On 4 November 2026 BSI's auditor closed our Stage 2 audit and recommended Ansvar for ISO/IEC 27001 certification. AI agents built and ran that information security management system (ISMS), from the first register to the last evidence link. An ISMS is the policies, responsibilities, checks and records a company uses to manage information security. We took the decisions and steered the agents. We did not write the ISMS by hand.
The audit#
BSI assessed Stage 1 on 31 August 2026. Stage 2 ran remotely from 2 to 4 November and tested, against sampled records, whether our controls work in practice. The certificate itself follows BSI's certification decision. Until it is issued, we share the audit report under NDA on request through our trust page.
Our policies and records answer each requirement in the standard's own terms, with the owner and the evidence named.
The audit also tested our scoping. Before Stage 1 we had excluded A.8.23, web filtering, from our Statement of Applicability, the list of controls we apply or exclude with the reason for each, because we run no office network and no web proxy. At Stage 1 the auditor questioned the exclusion. Our agent weighed the argument, agreed, and proposed a version that fits a small remote company: the built-in malicious-site protection in every work browser, confirmed on each device. Our ISMS Manager approved it, and the control was in place before Stage 2.
That is what we want from an agent: it reads the requirement closely, and it changes its position when someone gives it a better argument.
How our ISMS works#
Everything is in git#
Our management system is a git repository. Policies, the risk register, the Statement of Applicability, supplier records, internal audit files, management decisions and the evidence index are files in that repository. None of it sits in a compliance SaaS database.
Each change carries its author, its date, its review and the decision behind it. When the auditor asks who approved the access policy and when, we show the change and the decision record.
Agents do the work, people decide#
Our agents interview people, read configuration, draft documents, keep the registers and link evidence to controls. They work through pull requests: proposed changes that wait for approval. Our ISMS Manager merges a change after an independent review, or sends it back. Our CEO keeps the reserved decisions: the top-level policy, risk acceptance above appetite, budget and management review. Every decision is a dated record in the repository, in the words it was given.
We use pull requests and reviews because our team already works that way. If your people live in a ticket system, your agent can open tickets for the work people need to do. The approval of the ISMS change itself stays a review in git.
Talk to the ISMS#
Because the ISMS is files, you can build any view you like on top. We built a board, a calendar of recurring obligations and an audit room for the auditor. The board, the compliance calendar and an auditor export come with the template. Most days we just ask:
- "Using Ansvar, show the ISMS actions due this month."
- "Using Ansvar, list the controls whose newest evidence is older than a year."
- "Using Ansvar, draft the input for the next management review."
Live data or uploaded files#
You decide how much your agents see. Ours read live configuration through connectors we approved. If you prefer, give the agent exports, screenshots and documents instead. It records the evidence against the right control either way.
Why the standard text matters#
An agent applies a standard precisely only when it can read the standard. Ansvar is a licensed supplier of ISO standards through SIS, the Swedish Institute for Standards. Through the Ansvar service, logged-in users and their agents receive selected parts of SS-EN ISO/IEC 27001:2023 and SS-EN ISO/IEC 27002:2022 while they work, each part cited to its source. SIS sells the complete standards at sis.se.
Your agent writes each policy and record with the requirement in front of it. Your repository stores the requirement ids and your own words, and the skills keep the standard's text out of your files. That is why our auditor could trace our records back to the requirements.
Why this is where ISMS work is going#
Most ISMS work is reading, cross-referencing and keeping records in line with each other. Each week our agent reads the compliance calendar and drafts the actions and decisions that need a person. The agent does not tire on the fortieth supplier record, and a person still decides the risk appetite, the scope, the exceptions and who gets access.
The Agentic ISMS#
We built a customer product from the management system BSI audited: the Agentic ISMS. You get a repository template, the agent skills that build and operate it, access to selected parts of SS-EN ISO/IEC 27001:2023 and SS-EN ISO/IEC 27002:2022 through SIS, and the Ansvar gateway for the legal register, regulatory deadlines and threat data.
The management system is yours. It sits in your repository, under licences that let you keep using it. If you stop using Ansvar, you keep running your ISMS. Access to the standard parts, our guidance and our lookups ends, and you would buy the standard from SIS directly. With Ansvar connected, your agents have far less to look up by hand.
If you would rather have us do it, we also offer a full service. Our team and our agents build the ISMS with you and get your company ready for its certification audits. We price it on your company's maturity: what you already have in place, your size and your scope.