TL;DR
- ISO 42001 for AI agents means bringing every agent into your AI management system (AIMS): in scope, owned, risk-assessed, controlled and backed by evidence.
- The standard governs “AI systems” and never names agents. Scoping them in is your decision under clause 4.3.
- Agents strain a model-era AIMS because they act, change after release and borrow access.
- Clauses 9 and 10 matter most for agents, since they need proof of what agents actually did.
- Auditors ask for an agent inventory, a Statement of Applicability, impact assessments, runtime logs and corrective actions.
- A certificate covers your management system, not an agent, and doesn’t prove EU AI Act conformity.
Picture a company in its first ISO 42001 certification audit (a composite scenario). Its scope lists two AI systems: a credit scoring model and a document classifier. Then the auditor asks about the support agent that issues refunds and the coding agent with write access to production. Neither is in scope. Nobody is sure who owns them.
This is how ISO 42001 for AI agents usually goes wrong. Teams scope the standard around models. Agents arrive later, built by other teams, and stay outside the governance program until someone asks.
What is ISO 42001 for AI agents?
ISO 42001 for AI agents means bringing agents into your AI management system (AIMS): naming them in scope, assigning owners, assessing their risks and impacts, selecting Annex A controls for them and keeping evidence that those controls work at runtime. The standard covers “AI systems” and never mentions agents by name.
ISO/IEC 42001:2023 is, according to ISO, the first global standard for AI management systems, and independent certification bodies certify organizations against it. Clauses 4 to 10 set the requirements, in the same structure as other ISO management system standards such as ISO 27001. Annex A lists 38 reference controls across nine areas, A.2 to A.10, and you justify which apply in a Statement of Applicability.
Does ISO 42001 apply to AI agents?
Yes. An agent is an AI system, so the standard applies once the agent is inside your AIMS scope. Clause 4.3 makes scope your decision, and clause 4.1 asks you to work out your role for each AI system. You might build one agent, buy another and only use a third, and the applicable controls shift with each role.
Why agents strain an AI management system
Most AIMS programs were designed around models. Agents differ in three ways.
They act. An agent calls tools, writes to systems and triggers other agents, so its risks are actions, not predictions.
They change after release. A new prompt, model or tool changes behavior without retraining.
They borrow access. Many agents run on a user’s or service account’s permissions, so identity, not design, sets what they can do.
And there will be many. Gartner predicts that by 2028 an average global Fortune 500 enterprise will have over 150,000 agents in use, up from fewer than 15 in 2025. A spreadsheet won’t keep up.
How ISO 42001 clauses apply to AI agents
Every clause applies; what changes is the evidence. The table is our interpretation, since the standard doesn’t mention agents.
| Clause | What it requires | What it means for agents |
| 4. Context | Issues, interested parties, your role for each AI system, AIMS scope (4.3) | List every agent, decide which are in scope and record why any are left out |
| 5. Leadership | AI policy, roles and responsibilities | Name a business owner and a technical owner for each agent, plus who can switch it off |
| 6. Planning | AI risk assessment (6.1.2), risk treatment and Statement of Applicability (6.1.3), AI system impact assessment (6.1.4) | Assess tool access, autonomy and who’s affected; select Annex A controls per agent or agent class |
| 7. Support | Resources, competence, awareness, documented information | Train builders and approvers on where human approval sits; document each agent’s tools and data |
| 8. Operation | Run risk assessments (8.2), treatments (8.3) and impact assessments (8.4) in practice | Reassess when an agent gets a new tool, model or permission, not just once a year |
| 9. Performance evaluation | Monitoring (9.1), internal audit (9.2), management review (9.3) | Track agent behavior, blocked actions and incidents, and take them to management review |
| 10. Improvement | Continual improvement, nonconformity and corrective action (10.2) | Treat an agent acting outside policy as a nonconformity, with the root cause and fix on record |
Clauses 9 and 10 get the least attention in agent guidance, yet matter most. Clause 9 proves controls worked. Clause 10 turns an agent that emailed the wrong customer into a recorded nonconformity. Both need to know what agents actually did, which no policy document can tell you.
