Which Agentic AI Tools Are ISO 42001 Certified?
None of them. No agentic AI tool holds ISO/IEC 42001 certification, and none can. ISO/IEC 42001:2023 is a management system standard: it certifies that an organisation operates an AI management system meeting the standard, within a defined scope. There is no product conformity scheme under it. A vendor can be certified. A vendor's software cannot.
This matters because the question is usually asked while building a shortlist. If certification is the filter, the filter returns nothing useful — every honest answer is "no", and any vendor answering "yes" is describing their own organisation rather than the thing you are buying. Below: what a certificate actually covers, the three questions that do separate vendors, and the evidence that certification leaves you to produce yourself.
What ISO/IEC 42001 certifies, and what it does not
ISO/IEC 42001:2023, published in December 2023, is the international standard for AI management systems. It follows the same management system structure as ISO 9001 (quality) and ISO/IEC 27001 (information security): policy, risk assessment, operational controls, performance evaluation, improvement. Anyone who has been through a 27001 audit will recognise the shape of it.
That structure is what settles the question. In an ISO management system standard, the subject of certification is an organisation and its management system, within a stated scope. An accredited certification body assesses whether the organisation runs that system and issues a certificate naming the organisation, the scope, the standard, and a validity period.
Nothing in that process assesses a product. There is no version number on the certificate, no software build, no API. A model, a tool or an agent framework is an object the management system governs — it is not the thing being certified.
The short form: organisations get certified; products do not. A vendor saying "we are ISO 42001 certified" may be telling the exact truth about their company and still telling you nothing about the software in front of you.
What a certificate actually says
An ISO/IEC 42001 certificate is a short document, and almost all of its meaning sits in one field: the scope statement. Scope defines which parts of the organisation, which sites, and which activities the management system covers. A certificate can be entirely genuine and cover a scope that excludes the product line you are evaluating.
The second field that carries weight is the certification body, and whether it is accredited by a recognised national accreditation body. Certification is a market with a wide quality range. An unaccredited certificate is a document somebody printed.
What a certificate does not contain is any record of your deployment:
- It is about the vendor, not about you. Their management system, their scope, their audit period. Your AI management system is assessed on your evidence.
- It is periodic, not continuous. Certification audits sample a period. They do not observe every action a system took between audits.
- It says nothing about a specific run. No certificate can tell you whether one agent, on one day, followed the sequence your process requires before it acted.
Three questions that do discriminate
If "are you certified" cannot separate vendors, these three can. They are worth asking in writing.
Ask for the certificate itself rather than a claim, and read the scope line. Ask which accreditation body stands behind the certification body. A vendor who is genuinely certified will hand this over without friction, because it costs them nothing and it is the part they are proud of.
What a weak answer looks like: a logo, a trust-centre page, or a statement of "alignment" with the standard. Alignment is not certification, and it is not assessed by anyone.
This is the question the certification question is standing in for. Your auditor will ask you to demonstrate that your controls operated. Ask what artefact the product emits when a control fires, whether it is emitted per action or aggregated, whether it is written at the moment of the decision or assembled from logs afterwards, and whether it survives export.
The distinguishing detail: whether the record is generated by the component being audited or by something independent of it. A record a system writes about its own good behaviour is the weakest form of evidence there is, and an auditor knows it.
Evidence that only the vendor can validate leaves you dependent on the vendor at exactly the moment you least want to be — during an audit, an incident, or a dispute. Ask whether records are cryptographically signed, whether the public keys are published, and whether verification can be performed offline by someone who has never spoken to the supplier.
Why it matters for certification: an auditor assessing your management system is a third party. If they cannot check the evidence independently, it is testimony rather than proof.
What certification leaves you to produce
Certification and evidence are different objects, and buying one does not deliver the other. Even inside a fully certified organisation, an ISO/IEC 42001 audit asks for documented records that controls ran during the period under review — not that they were designed, and not that a supplier was certified.
For agentic AI this is where certification programmes most commonly stall. Policy controls are usually strong. The gap is operational: per-action records showing what the system did, in what order, and what stopped it when a step was not permitted. Aggregate dashboards cannot answer an auditor asking about one decision on one date.
The mechanics of that gap — which controls demand reconstruction, what per-action evidence looks like, and how a receipt chain maps to an audit file — are covered in detail here:
- ISO/IEC 42001 for Agentic AI: The Certification Evidence Gap — Annex A.6.2.8, Clause 9.1, the human oversight controls, and what evidence collection for a certification audit actually requires.
- EU AI Act vs NIST AI RMF vs ISO 42001 — how the three frameworks phrase the same operational evidence requirement.
Where AgenticRail stands
AgenticRail holds no certification and claims none. It is not SOC 2 audited, and it is not ISO 27001 or ISO/IEC 42001 certified. Nothing on this site should be read as claiming otherwise, and nothing here is a conformity assessment.
A distinction that matters more than the certification answer: AgenticRail is not one of the tools this article is about. There is no language model anywhere in the decision path, and no model is consulted. A step is evaluated deterministically against the caller's own declared step order, so the same payload yields the same verdict every time — which is what makes the output reproducible evidence rather than another system's opinion. It governs AI agents; it is not one.
Saying the certification part out loud anyway is deliberate. The question gets put to every supplier in the chain, and a page that answered it about everyone else while going quiet about itself would be worth less than nothing.
What AgenticRail produces instead is the artefact the second and third questions above are asking for. No agent step is permitted without a gate decision, and that decision — ALLOW or DENY — is returned before the step runs and recorded as a signed receipt, hash-linked to its predecessor so that altering an earlier record breaks the chain detectably at the next link. Receipts are signed with Ed25519 and the verification keys are published. The JSON verification report carries the raw signature alongside the exact byte string that was signed and the public keys inline, so an auditor can verify a sequence offline with no network call to us at all.
That is evidence for your management system. It is not certification, it is not a substitute for certification, and the obligations under the standard remain yours.
You can check this rather than take it on trust. Paste a sequence ID into report.agenticrail.nz/report and it returns the per-step enforcement log, signature and hash-link verification for every receipt, and — once a sequence is sealed — the comparison against the independently held archive copy. The JSON form of the same report carries the signed byte string and the keys, for offline checking. A demo sequence needs no key at all.