What is ISO/IEC 42001?

ISO/IEC 42001:2023 is the international standard for an AI management system: the policies, roles, processes and controls an organisation uses to develop, provide or use AI responsibly. It is certifiable, so an accredited auditor can confirm an organisation meets it. It certifies how the organisation manages AI, not how any single AI agent performs.

Why does ISO/IEC 42001 matter for AI agents?

Firms deploying agents need a way to show customers, partners and supervisors that their use of AI is governed, not improvised. ISO/IEC 42001 gives a recognised structure for that, in the same family as ISO/IEC 27001 for information security. Many organisations already run 27001, so 42001 fits processes they know.

It also gives a common language for procurement. A buyer can ask whether a vendor's AI management system is certified to 42001, and get a yes or no backed by an audit. Whether you need ISO/IEC 42001 to deploy AI agents addresses when that is worth pursuing.

How does it work in practice?

Like other ISO management system standards, it follows a plan, do, check, act cycle:

• Context and scope: which AI systems and activities the management system covers.
• Leadership: an AI policy, assigned roles and management commitment.
• Planning: AI risk assessment and treatment, and AI system impact assessment.
• Support: resources, competence, awareness and documented information.
• Operation: controls over the AI system life cycle, data and third parties.
• Performance evaluation: monitoring, internal audit and management review.
• Improvement: handling nonconformities and continual improvement.

Risk assessment is central; how it applies to agents is covered in ISO/IEC 42001 AI risk assessment for AI agents. ISO/IEC 23894:2023 provides further guidance on AI risk management.

What does an example look like?

An insurer decides to certify to ISO/IEC 42001, scoping its management system to the AI agents used in claims and customer service. It writes an AI policy, names an owner for each agent, runs risk and impact assessments for each, sets controls for change, monitoring and supplier management, and audits itself before the external audit. The certificate shows the insurer manages its AI systematically. It does not show that the claims agent's settlement drafts are accurate; that evidence comes from testing the agent on the insurer's own claims.

How is ISO/IEC 42001 different from the NIST AI RMF?

The NIST AI Risk Management Framework is voluntary guidance from the US National Institute of Standards and Technology, organised around four functions: Govern, Map, Measure and Manage. It is not certifiable. ISO/IEC 42001 is a management system standard that can be audited and certified. Many organisations use both: the NIST framework to shape how they think about AI risk, and 42001 to show that a management system is in place. NIST AI RMF vs ISO/IEC 42001 for AI agents compares them, and whether you should follow the NIST AI RMF or ISO/IEC 42001 helps you choose.

It also differs from certifying an individual agent. A 42001 certificate covers the organisation's management system. An agent certificate covers one agent, one capability, one customer, on that customer's cases, until it lapses.

Which terms sit close to it?

ISO/IEC 27001, ISO/IEC 23894, AI management system and AI impact assessment. For the wider regulatory picture, see our guide to AI agent regulation.

Where Pryme fits

ISO/IEC 42001 asks for controls over the AI life cycle and evidence that they work. Attest certifications, the minimum chain and the append-only verdict record produce that evidence per agent and per capability, which an organisation can use within its own management system.