An ISO/IEC 42001 certificate says an organisation runs a management system that governs AI responsibly. Agent certification says a specific agent has proven it can do a specific job, for a specific customer, on that customer's own cases. A regulated firm needs the first to show governance works and the second to justify letting an agent act.
What does an ISO/IEC 42001 certificate attest?
ISO/IEC 42001 sets requirements for an AI management system: context and scope, leadership and an AI policy, AI risk assessment and treatment, AI system impact assessment, resources and competence, operational control, monitoring, internal audit, management review and improvement. An accredited certification body audits the organisation against those requirements and, if it conforms, issues a certificate for the stated scope, maintained through surveillance audits.
What it attests, in substance: the organisation has defined how it governs AI and is following that definition. It does not attest that any particular AI system performs well. Our explainer on what ISO/IEC 42001 is covers the standard itself.
Who needs which?
Firms buying agent platforms ask vendors for 42001 certification as evidence of governance. Firms deploying agents may seek 42001 themselves, though it is not a legal requirement; see do you need ISO/IEC 42001 to deploy AI agents. Agent certification is needed by any firm that wants an agent to act beyond drafting, because supervisors and auditors will ask what evidence justified that authority.
What does each answer, and what does it miss?
The two operate at different levels.
- Subject. 42001 certifies an organisation. Agent certification certifies an agent.
- Question. 42001 asks: is AI governed through a working management system? Agent certification asks: can this agent do this job, here, to the required standard?
- Evidence. 42001 audits documents, records and interviews. Agent certification tests the agent's behaviour on real cases.
- Context. A vendor's 42001 certificate covers the vendor. Agent certification for a regulated firm should be on that firm's own cases, because performance depends on its data, products and customers.
- Lifetime. 42001 certificates run for a multi-year cycle with periodic surveillance. Agent certificates should be short-lived, because models, sources and briefs change.
- Consequence. A 42001 nonconformity leads to corrective action. A failed agent certification should reduce what the agent may do immediately.
Other schemes take other angles. The Cloud Security Alliance has published autonomy levels for AI agents, describing how independent an agent is. AIUC-1 is a third-party standard for AI agents from the Artificial Intelligence Underwriting Company. Neither replaces testing a specific capability on a specific firm's cases.
How do they fit together in practice?
The management system should require agent certification and use its results. That is where the two meet.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| 42001: AI policy | Policy states that agents act only within their certified depth | Approved policy |
| 42001: risk assessment | Likelihood estimates use agent certification results | Risk entries linked to certificates |
| 42001: operational control | Authority enforced at the moment of each action | Enforcement records |
| 42001: life cycle | Brief, source or model change triggers recertification | Change and recertification records |
| 42001: monitoring and measurement | Certificate status and expiry tracked | Certificate register |
| 42001: nonconformity | Failed certification reduces authority and opens corrective action | Downgrade records; corrective actions |
| 42001: internal audit | Auditors sample agent certificates and the cases behind them | Audit reports |
With that link, a certification auditor sees a management system that governs agents through evidence, and a supervisor sees agent authority backed by tests on the firm's own operation. Risk assessment is where the link is strongest; see ISO/IEC 42001 AI risk assessment for AI agents.
Take an illustrative example. A mid-sized lender buys an agent platform whose vendor holds 42001 certification, and builds a collections agent on it. The lender's own management system, which may or may not be certified, records that the agent may read accounts and draft repayment plans, and that sending plans requires certification on the lender's cases. The agent is tested on several hundred past cases, passes for drafting, falls short on spotting customers in difficulty, and so stays at drafting while its brief is improved. The vendor's certificate played no part in that decision, and could not have.
What will a supervisor or auditor ask?
- Your vendor holds 42001. What evidence do you have that its agent performs on your cases?
- Who decided this agent may act, and on what evidence?
- When was the agent last tested, and what happens if it fails?
- How does a change to the agent's instructions affect its authority?
- Does your management system require per-agent evidence, or only a general approval?
What does neither cover?
Neither is a legal licence to deploy an agent. Neither satisfies the EU AI Act's conformity assessment for high-risk systems on its own. Neither replaces data protection, conduct or prudential rules. For how the guidance standard on risk fits alongside, see ISO/IEC 23894 vs ISO/IEC 42001 and how ISO/IEC 23894 applies to AI agents. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme's Attest certifies each agent, for each customer, by replaying it against real cases from that customer's operation and scoring every answer against a floor across seven gates: grounded, refuses, depth, escalates, scope, adversarial and stable. Each gate must clear on its own. Certificates lapse after 90 days; a lapse, or a run that clears no depth, drops the agent to depth 1 the same day.
Questions people ask
Does a vendor's 42001 certificate cover our use of its agents?
It covers the vendor's management system within its stated scope. Your use, on your data, under your limits, is yours to govern and evidence.
Can an agent certificate replace a model validation?
It can supply much of the evidence a validation needs, such as performance on representative cases. Model risk functions will still want independent review of the method and its limits.
How often should agents be recertified?
Often enough that the certificate reflects the agent as it runs now. A short fixed expiry, plus recertification on any material change, is a sound approach.