The Annex A controls that matter most for agents
All nine Annex A areas can apply. For agents, four carry most of the weight.
A.5, assessing impacts of AI systems. Alongside the risk assessment, the standard asks for an AI system impact assessment: what deploying the system could mean for individuals, groups and society. An agent that approves refunds, screens candidates or answers patients needs one.
A.6, AI system life cycle. This runs from design through testing, deployment and monitoring. A.6.2.8, recording of event logs, is the control auditors return to, because tool calls are the agent’s real behavior.
A.9, use of AI systems. It covers responsible use and intended use (A.9.4). For an agent, write intended use as the tools and actions it may take, and the points where a human must approve.
A.10, third-party and customer relationships. Agents depend on model providers, tool vendors and MCP servers your team didn’t build. Each one is a supplier your AIMS should know about.
Agent risks your ISO 42001 risk assessment should cover
The standard doesn’t list agent-specific risks. These six belong in the register.
Unregistered agents. Agents built by business teams or bundled into SaaS tools. Treat through clause 4.3 scope and an inventory.
Excessive permissions. Agents that act on a user’s identity inherit more access than they need. Treat through A.9 and least privilege.
Prompt injection that reaches actions. Hidden instructions in a document can steer an agent into a real action. Treat through A.6 testing and runtime checks.
Third-party tools. When an API or MCP server changes, the agent changes too. Treat through A.10.
Cascading failures. One agent’s wrong output becomes another’s input. Assess the whole chain.
Drift after release. New prompts, models and tools change behavior quietly. Treat through clause 8 reassessment and A.6 change records.
Most of these treatments share one need: seeing agent behavior as it happens.
What evidence do auditors ask for with AI agents?
Auditors want proof that your AIMS covers agents and its controls operate. Expect requests for:
- An agent inventory with each agent’s owner, purpose, tools, data and permissions.
- A Statement of Applicability that covers agent use cases and justifies every excluded control.
- Dated risk and impact assessments for each agent or agent class.
- Runtime logs of inputs, tool calls, outputs and policy decisions.
- Evaluation and red-team results before release, plus monitoring after.
- Change history for prompts, models, tools and permissions.
- Management review records and corrective actions for agent incidents.
Items 1 to 3 are documents you maintain. Items 4 to 7 are records your agents generate daily, and that’s where most programs fall short.
Is your agent evidence audit-ready? Score your identity, policy and oversight controls in a few minutes with the free Agent Governance Maturity Assessment, and see which evidence gap to close before your ISO 42001 audit. Take the assessment →
What an ISO 42001 certificate does and doesn’t prove
A certificate covers your management system within a stated scope, not an agent or a product, so there’s no such thing as an “ISO 42001 certified agent.” Auditors themselves work to ISO/IEC 42006:2025, the requirements for bodies that audit and certify AI management systems.
ISO 42001 vs ISO 27001 and the EU AI Act
| ISO 27001 | ISO 42001 | EU AI Act | |
| What it is | Certifiable standard | Certifiable standard | EU regulation |
| Focus | Information security | AI management, including impacts on people | AI systems by risk category |
| Mandatory | No | No | Yes, for systems in scope |
| What it means for agents | Secures the data and systems agents touch | Governs how agents are scoped, owned, assessed and monitored | Sets obligations such as transparency and high-risk requirements |
If you hold ISO 27001, the management structure carries over; the new work is AI risk, impact assessment and Annex A.
The EU AI Act needs more care. Presumption of conformity under the Act comes from harmonised standards cited in the EU’s Official Journal, and the European Commission says ISO/IEC 42001 doesn’t align with the Act’s quality management requirements. An ISO 42001 certificate is strong evidence of governance, not proof of conformity. Most Article 50 transparency duties apply from August 2, 2026, and after the AI Omnibus, Annex III high-risk obligations apply from December 2, 2027.
