No EU law and no published ISO standard is written only for AI agents yet. Govern each agent as an AI system under ISO/IEC 42001:2023 and the EU AI Act, and add controls from Singapore's agentic AI framework (version 1.5, 20 May 2026).
This guide is for compliance and risk leads whose agents already call tools, update records or send messages.
Which frameworks say something specific about AI agents?
Three dated sources deal with agents by name. Singapore's IMDA launched its agentic framework at Davos on 22 January 2026. The OWASP GenAI Security Project published its agentic threat list on 9 December 2025. NIST's CAISI (now CAISSI) launched its AI Agent Standards Initiative on 17 February 2026.
| Source | Owner | Status and date | What it asks of organisations running agents |
|---|---|---|---|
| ISO/IEC 42001:2023 | ISO/IEC JTC 1/SC 42 | Voluntary standard. Edition 1, December 2023. No amendment or revision project on iso.org | An AI management system for any AI. No agent-specific controls |
| EU AI Act, as amended by Regulation (EU) 2026/1744 | European Union | Law. Article 50(1) applies from 2 August 2026. High-risk duties from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) | Providers must design agents that deal with people so they are told it is an AI. For high-risk uses, human oversight scaled to the level of autonomy |
| Model AI Governance Framework for Agentic AI | IMDA, Singapore | Guidance. Version 1.5, 20 May 2026, updated 5 June 2026 | Bound the risks upfront, keep humans accountable, apply technical controls, enable end-user responsibility |
| NIST AI RMF 1.0 and AI Agent Standards Initiative | NIST, United States | Voluntary. RMF of 26 January 2023, being revised. Agent work at initiative and draft stage | AI risk management for any AI. No published agent profile yet |
| OWASP Top 10 for Agentic Applications 2026 | OWASP GenAI Security Project | Community threat list, 9 December 2025 | Ten agent risks, ASI01 to ASI10, to assess and test against |
The IMDA framework defines agentic AI systems as systems that can plan across multiple steps to achieve specified objectives, using AI agents. Version 1.5 adds multi-agent and third-party agent risks, automation bias and more than ten case studies.
IMDA calls its framework first-of-its-kind and a living document. It is guidance, not law, so check the edition before you cite it.
How does the EU AI Act treat an AI agent?
The Act has no separate category for agents. Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy, so an agent is an AI system. What applies depends on your role and the risk class of the use.
A company that uses a third-party agent under its authority is normally a deployer (Article 3(4)). One that builds an agent and markets it under its own name is a provider (Article 3(3)). Being outside the EU does not take a Gulf company out of scope. The Act reaches providers placing AI systems on the EU market wherever they are established, and providers and deployers abroad whose system's output is used in the EU (Article 2(1)(a) and (c)).
For agents that deal with people, the key duty is Article 50(1), which applies from 2 August 2026. Providers must design AI systems that interact directly with people so those people are told they are dealing with an AI, unless that is obvious.
Regulation (EU) 2026/1744 of 8 July 2026 moved the high-risk dates to 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products. Pages that still give 2 August 2026 for high-risk duties are out of date.
From those dates, if an agent serves a high-risk purpose, human oversight must match the risks, the level of autonomy and the context of use (Article 14). Deployers must give oversight to people with the competence, training and authority to exercise it (Article 26). Your role and risk class depend on the use case, so take legal advice for a firm answer.
What does ISO/IEC 42001 cover for agents, and what does it leave out?
ISO/IEC 42001:2023 sets requirements for establishing, implementing, maintaining and continually improving an AI management system. It is written for organisations that provide or use AI-based products or services, so it covers agents.
It does not name controls for agents. ISO sets the management system: policy, risk and impact assessment, internal audit and management review. Agent controls such as scoped permissions, approval checkpoints and pre-deployment tests come from guidance like IMDA's framework and the OWASP list. You run them inside the management system.
Bring every agent into the scope of your AI management system, so each agent use case goes through risk and impact assessment. ISO/IEC 42005:2025, published in May 2025, covers AI system impact assessment. Our guide to ISO/IEC 42001:2023 explains the requirements and how they relate to the EU AI Act.
