Key Takeaways
- ISO/IEC 27001 alone does not cover the risks agentic AI introduces. ISO/IEC 42001 fills part of the gap, but the auditor still needs a testing method on top of it.
- Vendor assurance for AI models is worth less than most buyers assume. Read the contractual carve-outs before you rely on them.
- An AI Bill of Materials (AIBOM) is the SBOM equivalent for AI. Treat it as a mandatory artefact for any high-impact system.
- OWASP released the Top 10 for Agentic Applications in December 2025 (ASI01–ASI10). Use it as your baseline threat model.
- The Monetary Authority of Singapore’s SAFR framework, published July 2026, is the first regulator-issued runtime governance model for AI agents in finance. GCC regulators will follow within 18 months.
Traditional IT audit was built around systems that behave the same way twice. Agentic AI does not. That is the whole problem.
Audit scopes now include loosely coordinated agents making tool calls against production APIs and updating memory as they go. Half the control library from ISO 27001 still applies. The other half is silent on what actually matters: goal drift, tool misuse, prompt injection through untrusted content, cascading failures across a multi-agent workflow. Reading a policy on “AI ethics” tells you nothing about whether an agent will move money it shouldn’t.
This is a working playbook for auditing AI and agentic systems in regulated environments. It covers where existing frameworks stop, what to demand from vendors, and the five things a defensible audit method has to cover.
Key Definitions
- Agentic AI: An AI system that plans, uses tools, retains memory across steps, and executes actions with limited human intervention. Not a chatbot.
- AIBOM: AI Bill of Materials. A machine-readable inventory of models, datasets, weights, training pipelines, and third-party dependencies that make up an AI system.
- ISO/IEC 42001: The AI management system standard, published December 2023. Certifiable. Shares Clauses 4–10 with ISO 27001.
- OWASP ASI01–ASI10: OWASP Top 10 for Agentic Applications, released 9 December 2025. The current baseline threat taxonomy for autonomous agents.
- SAFR: Safeguards for Agentic Finance at Runtime. MAS-led framework, published 3 July 2026.
Why traditional audit does not scale to AI?
Traditional audit assumes reproducibility. You test a control once, accept residual risk, move on. AI breaks that assumption. The model’s behaviour depends on inputs the auditor did not see and outputs the auditor cannot predict.
Two things follow. First, point-in-time audit produces false comfort. A model that passed evaluation in March can drift by June. Second, the useful evidence is not policy. It is telemetry. If a vendor cannot show production logs of model inputs, outputs, and tool calls, the audit cannot proceed. You are taking their word for it.
That is not a defensible position for any regulated sector.
The illusion of vendor assurance
Vendor assurance for AI is thinner than it reads. This is where most first-time AI buyers get hurt.
Read the master service agreement of any major foundation model provider. You will find limitations on liability for hallucinations, model outputs, and downstream consequences. That is not because vendors are hiding something. It is because they genuinely cannot guarantee the behaviour of a probabilistic system across every input a customer will throw at it. Accountability for a biased loan decision or a leaked customer record does not sit with the vendor. It sits with the deploying organisation.
Two questions to ask before signing anything:
- What is contractually guaranteed about model behaviour, and where are the carve-outs?
- Will the vendor supply an AIBOM covering third-party dependencies, training data origins, and model version history? If not, why not?
An SBOM is no longer enough. Data poisoning, backdoored weights, and adversarial fine-tuning all live outside the software supply chain. The AIBOM is what closes that gap. The OWASP AI SBOM Initiative, JFrog, Wiz, and Manifest all publish practical schemas. Pick one and require it in vendor onboarding.
What a modern AI audit actually covers?
Five pillars, in the order they run.
1.Data governance and flow mapping
Map every input the model touches. Primary source, movement path, storage, cross-border transfer. This is where most data protection laws such as GDPR, UAE PDPL and DPDPA exposure hides. If a training set was scraped from a jurisdiction with data localisation rules, the problem exists before the model has generated a single output.
2.Full inventory, including shadow AI
You cannot secure what you cannot see. Standalone AI tools are the easy category. The harder category is AI features embedded inside vendor products already in use: the summarisation feature buried in a CRM update, the “smart reply” in a helpdesk platform, the assistant tab that appeared in a Microsoft licence renewal. Add shadow AI on top: employees pasting client data into public models from personal accounts. Almost every organisation audited in the last twelve months has this problem, and most did not know.
