and responsibilities, assess AI risks and the impacts of its AI systems, choose and apply controls, monitor and measure, run internal audits and management reviews, and keep improving. A set of reference controls accompanies the requirements, and organisations justify which ones apply.
An accredited certification body can audit and certify the management system. Related guidance includes ISO/IEC 23894:2023 on AI risk management, covered in how ISO/IEC 23894 applies to AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who is it for?
Any organisation that develops, provides or uses AI systems. In practice, it is most often pursued by:
- Vendors of AI products, because enterprise buyers ask for it.
- Large deployers that want a structured way to run AI governance across many teams.
- Regulated firms that want management-system evidence to show supervisors, alongside sector rules.
Smaller deployers often align with it without certifying, or use the voluntary NIST AI Risk Management Framework instead. The comparison is in NIST AI RMF versus ISO/IEC 42001 for AI agents, and the choice is discussed in whether to follow the NIST AI RMF or ISO/IEC 42001.
What does it mean when the system is an agent?
A management system standard asks whether you have a process. For agents, auditors will look for evidence that the process reaches each agent: that risks were assessed for its specific capabilities, that controls exist at the moment it acts, and that you monitor it.
That is where agent operations and the standard meet. The agent's brief, bounds, certification results, held-queue records and filed verdicts are exactly the kind of evidence a management system audit asks for. A certificate under 42001 does not replace them; it depends on them.
How do you meet it for an agent programme?
| Element in substance | Control for agents | Evidence it leaves |
|---|---|---|
| AI policy and objectives | Policy covering when agents may be used and who approves | Approved policy |
| Roles and responsibilities | Named owner for each agent; platform owner; risk | Inventory with owners |
| Risk assessment | Risks assessed per agent and capability | Risk register; see 42001 AI risk assessment for agents |
| Impact assessment | Effects on people and groups assessed per use | Impact assessments |
| Controls | Bounds, depth, held queue, certification | Configuration and certificates |
| Monitoring and measurement | Weekly signals, recertification cycle | Review minutes, certification results |
| Internal audit and review | Periodic audit of the agent programme | Audit reports, management review minutes |
| Improvement | Corrections and incidents feed changes | Change log |
What does that look like in practice?
Say a firm sells an agent that helps insurers triage claims. Every large insurer it pitches asks for evidence of AI governance, and several ask specifically about ISO/IEC 42001. The firm builds its management system around the processes it already runs, mapping each agent's certification, record and change control to the standard, and gets certified. The certificate shortens procurement.
One of its customers, a mid-sized insurer, decides not to certify. It aligns its AI policy and risk assessment with the standard, but relies on its existing risk framework and the agent-level evidence for its regulator. Both choices are reasonable.
What does it not cover?
A 42001 certificate does not show that an agent gives correct answers, is fair in a given decision, or meets a specific law such as GDPR, the EU AI Act or sector rules. It certifies how an organisation manages AI, not the behaviour of each agent on your cases. That evidence must come from testing and records.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Does 42001 help with the EU AI Act?
It can help structure the governance the Act expects, such as risk management and record-keeping, but it is not a substitute for meeting the Act's specific obligations.
Should we ask our agent vendor for 42001?
It is a reasonable request and a useful signal. Ask also for evidence that their agents can be certified on your own cases, since that is what your owner answers for.
How long does certification take?
It depends on how mature your governance already is. Organisations with an existing ISO/IEC 27001 system often move faster, because much of the management structure is in place.