- Home
- Compliance
- ISO 42001 for AI Agents
Turn agent activity into ISO 42001 evidence
Prefactor observes every agent action, evaluates quality and risk, and acts on policy at runtime — generating the evidence ISO 42001 actually asks for, from real production data.
ISO/IEC 42001 AI Management System, issued by International Organization for Standardization, applies to any organization developing or using ai systems. This page covers what affects AI agent teams specifically and how to map controls to it.
Source: official ISO 42001 reference. This page is practical guidance — confirm interpretation with your counsel.
Any organisation that develops, provides or uses AI products or services, regardless of size or sector.
What it requiresA continuous, documented AI risk process
How Prefactor addresses itPer-agent risk scoring plus continuous evals and drift detection on live traffic make this ongoing and evidenced, not a point-in-time review.
What it requiresAssess impacts on individuals and society
How Prefactor addresses itEval suites score output quality, groundedness and harm on real traffic; trace data is the evidence of actual impact.
What it requiresGovernance of data quality and provenance
How Prefactor addresses itEvery input and output is captured as classified trace data, with PII detection and per-run provenance.
What it requiresVerify performance before and after deployment
How Prefactor addresses itEval suites and regression gates before shipping; versioned eval history proves performance over time.
What it requiresMonitor AI performance in operation
How Prefactor addresses itContinuous monitoring with drift and anomaly alerting on quality, cost and behaviour after deployment.
What it requiresEffective human control of AI
How Prefactor addresses itRuntime guardrails route high-risk or low-confidence actions to a human before they execute; every intervention is logged.
Frequently asked questions
Does using a 'compliant' provider make us compliant?
Can Prefactor make us compliant?
Key provisions for AI agents
- AI management system requirements
- Annex A controls specifically for AI
- Risk-based approach to AI governance
- Lifecycle controls for AI systems
- Documentation and continual improvement
Who is affected
Any organization developing or using AI systems
Evidence collection
Auditors and reviewers typically expect:
- Continuous, dated evidence — not point-in-time snapshots
- Override and intervention records — proof humans actually retained control
- Eval results tied to specific agent versions
- Risk decisions tied to changes
- Incident records, even minor ones
- Plain-language documentation
Common gaps in ISO 42001 for AI agents
1. Logs not tamper-evident — application database isn't audit evidence.
2. Human oversight is theoretical — system allows override but nobody uses it.
3. Post-market monitoring is reactive — only investigated when something breaks.
4. No change management — prompts edited in production with no record.
5. Retrieval corpus not in scope of data governance — only training data is considered.
Implementation timeline
30 days: Inventory agents in scope. Begin technical documentation. Enable comprehensive tamper-evident logging.
90 days: Operate risk management. Stand up human oversight. Establish post-market monitoring cadence. First self-assessment.
180 days: Complete documentation. Pre-conformity review. Incident reporting workflow. Full readiness.