ISO/IEC 42001, AI management system
Published on 18 December 2023, ISO/IEC 42001 specifies the requirements for establishing, implementing, maintaining and continually improving an AI management system. It is the certifiable management wrapper around everything else in this ledger: it does not tell you how to authorise an agent, it tells you to decide, document and review how you do.
The verdict
Verified
The document exists. The ledger fetched it at its publisher and quotes it.
Key facts
What the sources say
- Record ID
- AAL-2026-0027
- Kind
- Standard or protocol
- Jurisdiction
- Global
- Last verified
- Added
- The standard states that it specifies the requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI management system.
- Its full title is Information technology, Artificial intelligence, Management system, and the edition checked is the first.
- It is a management system standard, so organisations are certified against their own documented system rather than against any agent control.
- It names no agent specific control, which is why it pairs with rather than replaces the technical rows in this ledger.
Dimension by dimension
2 dimensions, each one stated, silent or open
Accountability, Authorization. Stated means the document you can open below says it; silent means the ledger read the document and it does not.
- AccountabilityStated
- The standard puts named roles, objectives and review cycles around AI use, which is how an organisation stays answerable as systems change.IEC Webstore, ISO/IEC 42001:2023, primary source, 18 December 2023.
- AuthorizationSilent
- No clause addresses how an agent obtains or presents authority; that is left to the controls the organisation chooses.IEC Webstore, ISO/IEC 42001:2023, primary source, 18 December 2023.
What it changes
For a team deploying an agent
If a buyer asks whether your agent programme is governed, this certificate is the shortest credible answer. It proves you run a system, not that the agent is safe, so do not let it stand in for the technical evidence: the authorization, logging and stop path still have to exist underneath it.
Sources
What this record was verified against
- IEC Webstore, ISO/IEC 42001:2023Primary · 18 December 2023
Related
Records that sit beside this one
IMDA Model AI Governance Framework for Agentic AI
Singapore · verified 15 September 2026
The framework opens by saying there is no consensus on what defines an AI agent, but that agents usually possess some degree of independent planning, decision making and action taking over multiple steps to achieve a user defined goal.
EU AI Act Article 26, deployer obligations
European Union · verified 15 September 2026
Deployers must take appropriate technical and organisational measures to ensure they use high risk systems in accordance with the instructions for use.
Does a spending limit belong to the agent or to the principal
Global · verified 15 September 2026
The Visa Trusted Agent Protocol addresses recognising an approved agent and its intent, and does not itself carry a spending ceiling.
How does a sub agent's authority attenuate
Global · verified 15 September 2026
RFC 8693 lets a token record that one party is acting for another, but does not require the exchanged token to be narrower.
Can an agent hold a credential of its own
Global · verified 15 September 2026
NIST SP 800-63-4 states that for that publication, person refers only to natural persons.
Who is liable when a delegated agent exceeds its mandate
Global · verified 15 September 2026
The EU AI Act allocates duties to providers and deployers, and does not address an agent acting beyond its instructions.
Cite this record
Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0027 is permanent and is never reused.
- In a sentence
- According to the GAGE Agent Authority Ledger (as of 15 September 2026), iso/iec 42001, ai management system.
- APA
- GAGE (Global Academy of Generative-AI Education). (2026). ISO/IEC 42001, AI management system. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0027-iso-iec-42001-ai-management-system
- MLA
- "ISO/IEC 42001, AI management system." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0027-iso-iec-42001-ai-management-system.
- Chicago
- GAGE (Global Academy of Generative-AI Education). "ISO/IEC 42001, AI management system." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0027-iso-iec-42001-ai-management-system.
- Permalink
- https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0027-iso-iec-42001-ai-management-system
Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.
Back to the full ledger, or every record for Global and every standard or protocol record.
GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.