ISO/IEC 42001
A management-system standard for artificial intelligence, structured like ISO 27001 — policy, roles, risk assessment, controls, internal audit, continual improvement. Certifiable by accredited third parties.
Why it matters for autonomous finance
The only item on this list a firm can actually be certified against, which is why it will win procurement questionnaires regardless of technical merit. For an allocator doing operational due diligence on an AI-driven manager, it is the first box that has a defensible answer.
What it does not cover
A management-system certificate attests that you have a process, not that the process is adequate or that the system is safe. ISO 27001 certified firms are breached routinely; the certificate was never the claim. Treat 42001 as evidence of organisational seriousness and nothing more — and be suspicious of anyone who presents it as a risk answer.
Silent on model provenance, reconstruction, and cross-firm agent interaction. Every entry in this register carries this section. A standard read past its scope is worse than no standard, because it produces confidence without coverage.