ISO/IEC 42001 requires an AI management system: a defined scope, an AI policy, named roles, AI risk and impact assessments, controls chosen to treat what those find, monitoring, internal audit, management review and improvement. For an agent platform, each requirement must reach what agents add: tool connections, actions on customers' behalf, model providers and briefs that change behaviour.
What does ISO/IEC 42001 require, in plain words?
ISO/IEC 42001:2023 follows the same high-level structure as other management system standards, so firms that hold ISO/IEC 27001 will recognise the shape. Its main requirements are:
- Context and scope. Understand internal and external issues, the expectations of interested parties, and your role, for instance as developer, provider or user of AI. Define what the management system covers.
- Leadership. Top management sets an AI policy, assigns roles and responsibilities, and shows commitment.
- Planning. Assess AI risks, decide how to treat them, assess the impact of AI systems on individuals, groups and society, and set objectives.
- Support. Provide resources and competent people, raise awareness, communicate, and keep documented information.
- Operation. Run the planned processes, including risk treatment and impact assessment, across the AI system lifecycle.
- Performance evaluation. Monitor and measure, run internal audits, and hold management reviews.
- Improvement. Fix nonconformities, take corrective action and improve continually.
An annex lists reference controls, grouped by theme: AI policies, internal organisation, resources for AI systems, impact assessment, the AI system lifecycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. You decide which apply and justify any you leave out. A further annex gives implementation guidance. Our explainer on what ISO/IEC 42001 is covers the background.
Who does it apply to?
It is voluntary. Any organisation that develops, provides or uses AI may adopt it and seek certification. Agent platform vendors adopt it to show buyers their AI is governed; regulated deployers adopt it to show supervisors the same. Our answer to whether you need ISO/IEC 42001 to deploy agents is no, but the discipline is useful whether or not you certify.
What does it mean when the AI system is an agent that acts?
The standard is written for AI systems generally. Agents add four things that the management system must reach explicitly.
Resources include tools and permissions. The annex's controls on resources cover data, tooling, computing and people. For an agent, the tools it can call and the permissions behind them are the most consequential resources of all. Document them per agent and per capability.
The lifecycle includes the brief. An agent's brief, sources and bounds change its behaviour without any change to the model. Lifecycle controls on design, verification, deployment and monitoring must treat a brief change like a release.
Impact assessment includes actions. An impact assessment for a chatbot considers what it says. For an agent, it must also consider what it does: a held payment, a closed ticket, a declined claim, a changed limit.
Third parties include the model provider. The model is usually supplied by someone else and can change. Controls on third-party relationships must cover model updates, data handling and what happens when the provider's model behaves differently.
How do you meet the requirements on an agent platform?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Scope and context | Scope names the agent runtime, tool connections and agents in use | Scope statement |
| AI policy | Policy sets principles for agent authority: per capability, earned on evidence, expiring | Approved policy |
| Roles | Each agent has a named owner and named approvers for held actions | Role assignments per agent |
| AI risk assessment | Agent-specific risks: false instructions, excess permissions, injected text, repeated actions | Risk register entries with treatments |
| AI system impact assessment | Impact of each agent's actions on the people affected | Signed impact assessments |
| Lifecycle controls | Briefs, sources and tool changes reviewed and tested before release | Change records and test results |
| Third-party controls | Model provider changes monitored; agents re-tested after changes | Supplier reviews and re-test records |
| Monitoring and measurement | Each capability tested against real cases on a schedule | Test results and trends |
| Internal audit and review | Agents sampled in internal audit; results reviewed by management | Audit reports and review minutes |
Security controls sit alongside this. If you run both management systems, our comparison of ISO/IEC 42001 and ISO/IEC 27001 shows where they share processes, and our piece on ISO/IEC 27001 vs SOC 2 for agent platforms covers the security assurance buyers ask for.
What will an auditor ask?
- What is in scope, and are all agents in use inside it?
- Show us the AI policy and how it governs what agents may do.
- For this agent, show us its owner, risks, impact assessment and controls.
- Which annex controls did you exclude, and why?
- How do you control changes to an agent's brief and tools?
- What did the last management review decide about agents?
What does the standard not cover?
It does not tell you what an agent may do in a specific case; it requires you to have a system for deciding and checking that. It is not a law and does not by itself meet the EU AI Act's requirements, though it supports many of them. It does not cover information security in full. For a voluntary framework with a different shape, see whether to follow the NIST AI RMF or ISO/IEC 42001. For case-level proof of an agent's behaviour, see our guide to what it means to certify an agent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does ISO/IEC 42001 apply if we only use agents built by someone else?
Yes, if you choose to adopt it. Your role is a user or deployer, and your risk and impact assessments will focus on how you use the agents and what they do in your operation.
How many annex controls must an agent platform implement?
There is no fixed number. You choose the controls your risks require and justify exclusions. For agent platforms, few of the controls are likely to be irrelevant.
Can one management system cover several agent products?
Yes. Scope can include several products and teams. Each agent should still have its own inventory entry, owner, risk entries and evidence.