← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

ISO/IEC 42001 evidence for AI agents

ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS). Like ISO 27001 for information security, it certifies that the organisation runs a managed process: policy, roles, risk assessment, impact assessment, controls, monitoring and improvement. It does not certify a model.

Certification audits are evidence-driven. The auditor samples controls and asks to see records that the control operates.

Controls that touch agent operations

Annex A lists reference controls. Several apply directly to agents in production:

• Event logging for AI systems: determining at which lifecycle phases event logs are recorded, at minimum while the system is in use (control A.6.2.8).
• Operation and monitoring of the AI system after deployment.
• Verification and validation before release.
• Documentation of the system and of its intended use and limitations.
• Impact assessment on individuals and groups affected by the system.

What evidence looks like

• A written logging decision: which events, which systems, how long, who can access.
• Sample run logs showing the decision is implemented, including policy decisions and human approvals.
• Proof of integrity: logs that detect edits, verified by someone outside the operating team.
• Monitoring outputs: weekly summaries of blocked actions, escalations and incidents, with follow-up actions.
• Test records for each release, reproducible from recorded runs.

Reuse across frameworks

The same logs serve the EU AI Act record-keeping articles (Article 12, Article 19, Article 26) and the NIST AI RMF. Build the evidence once, at the call site, and map it several times.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 29 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.