Governing AI agents with ISO/IEC 42001 and the NIST AI RMF
Agents act with delegated authority, so governance has to reach past documents into running systems. Two established frameworks show how.
By Diego Bianqui · Updated
Why agents raise the governance bar
A chatbot that answers questions creates content risk. An agent that sends emails, changes records or spends money creates operational risk: it acts on behalf of the organization, sometimes without a human in the loop. Governance has to answer new questions — who owns this agent, what is it allowed to do, how do we know it stays within that, and who can stop it?
Two established frameworks give a structure for those answers, without inventing a new one: ISO/IEC 42001:2023 and the NIST AI Risk Management Framework.
The two frameworks at a glance
| ISO/IEC 42001:2023 | NIST AI RMF 1.0 | |
|---|---|---|
| What it is | An international standard specifying requirements for an AI management system (AIMS). | A voluntary framework for managing AI risks, from the US National Institute of Standards and Technology. |
| Structure | Management-system clauses 4–10, plus Annex A with 38 controls across 9 objectives. | Four functions — GOVERN, MAP, MEASURE, MANAGE — broken into categories and subcategories. |
| Certification | Yes, by accredited third-party certification bodies. | No certification; organizations describe current and target profiles. |
| Generative AI | Applies to all AI systems, including agents. | Complemented by the Generative AI Profile, NIST AI 600-1. |
| Best for | Demonstrating governance to customers and auditors. | Structuring risk management in practice. |
They work well together: the AI RMF supplies a risk methodology, ISO/IEC 42001 supplies an auditable management system, and NIST has published a crosswalk between them.
Applying them to agents: six practical steps
- Inventory every agent: purpose, owner, model, tools, data it touches and the identity it acts as. You can't govern what you haven't listed.
- Set autonomy levels. Decide per agent which actions it can take alone, which need approval, and which are forbidden — and enforce those limits in the harness, not only in policy.
- Assess risk and impact before deployment. Use the OWASP Agentic Top 10 for security threats and an AI system impact assessment for effects on people and the organization.
- Choose controls in proportion to the risk. Not every agent needs every control; every control should answer a risk you have written down.
- Monitor in production. Tracing, evaluation and incident handling — AgentOps — produce the evidence that controls actually work.
- Review and improve. Management review, internal audit and corrective actions close the loop, as both frameworks expect.
Evidence beats documents
The most common governance failure is a policy that describes controls the running system doesn't have. For agents, good evidence is concrete: a permission configuration that matches the documented scope, approval logs for sensitive actions, evaluation results on every release, traces of real runs, a tested kill switch. If the engineering produces that evidence by default, audits and customer questionnaires become much easier.
This article is general information, not legal advice. ISO/IEC 42001 certification does not by itself make an organization compliant with the EU AI Act or any other law.
Related guides
- The OWASP Top 10 for Agentic Applications, explained
- AgentOps: running AI agents in production
- Harness engineering: the system around the model
Sources
- ISO, ISO/IEC 42001:2023 — AI management systems (external site)
- NIST, AI Risk Management Framework (external site)
- NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (external site)
Working on agents in production? Get in touch.