An ISO/IEC 42001 certification audit runs in two stages. First the auditor checks your AI management system is designed and documented; then they test that it operates, sampling AI systems and tracing them from policy to evidence. Where agents are in scope, expect auditors to pick one and ask who owns it, what it may do and how you know.
What does a certification audit test, in plain words?
ISO/IEC 42001:2023 is a certifiable standard for an AI management system: the policies, roles, processes and controls an organisation uses to develop, provide or use AI responsibly. An accredited certification body audits against it. If you need the basics first, read what ISO/IEC 42001 is.
The audit follows the usual pattern for management system standards:
- Stage 1. The auditor reviews documented information: the scope, AI policy, roles, the method for AI risk assessment and AI system impact assessment, the statement of which controls apply and why, and evidence that internal audit and management review have happened. They decide whether you are ready for stage 2.
- Stage 2. The auditor tests operation. They interview owners, sample AI systems, and look for records showing the processes run as written.
- Findings. Major nonconformities must be corrected before a certificate is issued. Minor ones need a corrective action plan.
- Surveillance. Periodic audits through the certificate's cycle check that the system keeps working, followed by a full recertification.
Our piece on what ISO/IEC 42001 certification proves explains what the certificate means once issued.
Who goes through it?
Any organisation that develops, provides or uses AI and wants independent certification of its AI management system: vendors seeking to reassure buyers, and deployers such as banks, insurers and health providers seeking to show supervisors and customers that AI is governed. The scope can cover the whole organisation or a defined part, such as one business line or one platform.
Choose scope carefully. Too narrow and buyers will ask why the agents they use are outside it. Too wide and the first audit will find gaps in areas nobody prepared.
What do auditors look for when the AI includes agents?
Auditors know chatbots and predictive models well. Agents that take actions raise the bar in five places, and a well-prepared auditor will probe each.
Inventory. Is every agent in the AI system inventory, with its capabilities listed? An agent that can read a ledger and also post journal entries is two risk profiles in one system.
Risk assessment. Does the AI risk assessment cover risks specific to action: an agent acting on a false instruction, exceeding its permissions, being steered by injected text, or repeating an action? Generic risks such as "bias" and "hallucination" will not satisfy an auditor who has seen agents.
Impact assessment. Has an AI system impact assessment considered the people affected by the agent's actions, such as a customer whose payment is held or whose claim is routed?
Human oversight. Where the documentation says a person approves, the auditor will sample approvals and look at who approved, when and how often they disagreed.
Change control. A change to an agent's brief, sources or connected tools changes its behaviour. Auditors will ask whether those changes go through the same review as code.
How do you prepare evidence that survives sampling?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| AI systems identified and in scope | Inventory listing each agent, its capabilities and owner | Inventory with version history |
| Risks assessed and treated | Agent-specific risk entries with treatments linked to controls | Risk register entries per agent |
| Impacts on people assessed | Impact assessment for each agent that affects individuals | Signed assessments, reviewed on change |
| Controls selected and justified | Statement of which annex controls apply and why | Statement of applicability |
| Oversight operates | Held actions approved by named people | Approval records with identity and time |
| Performance monitored | Agent capabilities tested against cases before release and on schedule | Test results and trend reports |
| Internal audit and management review done | Internal audit of agents; management review of results | Audit report; review minutes and actions |
Internal audit is the dress rehearsal. Our guide to an ISO/IEC 42001 internal audit of AI agents covers what to sample before the certification body does.
A useful test: pick any agent at random and see whether you can produce, within minutes, its owner, its permitted actions, its last test result, its last change and three recent approvals. If you can, stage 2 will go well.
What will the auditor ask on the day?
- Show us the inventory. Choose one agent and walk us through it.
- Who owns this agent, and who may change its instructions?
- What risks did you identify for it, and which controls treat them?
- Show us three actions the agent took and the record of each.
- Where does a person approve, and how often do they reject?
- What happened the last time this agent failed a test?
What does the audit not cover?
The audit tests your management system, not each agent's correctness on each case. A certificate does not mean an auditor checked your refund agent's answers. Our answer to whether agent certification is the same as ISO certification explains the gap, and our guide to what it means to certify an agent covers the case-level evidence. The audit also does not assess compliance with law, such as the EU AI Act or data protection, though it will look at how you identify legal requirements. Some firms weigh it against the NIST AI RMF; see whether to follow the NIST AI RMF or ISO/IEC 42001.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
How long before stage 2 should the management system be running?
Long enough to have records: at least one internal audit, one management review and a period of operating evidence for the agents in scope. Auditors cannot sample processes that have not yet run.
Can we exclude agents from the first certification scope?
You can set scope as you choose, but excluding the AI that customers care most about weakens the certificate's value. A better route is to include them and prepare properly.
What causes major nonconformities in agent deployments?
Common causes are agents missing from the inventory, oversight that exists only on paper, and no evidence of testing after changes. Each shows the system is not operating as documented.