Compliance · ISO/IEC 42001:2023 · Agentic AI

ISO 42001 certifies how you govern AI. For agents, you still have to show what they did.

ISO/IEC 42001:2023, published in 2023, is the first international management-system standard for AI. A surveillance audit still asks whether the controls actually operated, and for agents that act on real systems, that answer lives in a record.

§ 01 The standard

A management system, and the controls it selects.

The controls are principle-based, not prescriptive technical checklists. That is a strength for governance and a gap at audit time: a control that says the life cycle must be managed and logged does not, by itself, produce the log.

You can certify the management system in a document. You cannot certify an agent's action without the record of it.

§ 02 The evidence

What a surveillance audit asks an agent program to show.

The substrate makes operational evidence a property of the action.

What an auditor asks you to evidence

Without the substrate

With Subnet345

That operational controls on your AI systems were actually applied, not merely documented

Asserted in the Statement of Applicability, evidenced by sampling

The action, the policy version, and the outcome, on the record

Which agent acted, on which data, under whose authority

Reconstructed from scattered application logs

Attributed at the moment of action

How AI-system incidents and refusals were captured and handled

Captured unevenly, if at all

Every refusal recorded with the exact rule and version that fired

Where the operating record lives when a surveillance audit asks for it

Vendor-managed, with caveats

Inside your boundary, on your retention schedule

Hand the examiner evidence in a form they can read

A bespoke log export, assembled by hand

Evidence exports in a format your examiner can read, run by your operator inside your perimeter

This material is informational, not legal, regulatory, or certification advice. Subnet345 does not hold ISO 42001 certification and does not certify your organization. The substrate produces the record; it does not by itself make a program compliant or certifiable. Regulatory mapping reviewed: August 2026.

§ 03 Questions

ISO 42001 and agentic AI, answered.

Is Subnet345 ISO 42001 certified?

No. Subnet345 does not hold ISO 42001 certification, and we do not certify your organization; certification is issued by accredited certification bodies, not by a vendor. What the substrate does is produce the operational evidence your AI management system relies on: the attributed, tamper-evident record of what your AI agents actually did. It supports your program's evidence, it is not a certificate and it is not a substitute for one.

Does producing this record make our program compliant?

No. This material is informational, not legal, regulatory, or certification advice. The substrate produces the record; it does not by itself align a program to ISO 42001, select your controls, or make you certifiable. Assess your specific posture with qualified counsel, your internal AI governance function, and an accredited certification body.

Can you evidence the controls operated, action by action?

Request a demo →All frameworks →