Where ISO 42001 stops for AI agents
ISO 42001 tells you to define controls, operate them and prove they work. It doesn’t enforce anything itself.
For models, that gap is manageable. For agents, the decisions that matter happen at runtime, one tool call at a time. Is this agent in the inventory? May it call this API? Is it sending customer data somewhere new?
Four of the seven evidence items above come from that moment. When agents call models and tools directly, each team logs differently or not at all, and the AIMS rests on screenshots gathered before the audit.
What closes the gap is one control point in the call path: every agent identified, every call checked against policy, every decision traced the same way. That’s what Lyzr Opencontroller is built for.
How Lyzr Opencontroller produces ISO 42001 evidence for agents
Opencontroller is a control plane for AI agents: find every AI agent, give each one an owner, and control what it can call, spend and touch. It sits between your agents and everything they call, so policy applies before a call lands. Existing frameworks and runtimes stay as they are, and it can run in your VPC, on-premises or air-gapped.
Lyzr’s architecture describes Opencontroller as a system of record, policy and evidence. For ISO 42001, that turns agent activity into the records auditors ask for.
| What your AIMS needs | Where ISO 42001 asks for it | How Opencontroller supplies it |
| A complete agent inventory with owners | Clauses 4.3 and 5.3, A.4 | Finds the agents running across your organization and gives each one an owner |
| Intended use enforced, not just written down | A.9 | Applies identity and policy to every call; model and tool calls go only to destinations you authorize |
| Event logs for agent actions | A.6.2.8 | Traces every action to its owner and cost, with OpenTelemetry traces exported to tools you already run |
| Third-party models and tools under one policy | A.10 | One policy model across any cloud, framework and model |
| Inputs for monitoring and corrective action | Clauses 9.1 and 10.2 | Calls held for approval or redacted by policy show where controls were tested and held |
Opencontroller doesn’t certify you, write your Statement of Applicability or run your impact assessments. It supplies the runtime evidence your management system can’t produce on paper.
Back to the audit. With agent traffic routed through Opencontroller, the refund agent and the coding agent appear in the inventory with owners, their tools match their intended use, and every action is traced. The auditor’s question takes minutes, not weeks.
Book a demo to see how Opencontroller gives your AI management system evidence for every agent.
Frequently asked questions
It means bringing AI agents into an ISO/IEC 42001 AI management system: naming them in scope, assigning owners, assessing risks and impacts, applying the relevant Annex A controls and keeping runtime evidence that those controls actually work.
Yes. ISO 42001 applies to AI systems, and agents are AI systems. The standard doesn’t name agents, so whether each agent sits inside your AIMS scope is your decision under clause 4.3. Auditors will ask about agents left out.
No. ISO 42001 certifies an organization’s AI management system within a stated scope, not an agent or a product. Including agents in that scope shows they’re governed, but the certificate belongs to the management system.
Any of the nine areas can apply, chosen in your Statement of Applicability. For agents, the key ones are A.5 impact assessment, A.6 life cycle and event logs, A.9 use of AI systems and A.10 third-party relationships.
Expect to show an agent inventory with owners, a Statement of Applicability, risk and impact assessments, runtime logs of tool calls, evaluation results, change history, and management review records with corrective actions for agent incidents.
No. Presumption of conformity under the EU AI Act comes from harmonised standards, and the European Commission says ISO 42001 doesn’t align with the Act’s quality management requirements. Certification supports AI Act work but isn’t proof of conformity.
Book A Demo: Click Here
Join our Slack: Click Here
Link to our GitHub: Click Here
Got a use case in mind?
8 weeks from use case to agents running in production.
Platform, people and FDEs, all in. Bring your environment. We'll co-build and stay until it's live.
Talk to UsFree resource
101 AI Agents Use Cases
100+ production-ready AI agent use cases across Marketing, Sales, HR, Banking, Insurance, Operations and a lot more
Download now