3. Risk classification by business impact
Rank every AI system on a tier: low, medium, high, critical, showstopper. A marketing copy generator is low. An agent with tool access to a payments API is showstopper. The classification determines how much of the rest of this list actually runs. Do not audit a chatbot the same way as an agentic workflow with production authority.
4.Black-box testing against real adversarial inputs
You will not get the model weights. You will not get the training data. Assume both from the start and design the test accordingly. Establish operational boundaries in writing, define expected behaviour, then attack the system across the OWASP ASI categories: goal hijack, tool misuse, memory poisoning, agent identity abuse, cascading failures, human-agent trust breakdown. Test with the prompts an insider or contractor would actually send. Not synthetic red team examples from a vendor deck.
5.Impact assessment tied to a specific use case
Generic “AI risk assessments” produce generic mitigations, which produce nothing. Tie every finding to a named business process: this agent, doing this task, at this frequency, on this data. That is what the ISO 42001 Annex A controls demand when applied properly, and it is what a regulator will ask for when something breaks.
Continuous monitoring is not optional
An AI audit that ends at deployment is not an audit. It is a snapshot with a false timestamp.
Models retrain. Data drifts. Prompt patterns shift as users get more creative, or more adversarial. The metrics that need to run continuously fall into four families:
- Performance: accuracy, precision, recall, real-world error rate against a stable evaluation set
- Risk and ethics: hallucination rate, fairness indicators across protected groups, toxicity scores
- Security: prompt injection attempts, API abuse, data leakage indicators, unauthorised tool calls
- Model health: data drift, concept drift, degradation trend lines
Get this in writing before deployment. If the operations team cannot instrument these metrics, the system is not ready for a regulated environment. This is the most underrated line in the whole methodology.
Where the regulators are going?
Two developments matter more than the rest right now.
Singapore’s IMDA published the Model AI Governance Framework for Agentic AI in January 2026. In July 2026, MAS followed with SAFR, focused on AI agents in financial services. SAFR is narrower in scope than the article title suggests, but it is the first regulator-endorsed runtime framework for autonomous agents, covering agent-assisted payments, wealth management document review, and controlled client engagement, with mandatory human override triggers.
The EU AI Act’s high-risk provisions in Articles 9, 14, and 15 already require risk management, human oversight, and cybersecurity evidence for the systems most enterprises are trying to deploy. OWASP ASI01–ASI10 is the technical evidence layer most auditors will map to those articles.
GCC regulators are watching all of the above. Expect variants to surface in UAE, Saudi, and Bahrain financial and healthcare supervisory guidance within the next 12 to 18 months.
Conclusion
Auditing AI and agentic systems is a new discipline built on the same base as classical assurance, not a bolt-on to ISO 27001. ISO 42001 provides the management framework. OWASP ASI01–ASI10 provides the threat taxonomy. AIBOM provides supply chain visibility. Continuous monitoring provides the only kind of assurance that survives contact with a probabilistic system. The tools exist. Regulators are moving faster than most GCC boards realise. The organisations that get their audit method right in the next twelve months are the ones that will still be allowed to deploy agentic AI in regulated workloads eighteen months from now.
Frequently Asked Questions
No. ISO 27001 covers information security management but does not address AI-specific risks: model drift, hallucination, adversarial inputs, agentic tool misuse. Pair it with ISO/IEC 42001, which shares its Clauses 4–10, and audit for the AI-specific controls in Annex A of 42001.
How is AIBOM different from SBOM?
An SBOM lists software components. An AIBOM extends that to datasets, model weights, training pipelines, hyperparameters, and model lineage. Traditional supply chain tools do not capture where a model was trained or on what data. An AIBOM does.
What does OWASP ASI01 actually cover?
Agent Goal Hijack. An attacker manipulates the agent’s objectives through indirect means: a poisoned document, a malicious calendar invite, an email with hidden instructions. The Microsoft 365 Copilot “EchoLeak” scenario is the reference case.
Does the MAS SAFR framework apply outside Singapore?
Not directly. But regulators borrow from each other. Expect variants of SAFR in Hong Kong, UAE, and EU financial supervisory guidance within 12 to 18 months. Reading the white paper now is the cheapest way to prepare.
Can a vendor assurance letter substitute for an AI audit?
No. Vendor assurance covers the vendor’s controls, not how the model was deployed against a specific dataset and use case. The audit obligation stays with the deploying organisation.
Who owns AI risk in a typical enterprise?
Ownership is usually contested between the CISO, the Chief Data Officer, the CIO, and increasingly a Chief AI Officer or AI ethics board. This is one of the most common findings in an ISO 42001 gap assessment: no single accountable owner, and therefore nothing gets done.
