An ISO/IEC 42001 management system gives you much of the governance the EU AI Act expects: policy, roles, risk assessment, impact assessment, competence, monitoring, audit and correction. It does not prove a specific agent meets the Act's technical requirements on logging, oversight, accuracy or transparency. Use the management system to run AI Act controls, and keep agent-level evidence separately.
What does each require, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. It sets legal duties by risk tier. For high-risk systems, providers must run a risk management system (Article 9), govern data (Article 10), log automatically (Article 12), inform deployers (Article 13), design for human oversight (Article 14) and achieve appropriate accuracy, robustness and cybersecurity (Article 15), within a quality management system. Deployers carry duties under Article 26. Article 50 sets transparency duties and Article 4 requires AI literacy.
ISO/IEC 42001:2023 is a certifiable standard for an AI management system. It asks an organisation to understand its context, set an AI policy, assign roles, assess and treat AI risks, carry out AI system impact assessments, ensure competence, control operations, monitor and measure, audit internally, review at management level and correct nonconformities. Its annex provides a set of controls covering areas such as data, the AI system lifecycle, third-party relationships and information for interested parties. For a primer, see what ISO/IEC 42001 is.
Who uses which?
The AI Act binds providers and deployers in its scope. ISO/IEC 42001 is voluntary and can be adopted by any organisation, whether it builds, buys or uses AI. Many organisations adopt it to show customers and supervisors they govern AI systematically, and some use it as the backbone of their AI Act programme. The choice between frameworks is covered in should you follow the NIST AI RMF or ISO/IEC 42001.
Where does 42001 evidence the Act, and where does it fall short for agents?
The management system is strongest where the Act asks for processes. It is weakest where the Act asks for properties of a specific system.
Where it helps. An AI policy that covers agents, roles that name owners, a risk assessment method, impact assessments, competence and awareness duties, operational controls, monitoring, internal audit and corrective action all map well to the Act's expectations on risk management, quality management, deployer monitoring, assignment of human oversight and AI literacy. Our guides on writing a 42001 AI policy that covers agents and 42001 risk assessment for agents go into those pieces. The complementary guidance in ISO/IEC 23894 on AI risk management is covered in how ISO/IEC 23894 applies to AI agents.
Where it falls short. 42001 shows you have a process for logging; the Act asks whether this agent's logs let you trace its operation. 42001 shows you assign oversight; the Act asks whether this agent's design lets a person interrupt it safely. 42001 shows you measure performance; the Act asks whether this agent is accurate enough for its intended purpose. Certification to 42001 does not, by itself, give a presumption of conformity with the Act's high-risk requirements, and it does not replace any conformity assessment the Act requires.
Agents widen the gap. An agent's risks sit in its capabilities, its sources and its authority. A management system can be certified while an individual agent still holds permissions nobody tested. Evidence for the Act has to reach the capability.
How do you use one to evidence the other?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| AI Act risk management | 42001 risk assessment and treatment applied per agent capability | Risk register entries per capability |
| AI Act quality and deployer monitoring | 42001 monitoring, internal audit and management review include agents | Audit reports and review minutes |
| AI Act human oversight assignment | 42001 roles name the overseer for each agent | Role assignments |
| AI Act AI literacy | 42001 competence and awareness requirements, tailored to approvers | Training and competence records |
| AI Act logging | Agent-level append-only record of every step and verdict | Action records per case |
| AI Act oversight design | Held actions and tested stop per agent | Held-action records and stop tests |
| AI Act accuracy and cybersecurity | Agent certified on real cases; injection tested | Certification and test results |
| AI Act transparency | Disclosure and marking built into each agent | Conversation records and marked outputs |
| AI Act FRIA where required | 42001 impact assessment extended to Article 27 content | Combined assessment |
The first four rows are where 42001 does the work. The rest need agent-level evidence the management system should require but cannot itself produce.
What will an auditor or supervisor ask?
- Is your 42001 scope wide enough to include every agent and its capabilities?
- How does your impact assessment process meet the Act's requirements for high-risk agents?
- Show us agent-level evidence for logging, oversight and accuracy, not just the procedure.
- How do 42001 nonconformities about agents reach the agent owner?
- Do you treat 42001 certification as compliance with the Act?
The last question is a test. The right answer is no.
What does 42001 not cover?
It does not determine whether an agent is high-risk. It does not deliver legal compliance on its own. It does not replace information security management under ISO/IEC 27001, though the two integrate. And it is voluntary, so its value lies in the evidence it produces, not in the badge. For the wider map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme produces the agent-level evidence a management system calls for but cannot generate: certification of each agent on the customer's own cases through Attest, an append-only record of every verdict, and certificates that lapse after 90 days so monitoring is continuous rather than annual.
Questions people ask
Does 42001 certification make us AI Act compliant?
No. It shows you run a management system for AI. The Act asks about specific systems and specific duties, which need their own evidence.
Should deployers adopt 42001, or only providers?
Either can. For deployers, it gives structure to monitoring, oversight assignment and literacy, which are central deployer duties.
Is 42001 worth it for a small firm with a few agents?
It can be heavy. A small firm may adopt its structure without certification, and focus effort on agent-level evidence.