For decades, ISO 27001 has been the gold standard for corporate information security. It answers a clear set of questions: where does your data sit, who can reach it, and how is it protected?
Those questions stop being enough the moment autonomous AI/SI agents enter your operations. An agent is not passive software that stores data. It sends email in your company's name, answers a customer on WhatsApp, creates an order, interprets a spreadsheet and makes decisions.
That raises questions your board has never had to ask before. If an agent makes a commitment to a customer that nobody authorised, who is accountable? When something goes wrong, can you actually stop it? Six months from now, when an auditor asks why a decision was made, do you have a record to show?
ISO/IEC 42001:2023, the world's first AI management system standard, was published to make exactly these questions answerable.
The Difference Between ISO 27001 and ISO 42001
What separates them is what they govern:
- ISO 27001 protects data. It centres on confidentiality, integrity and availability. It keeps information out of the wrong hands.
- ISO 42001 governs decisions and behaviour. It defines the boundaries an AI works within, the gates a decision passes through, how risk is contained, and who is accountable when something goes wrong.
Put simply: ISO 27001 locks the vault door; ISO 42001 governs what the AI holding the key is allowed to do inside it.
One does not replace the other. Your information security can be flawless and you can still be liable for a promise an agent made to your customer.
Five Questions a Decision Maker Should Be Able to Answer
ISO/IEC 42001 is a long standard, but in practice it comes down to five questions an executive has to be able to answer. Ask them of any AI vendor you evaluate. Evaluate the vendor’s actual decision boundaries and accountability.
1. When something goes wrong, can you stop it?
The biggest risk is a system that cannot be stopped once unwanted behaviour starts. In most products the "stop" button only closes the chat window. Scheduled jobs, calendar reminders and reporting cycles keep running in the background, and a new message on WhatsApp or email wakes the agent straight back up.
A real emergency stop freezes the agent's background work, silences its messaging channels, closes its open sessions, and records who stopped it and when.
The question to ask: "When I say stop, how long until it is actually silent, and is there a record of who did it?"
2. Where does customer data go, and can it be deleted?
Customers and staff share identity numbers, card details and bank accounts in the middle of a conversation. That information settles into the AI's memory without anyone intending it to.
For GDPR and KVKK you need two things settled. First, whether such details are masked before they reach memory at all. Second, whether a deletion request can genuinely be carried out. Deletion has to cover not just the records but the summaries the AI derived and the knowledge base it built, or nothing has really been deleted.
Get one commitment in writing as well: your data will not be used to train models. That belongs in the contract.
3. Six months from now, can you explain why it did that?
A black box is not acceptable in an enterprise. An audit, a customer complaint or a legal process always asks backwards.
Every step an agent takes, what it was based on and what came of it has to be recorded. Two properties of that record matter: it cannot be altered after the fact, and it has to be exportable. An auditor does not want to look over your shoulder at a dashboard; they want a file they can examine themselves.
One more detail: that file should not carry your internal sequence numbers out of the building. Shared sequence numbers let the other side estimate your transaction volume. Records should travel under readable names instead.
4. Can the agent be talked into something from the outside?
This is a new class of risk with no equivalent in traditional security. An email, a web page or a document the agent reads can try to give it instructions. The attacker never breaks into your systems; they persuade your agent.
The defence comes down to one principle: authority cannot be widened by conversation. Company rules must not be editable by the flow of a chat, text arriving from outside must be treated as data rather than instruction, and approval for a risky action must come from a person clicking. The AI deciding on its own that "the user agreed" cannot be enough.
Put it to your vendor this way: "Can text arriving from outside cause the agent to use authority I never granted?"
5. If the vendor goes down, does your business stop?
Tying a business process to a single AI provider's uptime is an operational risk. When that provider has an outage, work that does not change anything should fail over to a backup model automatically.
This question is commercial, not technical: "If your provider is down for two hours, does my customer notice?"
How Botonom Answers Those Five Questions
Botonom is built so that businesses do not have to construct these controls from scratch. Every agent on the platform:
- Stops with one click, from the dashboard or the mobile app. Its scheduled work halts, its messaging channels go quiet, its open sessions close, and the action is recorded.
- Works inside its own company's boundary. Conversation history and knowledge are separated per company, so one agent cannot reach another company's data. Customer data is never used to train models.
- Acts only within its authority. Money transfers, deletions and bulk messages arrive on a manager's screen as an approval. Approval is a click; an agent cannot unlock itself.
- Accounts for itself. Every step is recorded, readable in the dashboard, and exportable for any date range as a file you can hand to an auditor.
- Can forget. A company's entire agent memory, conversation history and knowledge base can be permanently erased on a manager's decision.
Frequently Asked Questions
Is ISO 42001 a legal requirement?
There is no criminal provision behind it. But the EU AI Act, GDPR-equivalent regimes and financial audits all expect organisations to place their AI processes inside an auditable framework. In practice the pressure arrives from customers before regulators: large enterprise buyers have started asking their vendors for this.
Does it apply to us if we do not train our own models?
Yes. ISO 42001 covers not just the technology companies that build models but every organisation using AI inside its operations. If you run a system that decides on your behalf, the accountability is yours.
Does using Botonom complete our compliance work?
No, it shortens it. Emergency stop, human approval gates, role-based authority, an exportable audit trail and data purge come with the platform, so the technical half of your compliance work stops being a months-long software project. It does not replace your own certification process; it lets you walk into that process ready.
