TL;DR
- ISO/IEC 42001:2023 is the only certifiable AI governance standard. That is its single most important property.
- It does not mention non-human identity. It does not have to: an AI management system that cannot say which agent did what, under whose authority, fails several of its clauses on ordinary reading.
- The clauses where NHI evidence is actually demanded are 6.1 (risk), 8.1 (operational control), 8.4 (impact assessment), 9.1 (monitoring), and 10 (improvement), plus Annex A controls on lifecycle, logging, and accountability.
- Certification does not equal EU AI Act compliance, and no accredited body claims otherwise. It builds most of the evidence machinery the Act will require, which is a different and more useful statement.
- The failure mode we see most: organisations scope 42001 around models and omit the agents and integrations that actually touch production data.
Why 42001 is the right anchor for agent governance
Most AI governance material is guidance. ISO/IEC 42001 is a management system standard, which means it has the structure that makes governance auditable: a defined scope, documented risk assessment, operational controls, measurable objectives, internal audit, management review, and corrective action. An accredited certification body will ask for evidence of each.
That structure matters more than the content for one reason. When an agent takes a consequential action, the question that follows is always the same: who authorised this, on what basis, and can you show me? A management system is the only artefact that answers it repeatedly rather than once.
Status
Ratified, certifiable. ISO/IEC 42001:2023, published 2023. Certification is performed by accredited bodies against a documented AI management system. This places it in a different tier from the CSA and OWASP frameworks, which are authoritative guidance but not certifiable. See the standards tracker.
Where non-human identity shows up, clause by clause
The mapping below is our practical reading, not text from the standard. 42001 does not name NHIs. We are describing where an auditor's questions land in practice.
| Clause | Requirement in substance | NHI evidence an auditor will look for |
|---|---|---|
| 4 Context and scope | Define the boundary of the AI management system | Whether agents, copilots, and AI-driven integrations are inside the scope statement. This is where most scoping failures originate |
| 5 Leadership and roles | Assign accountability | A named accountable owner for every AI agent. Not a team mailbox, a person |
| 6.1 Risk and opportunity | Identify and treat AI risks | Over-privileged agents, standing credentials, delegation chains, and prompt-injection-driven authority escalation appearing in the risk register at all |
| 6.2 Objectives | Measurable AI objectives | Metrics such as percentage of agents with bounded credential lifetime, or time from revocation to inability to act |
| 7.5 Documented information | Control of records | Agent inventory maintained as a controlled record with version history |
| 8.1 Operational planning and control | Control AI processes | Provisioning, authorization, rotation, and decommissioning for agent identities, documented and followed |
| 8.4 Impact assessment | Assess impacts on individuals and society | Assessments that consider what an agent can reach, not only what a model outputs |
| 9.1 Monitoring and measurement | Monitor performance | Logs that attribute actions to a specific agent and the delegating human. This is the hardest evidence to retrofit |
| 9.2 / 9.3 Internal audit, management review | Independent review | Access reviews that include non-human identities. Most organisations review humans only |
| 10 Improvement | Nonconformity and corrective action | A tested revocation path, and evidence it has been exercised |
The five ways NHI breaks a 42001 audit
- Scope written around models, not agents. The AI management system covers "AI systems developed by the organisation" and silently excludes the third-party copilot with write access to the CRM. This is the most common and most consequential error, and it is made at the very start.
- No agent inventory. Clause 7.5 wants controlled documented information. A spreadsheet last updated at project kickoff is not a controlled record.
- Ownership recorded as a team, not a person. Clause 5 is about accountability. "Platform Engineering" cannot be accountable; a named individual can.
- Logs that cannot reconstruct a delegation chain. Clause 9.1 evidence collapses if the log shows only the service principal. If your logs cannot show that a specific agent acted for a specific human under a specific consent, you cannot evidence oversight. See agent identity standards for the protocol layer that makes this possible.
- Untested revocation. Clause 10 wants corrective action to work. "We would disable the account" is an assertion. Measure the time from revocation to inability to act, or you do not know it.
