Your AI agent needs a team behind it
cubesys has achieved ISO/IEC 42001 certification for our AI management system.
This page explains what was certified, what it does not cover, and what it changes
if you are considering an AI agent for your own business.
What we achieved
cubesys is certified to ISO/IEC 42001, the international standard for AI management systems. It covers how an organisation governs the AI it builds and uses.
|
Compass Assurance Services
| Certificate number | Issued |
| 9146-1168-01 | 14 October 2026 |
Certification means an independent assessor has checked that we assess risk and impact, assign every agent a named owner, audit ourselves and continually improve.
What it changes for you
The problem has moved. Not long ago the question was whether AI would reach production at all. It largely has. Deloitte's 2026 survey of 3,235 leaders across 24 countries found only a quarter of organisations have moved 40% or more of their pilots into production, so the gap is real. But the sharper finding sits elsewhere. McKinsey's 2026 global survey of 1,719 respondents found around 80% of organisations reporting productivity gains from AI, and only 37% able to attribute any EBIT impact. Both figures are flat on the year.
People feel faster. The accounts do not show it. That gap is an operating-model problem, not a model problem: an agent nobody owns, working on something nobody measured, in a process nobody wrote down. It is also the specific problem ISO/IEC 42001 asks an organisation to solve, which is why certification is worth more than a badge here.
And on agents specifically, Gartner predicts over 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. Those are the three failure modes an agent operating model exists to prevent.
80% |
of organisations report productivity gains from AI
McKinsey, The State of AI 2026 |
37% |
can attribute any EBIT impact
McKinsey, The State of AI 2026 |
25%
|
have moved 40% or more of their pilots into production
Deloitte, State of AI in the Enterprise 2026 |
40%+ |
of agentic AI projects predicted to be cancelled by end of 2027
Gartner predicts (June 2025) |
So when cubesys builds an agent for your business, four things are already settled before anything is built:
2.
Its boundaries are written down first.
What data it can reach, what it may decide, where it must hand back to a person.
AI Contract and Statement of Applicability →
3.
It is assessed for risk and impact before it goes near production.
And the assessment is kept, not filed away.
Risk and impact assessment →
4.
It is measured and improved in use
With an audit trail an executive or a regulator can follow.
Measurement and improvement →
What it does not mean
Certification covers how we manage AI. It is not a warranty on any individual model, and it does not remove the need for your own governance. What it does mean is that when we build with you, the discipline is already in place on our side.
We proved it on ourselves
~8 hours → under 10 minutes
Our monthly tenant health check used to take a consultant around eight hours. It now takes under ten minutes, and a named person still signs it off.
200%
Copilot-assisted hours up 200% across cubesys, with more than 5,500 chats in the first 30 days.
“That little bit of advice has been revolutionary for me in my particular role. I’ve now got a master framework for how I want things to happen consistently, while referencing the documents we already have in Teams. It’s incredible how this can work. The next step for me is understanding how I can get that to happen automatically behind the scenes.”
The people behind the practice
.png?width=164&height=164&name=Chrissy%20(2).png)
Christine Brown
Head of AI Transformation and Strategic Programs
Watch the interview
Silvan Maeder
CTO & Co-Founder
Watch the interview
Frequently asked questions
-
What is ISO/IEC 42001?
ISO/IEC 42001 is the international standard for AI management systems: how an organisation governs the AI it builds and uses. It asks an organisation to show, in writing and in practice, how it assesses AI risk and impact, who is accountable, and how it measures and improves its AI over time.
-
What exactly is covered by the cubesys certification?
Our certificate covers: "The governance, implementation, configuration, deployment, operation, support, monitoring and continual improvement of Artificial Intelligence systems used in the delivery of technology services and the operation of the business." It certifies how we manage AI, not any individual AI model or product.
-
Who certified it?
Our AI management system was independently assessed and certified by Compass Assurance Services. [Optional: certificate number and issue date, once issued]
-
Does this mean an agent built by cubesys is compliant by default?
No. Certification covers how we manage AI. It is not a warranty on any individual model, and it does not remove the need for your own governance; your obligations stay yours. What it does mean is that when we build with you, the discipline is already in place on our side, and we help you meet your obligations.
-
What is an AI Contract?
An AI Contract defines an agent before anyone builds it: its role, tone, data access, guardrails, hand-back points and how it will be measured. Your business signs it, and our consultants build to it. If you already have a governance framework, the AI Contract is designed to sit under it rather than replace it.
-
How do you decide when a person must be involved?
We decide it up front, in writing, not after something goes wrong. Each agent's AI Contract sets out what it may decide on its own, what it must hand back to a person, and who that person is. Every agent has a named human owner who reviews its work and can change those rules as the agent is used.
-
How do I start?
Start with a conversation. We'll talk through your actual work, where an agent is viable and, just as usefully, where it is not. From there, most organisations begin with an AI Readiness Assessment or the AIForge Activation Pack.
-
What does an initial AI Forge engagement look like?
The AIForge Activation Pack is a fixed-fee engagement of about two weeks, delivered virtually.
- Days 1–5, Discover: we review your Microsoft 365 environment for readiness, including Microsoft Purview posture, oversharing risk, sensitivity labels and your security baseline.
- Days 6–10, Activate: we deploy SystemsAtlas, our agent that maps how work actually happens and shows which workflows are ready for AI.
You finish with an AI Readiness Report, SystemsAtlas running in your environment, and a clear path into building your first production agents.
-
Is the AI pilot-to-production problem still real?
Yes, but it has changed. Deloitte's 2026 State of AI in the Enterprise survey of 3,235 leaders across 24 countries found only a quarter of organisations have moved 40% or more of their pilots into production. The sharper gap is value: McKinsey's 2026 global AI survey found around 80% of organisations report productivity gains from AI, but only 37% can attribute any EBIT impact. Getting AI running has become the easier part. Proving what it changed is the hard part.
-
Why does certification help with AI value rather than just AI risk?
Most AI that fails to show value fails for operating reasons, not technical ones: nobody owns it, nobody measured what it changed, and the process it runs in was never written down. ISO/IEC 42001 makes an organisation fix exactly those things, with named owners, written boundaries, and measurement and improvement built in. The same discipline that manages risk is what turns a deployed agent into one you can point to in the numbers.