AI Governance Institute
← News
Research2026-10-18

BCS ISO 42001 Certification Shows What Auditable Agentic AI Governance Looks Like

What happened

BCS announced it has received ISO/IEC 42001:2023 - Artificial Intelligence Management System certification. An independent audit by BSI Group assessed governance practices across six domains: policy frameworks, accountability structures, pre-build risk assessment, testing procedures, operational controls, and human oversight. The certification was notable because it explicitly covered agentic AI governance, not just general AI system management. According to the BCS announcement, auditors evaluated whether governance procedures operated in daily practice, not only in written policy documents. The finding confirms that evidence-linking across the AI system lifecycle, connecting policies to operational controls to documented human decisions, is the core audit test organizations must pass.

Why it matters

  • ·The BSI audit's focus on daily practice over policy documents sets a concrete evidence standard. Compliance teams must show that controls actually run, not just that they exist on paper. Organizations preparing for ISO/IEC 42001:2023 - Artificial Intelligence Management System certification should expect the same scrutiny.
  • ·The explicit inclusion of agentic AI in scope signals that auditors and certification bodies now treat autonomous AI systems as a distinct governance category. Enterprises running AI agents without a documented oversight framework face an emerging gap against this emerging audit baseline.
  • ·Regulators and procurement bodies increasingly treat ISO 42001 certification as evidence of governance maturity, as seen in recent EU and financial sector guidance. Organizations without a comparable program may find themselves at a competitive or compliance disadvantage in regulated procurement and vendor assessment processes.

Stay ahead of stories like this

Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-016Agentic AI Deployment Readiness AssessmentHOC-001AI System Risk ClassificationALC-005Regulatory Audit ReadinessBRD-005AI Governance Maturity AssessmentAGT-027Agent Ownership and Accountability Register

What to do now

  • ☐Map your existing AI governance documents to the six domains the BSI audit assessed (policy, accountability, pre-build risk assessment, testing, operational controls, and human oversight) and identify where your program has gaps between what is written and what is actually done.
  • ☐Ask the team that manages your AI systems to show you a recent example of a human oversight decision being documented in practice, not just described in policy, to test whether your controls leave an evidence trail.
  • ☐Confirm that your AI governance program explicitly classifies agentic AI systems (systems that take actions automatically without a human approving each step) as a distinct category with its own controls and approval requirements.
  • ☐Review whether your organization's ISO 42001 readiness work, or equivalent AI management program, covers the full lifecycle from pre-build risk assessment through post-deployment monitoring, and assign an owner for each stage.
  • ☐Check whether any regulated contracts or vendor assessments your organization is subject to now ask for ISO 42001 certification or equivalent evidence, and document the current gap if they do.

What to watch next

Certification bodies and industry groups are expected to publish additional guidance on how ISO/IEC 42001:2023 - Artificial Intelligence Management System applies specifically to agentic AI deployment, following BCS's certification. The CSA's ISO 42001 certification guide and the Deloitte finance webcast have already framed the standard as an audit evidence anchor alongside the EU AI Act (Regulation (EU) 2024/1689). Compliance teams should monitor whether regulated sectors begin citing ISO 42001 certification as a vendor qualification criterion. That shift would make the standard effectively mandatory for market access.

Related Coverage

Research2026-10-30

ProSearch's ISO 42001 Certification Shows What Auditable AI Governance Costs

ProSearch, a legal eDiscovery services company, has obtained ISO/IEC 42001 certification covering the AI management system that handles client data intake, storage, processing, and hosting. The certification followed a year-long effort to build cross-functional policies, controls, training, oversight, and independent validation. The case provides a concrete reference point for what AI governance programs must include to pass an independent audit against the standard.

Corporate Policy2026-11-06

Microsoft's Agentic Maturity Model Sets an Enterprise Governance Benchmark

Microsoft has published a governance and security pillar for its agentic AI maturity model, covering agent inventory, access controls, policy documentation, monitoring, and staged deployment readiness. The guidance gives enterprise compliance teams a structured benchmark against which their own agentic AI programs can be measured. Organizations using Microsoft's agent platforms, or any agentic AI tooling, should use the model to identify program gaps before regulators or auditors do.

Research2026-11-01

80% of Agent Incidents Lack Control Evidence, Anaconda Finds

Anaconda, joining the Open Secure AI Alliance, published research finding that 80% of recorded AI agent incidents lacked public evidence that security controls existed or were operating. The research also argues that testing individual prompts or tool calls is insufficient because retrieved content can silently alter an agent's plan and trigger unintended actions mid-task. Both findings point to a documentation gap that regulators and auditors are increasingly positioned to exploit.