Relationship to the EU AI Act
Certification to ISO/IEC 42001 does not equal EU AI Act compliance, and the reason is more specific than most summaries give. ISO/IEC 42001 is not a harmonised standard under the AI Act, so it confers no Article 40 presumption of conformity. CEN-CENELEC JTC 21 assessed it against the Article 17 quality management requirement, found it did not align, and drafted a separate European standard, prEN 18286, whose annex maps its requirements onto ISO/IEC 42001 Annex A controls. A 42001 management system therefore gives you reusable structure and the governance evidence buyers ask for today, and not a conformity route. The standard and the regulation overlap substantially on risk classification, transparency, accountability structures, and human oversight, and the evidence a 42001 management system produces is largely the evidence the Act's technical documentation and record-keeping obligations demand. That is a strong practical argument for 42001 as the operating spine, and a weak one for treating it as a compliance shortcut.
The Digital Omnibus deferred Annex III high-risk obligations to 2 December 2027. That is additional preparation time, and the co-legislators were explicit that preparation should already be under way. An organisation that builds the management system now arrives at the deferred deadline with evidence rather than intentions.
Where to start
- Write the scope statement last, not first. Inventory what AI is actually running, including agents you did not build, then scope. Scoping first guarantees you scope around what you already know.
- Build the agent inventory as a controlled record with owner, purpose, data reach, credential type, and expiry.
- Fix delegation logging before the stage 1 audit, not after. It is the one gap that cannot be closed quickly.
- Run a revocation drill and record the result. Cheap, fast, and it produces clause 10 evidence you cannot otherwise fabricate.
- Map existing ISO/IEC 27001 controls across if you hold that certification. The management system machinery is reusable; the AI-specific risk work is not.
Frequently asked questions
Does ISO/IEC 42001 cover non-human identity?
Not by name. ISO/IEC 42001 does not use the term non-human identity. But an AI management system that cannot show which agent took an action, under whose authority, and with what scope will struggle with clauses 6.1, 8.1, 9.1 and 10 on ordinary reading, and with the Annex A controls on lifecycle and logging. In practice NHI evidence is where a substantial part of a 42001 audit lands when agents are in scope.
Does ISO/IEC 42001 certification make us EU AI Act compliant?
No, and no accredited certification body claims it does. The two overlap substantially on risk classification, transparency, accountability and human oversight, and a 42001 management system produces much of the evidence the Act requires. But they are different instruments with different scopes and conformity routes. Treat 42001 as the operating spine, not as a compliance shortcut.
What is the most common ISO 42001 scoping mistake with AI agents?
Writing the scope around AI systems the organisation develops, which silently excludes third-party agents and copilots that have write access to production systems. Those are usually the highest-risk AI in the estate. The fix is to inventory what is actually running before drafting the scope statement, rather than after.
Is ISO/IEC 42001 certifiable?
Yes. It is a management system standard published in 2023 and certification is performed by accredited bodies. That distinguishes it from the CSA Agentic Trust Framework, the OWASP guidance and the NIST AI RMF, all of which are authoritative but not certifiable.
We already hold ISO/IEC 27001. How much of it carries over?
The management system machinery carries over almost entirely: scope definition, risk methodology, documented information control, internal audit, management review and corrective action. What does not carry over is the AI-specific risk work, the impact assessment on individuals and society, and the agent-level evidence in clauses 8 and 9. Organisations with 27001 typically find the structural work done and the substantive work still ahead.
Implementing ISO/IEC 42001?
Our sister site publishes the documentation toolkit (23 clause-mapped AIMS documents and all 38 Annex A controls, from $199) and a free 18-question gap assessment that scores which documents you already have.
Implementing ISO/IEC 42001 with agents in scope?
HumanAudit runs ISO/IEC 42001 implementation and readiness work where non-human and agent identity is in scope. A 20-minute call will tell you whether your NHI evidence would survive a stage 2 audit.