What should you be able to show for each agent?
Read with the EU AI Act duties, IMDA's four dimensions translate into records. This is our practical reading, not an audit checklist issued by any body.
- An agent inventory showing the tools, data and systems each agent can reach, and its level of autonomy.
- A risk assessment per use case covering scope of action, reversibility and autonomy, the three factors IMDA uses.
- A permission record per agent. IMDA recommends authority that is scoped, least-privilege, non-transferable and generally time- or session-bound, never above the authorising human's permissions. Give each agent its own identity, separate from human accounts.
- A list of actions that need human approval, with evidence that approvals happened. IMDA names irreversible actions such as permanently deleting data, sending communications and making payments.
- Named accountable people, including for third-party agents and vendors. Our guide to ISO/IEC 38507:2022 covers the board's role.
- Pre-deployment test results for execution accuracy, policy adherence and tool use, plus adversarial tests for goal hijack, tool misuse and memory poisoning.
- A gradual rollout plan and monitoring logs. Version 1.5 adds monitoring of human override rates and response times, to catch automation bias.
- A user notice saying that people are dealing with an AI, what the agent can do, which data it can reach and what the user remains responsible for.
IMDA's factsheet shows tiering in practice. Dayos runs an IT-ticket agent in three tiers. Low-severity, fully reversible tickets are fully automated and audited biweekly. The middle tier needs human approval, and on high-severity work with limited reversibility, such as permission changes, the agent may not act.
Where do the OWASP agentic list and NIST's agent work fit?
The OWASP Top 10 for Agentic Applications 2026 runs from ASI01 Agent Goal Hijack and ASI02 Tool Misuse and Exploitation to ASI10 Rogue Agents. In between sit identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures and human-agent trust exploitation.
ASI02 builds on Excessive Agency (LLM06:2025) from OWASP's 2025 LLM list, and IMDA points readers to OWASP for fuller threat coverage. Use the ten entries as the threat catalogue behind your risk assessment and tests.
NIST's AI RMF 1.0 is being revised under the White House AI Action Plan, with no published date. The initiative covers industry-led standards, community-led open protocols, and research on agent security, identity and evaluation. Its consultations on agent security and on agent identity and authorisation closed in March and April 2026. Watch for the outputs, but do not treat drafts as requirements.
What does the UAE's agentic AI target mean for suppliers?
On 23 April 2026, the UAE Cabinet announced a government framework to transform 50% of UAE Government sectors and services to agentic AI within two years.
This is a target for federal government operations, not a regulation binding private companies. We found no UAE rule that requires a particular agent framework. Vendors serving federal entities should expect to be asked how their agents are governed. The records above give you the answer.
How AGS can help
The Agentic AI Governance & Assurance Management System holds 356 editable documents: 266 Word, 89 Excel and a PowerPoint Board Presentation. It includes an AI Agent Register, an Autonomy Classification Workbook, an Agent-to-Tool Permission Matrix, a Mandatory Human Intervention Matrix, Kill Switch Requirements, a Prompt Injection Test and an EU AI Act Applicability Assessment. ISO/IEC 42001:2023 is referenced, not implemented, so the kit sits beside an AI management system.
Frequently asked questions
Can an AI agent be certified to ISO/IEC 42001?
No. Certification covers an organisation's AI management system, not a single agent. Independent certification bodies certify, not ISO, and ISO/IEC 42006:2025, published in July 2025, sets requirements for them.
What fines can a deployer face under the EU AI Act?
Breaches of deployer duties under Article 26 and transparency duties under Article 50 carry fines of up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, the lower of the two applies (Article 99(6)), and Regulation 2026/1744 extends that to small mid-cap companies (Article 99(6a)).
Does the AI literacy duty cover staff who supervise agents?
AI literacy duties have applied since 2 February 2025. Article 4, as replaced by Regulation 2026/1744, now requires providers and deployers to take measures to support the AI literacy of staff and others operating AI on their behalf. People who run or oversee your agents are the obvious audience.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO, IEC, IMDA, NIST, OWASP, the European Commission or the UAE Government. This guide is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
