Inventory and ownership
AI worker inventory, Agent Passport records, lifecycle state, owner roles, reviewer roles, and accountability boundaries.
ISO-Aware AI Governance
Extend the management system you already run into AI governance.
Scaled Agents™ is ISO 42001-aware and ISO 27001-integration-aware. It helps enterprises extend existing security, GRC, and ISO 27001-style management systems into AI governance through structured inventories, Agent Passports, oversight workflows, and evidence records.
The core principle is one system, not two: AI governance should connect to existing governance, risk, audit, documentation, corrective action, and management review routines instead of creating a disconnected AI-only program.
Context
Use this page as a readiness orientation, not an assurance claim.
This page is for enterprise teams that already operate security, risk, audit, GRC, privacy, procurement, or ISO 27001-style management-system routines and need to understand how AI governance records can connect to that existing operating model.
It explains where Scaled Agents can support AI governance preparation: inventories, Agent Passports, risk and impact preparation, human oversight paths, connector boundaries, runtime evidence, control mapping conversations, management-review inputs, and board-ready summaries.
- One management system, extended into AI governance
- Preparation and evidence organization, not certification
- Customer and auditor judgment remain outside the product
Integration Positioning
AI governance should extend the ISMS operating rhythm.
Enterprises with an information security management system already have risk review, evidence collection, internal audit, corrective action, document control, and management review routines. Scaled Agents helps add AI-specific records and workflows around that existing operating model.
Risk and impact preparation
Risk classification, trust-boundary review, AI impact assessment support, sensitive-data review, autonomy review, and escalation planning.
Evidence and review cadence
Evidence generation and audit readiness through Stamps, Toll Gate decisions, Human Review records, Runtime Permit context, and activity trails. These records support evidence generation and audit readiness without creating an audit opinion.
Certification boundary
Scaled Agents is not a certification body. Scaled Agents does not certify organizations, does not guarantee certification, does not replace customer auditors, and is not endorsed as a standards-body tool. ISO-aware content supports preparation, evidence organization, and control mapping conversations only.
Control Mapping
Map Scaled Agents records to ISO-aware governance concepts.
This public matrix is a customer-safe positioning view. Detailed clause interpretation, licensed standards text, customer-specific mappings, legal conclusions, and audit conclusions stay with qualified reviewers.
| Requirement / concept | Current Scaled Agents capability | Fit | Recommended improvement |
|---|---|---|---|
| AI system inventory | Worker Catalog, Agent Registry, Passport status, lifecycle summaries. | Strong | Add ISO readiness filters and export labels. |
| Agent Passport | Passport identity, owner, purpose, scope, permissions, evidence, review state. | Strong | Add impact assessment, SoA support, and management-review references. |
| Ownership and accountability | Owner, sponsor, reviewer, risk owner, data owner, approval authority, escalation path. | Strong | Create board and management-review rollups. |
| AI impact assessment support | Risk tiering, trust boundary, data class, autonomy, consequence, scale-breaker review. | Partial | Build AI Impact Assessment Studio as a governed workflow. |
| Statement of Applicability support | Control mapping references exist in schema and governance mapping fixtures. | Partial | Add a separate SoA support view with inclusion rationale, exclusions, owners, and evidence references. |
| Internal audit and corrective action | Evidence records, review queues, remediation planning, incident and exception language. | Partial | Add internal audit workspace and corrective action register. |
| Management review and board reporting | Lifecycle analytics, Registry/Passport previews, board-level governance preview. | Partial | Add management review dashboard and board-ready governance packet. |
| Audit evidence export package | Audit export package schema, Evidence Record, Stamps, Toll Gate decisions. | Partial | Create customer-safe export package with redaction, scope, and review disclaimers. |
Product Fit
Current records already support much of the ISO-aware foundation.
Identity, owner, purpose, scope, tool and data boundaries, approval status, review dates, lifecycle state, and evidence references.
Review checkpoints for higher-risk actions, sensitive data, restricted tools, external communication, and consequential decisions.
Action-time authority planning for scoped, short-lived requests before mock or future controlled execution proceeds.
Event logging, decision evidence, remediation events, reviewer context, closure status, and audit-readiness summaries.
Roadmap Boundary
What should come next, after review.
P1 product roadmap
- AI Impact Assessment Studio
- Statement of Applicability Support View
- Management Review Dashboard
- Internal Audit Workspace
- Corrective Action Register
P2 product roadmap
- ISO 27001 to ISO 42001 Integration Wizard
- Certification readiness scoring with conservative labels
- Exportable audit package
- Board-ready governance packet
- Industry-specific ISO readiness templates
Roadmap boundary
These roadmap items are not live certification, audit, legal, security, or compliance capabilities. They should be reviewed, scoped, and implemented through the Scaled Agents backlog before being treated as product functionality.