Governing AI Agents Under ISO/IEC 42001: Registers, Impact Assessments and Evidence

Why agents stress an AI management system

Four properties make agents harder to govern than models that only produce text:

• They act. An agent can send email, change a database or call a payment API. The consequence of an error is an action, not a wrong answer.
• They hold access. Agents need credentials to reach tools, and those credentials are often broader than the task requires.
• They chain. One agent's output becomes another's input, so a manipulated instruction can travel through several systems.
• They change. New tools, skills and model versions alter behaviour without a formal release.

The OWASP Top 10 for Agentic Applications, published in December 2025, catalogues the resulting risks, from agent goal hijack and tool misuse to identity and privilege abuse and rogue agents. An AI management system does not replace those technical controls. It makes sure they exist for every agent, have an owner, and produce evidence.

The agent register

ISO/IEC 42001 expects an organisation to document the resources its AI systems use, including data, tools, computing resources and people (Annex A, A.4). For agents, that documentation is best kept as a register with one entry per agent:

OWASP's draft Agent Control Standard, contributed in September 2026, proposes an Agent Bill of Materials in CycloneDX, SPDX or SWID formats. It is early, but designing the register so it could be exported that way avoids rework later.

When an agent needs an impact assessment

Annex A, A.5, requires a process for assessing the impact of AI systems on individuals, groups and society, and for documenting the results. ISO/IEC 42005, published in May 2025, gives guidance on how to run those assessments across the life cycle.

For agents, a practical trigger list is: the agent makes or substantially contributes to decisions about people; it can take irreversible actions; it handles personal or sensitive data; it interacts directly with customers or the public; or it operates in a regulated process such as credit, employment, health or critical infrastructure.

In Australia, the first trigger now has a legal edge. From 10 December 2026, privacy policies must describe the kinds of personal information used in automated decisions that could significantly affect individuals, and the kinds of decisions made, whether the program makes the decision or substantially and directly contributes to it. Agents in customer service, claims or collections workflows are likely candidates. See AI governance in Australia and New Zealand for the wider picture.

Life cycle controls, applied to agents

These map closely to the technical checklist our advisory colleagues use before agents go live, set out in the 12-point agentic AI risk assessment. The management system's job is to prove each of those checks happened, for every agent, every time.

The evidence an auditor will sample

• the AI policy and its alignment with other policies (A.2), with agents in scope;
• the agent register, current and reviewed, with owners;
• completed impact assessments for agents that meet the trigger list;
• pre-deployment evaluation and red-team results, and re-evaluations after material changes;
• approval records for high-risk actions, and evidence that approvers saw what would change;
• event logs that attribute actions to an agent identity and a person;
• supplier assessments for agent platforms and components;
• nonconformities and corrective actions from agent incidents or near misses.

The common failure in audits is not a missing policy but missing operation: a register last updated at launch, or an impact assessment for the pilot but not for the production version. Dated, sampled evidence is what separates a management system from a document set.

How the regulatory landscape lines up

• European Union. The Digital Omnibus agreed in 2026 moved high-risk AI obligations to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Transparency obligations under Article 50 applied from 2 August 2026.
• Singapore. IMDA's Model AI Governance Framework for Agentic AI, published in January 2026 and updated in May 2026, asks organisations to bound agent risks upfront and keep humans meaningfully accountable.
• Australia. The Guidance for AI Adoption of October 2025 sets six practices that align with an ISO/IEC 42001 system, and the December 2026 privacy change applies to automated decisions.
• Malaysia, Saudi Arabia and the UAE. Malaysia is consulting on an AI Governance Bill, while SDAIA's principles and the UAE Charter remain voluntary. See AI governance in Saudi Arabia, the UAE and Pakistan.

Running it in GRCLens

GRCLens carries the full ISO/IEC 42001 catalogue, with an AI Systems Inventory kept as a register in the tenant, an automated decision-making register, an AI risk register and a nonconformity and corrective action register. Agents sit in the inventory with their owners, tools, data and linked impact assessments, and evidence is reviewed by an AI model hosted inside your own infrastructure, so prompts and documents never leave the deployment. The same controls share evidence with ISO/IEC 27001, SOC 2 and privacy frameworks on one control model.

Frequently asked questions

How Security Solution Consultants can help

Security Solution Consultants implements ISO/IEC 42001 management systems for organisations in Australia, New Zealand, Singapore, Malaysia and the Gulf, and runs pre-deployment risk assessments for AI agents. See our compliance and risk management advisory and AI governance guide for businesses. With GRCLens holding the register, assessments and evidence, certification readiness becomes a matter of keeping records current rather than rebuilding them before each audit. Request a demonstration.