---
title: "How to Use Vanta MCP with Claude, Codex, Cursor & Perplexity"
description: "Learn how to use Vanta MCP with Claude, Codex, Cursor, and Perplexity to streamline security and compliance workflows."
canonical: "https://axipro.co/vanta-mcp-claude-codex-cursor-perplexity/"
language: "en-US"
modified: "2026-09-01T07:22:47+00:00"
generator: "WordPress 7.1.1"
---

[Home](https://axipro.co)

/ [Vanta](https://axipro.co/category/vanta/)

/ How to Use Vanta MCP with Claude, Codex, Cursor & Perplexity

# How to Use Vanta MCP with Claude, Codex, Cursor & Perplexity

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- September 1, 2026

Copy Link

Vanta’s hosted MCP server gives Claude Code, Codex, Cursor, and Perplexity a live line into your compliance program. Failing tests, controls, vulnerabilities, vendors, policies: all of it queryable in plain English from whatever tool you already have open.

Connecting a client shouldn’t take more than ten minutes. **Fixing what the agent finds still takes an engineer**, and then a wait for Vanta’s next sync before the dashboard turns green.

This guide walks through setup for all four clients, the remediation workflow from first query to verified fix, and the errors people hit most. It also covers the parts of the beta that Vanta’s marketing pages skip.

## **What Is the Vanta MCP Server?**

### Understanding Model Context Protocol (MCP)

[Model Context Protocol](https://modelcontextprotocol.io/) is an open standard for connecting AI applications to outside systems. An MCP client (the AI tool) asks an MCP server what it offers, usually a set of named tools with typed inputs, and calls those tools on your behalf. The protocol specification covers transport, authorization, and message format, which is why one server works with any compliant client.

[Anthropic](https://en.wikipedia.org/wiki/Anthropic) released MCP in late 2024 and handed it to the Agentic AI Foundation in December 2025, a fund under the [Linux Foundation](https://www.linuxfoundation.org/) co-founded with Block and OpenAI. The Linux Foundation’s announcement counted more than 10,000 public MCP servers at that point, with ChatGPT, Cursor, Gemini, Microsoft Copilot, and VS Code all supporting the protocol.

[TechCrunch](https://techcrunch.com/) called the foundation’s projects the basic plumbing of the agent era. That neutral governance is the reason a single Vanta server can serve Claude, Codex, Cursor, and Perplexity without four separate integrations.

### What Vanta MCP enables for AI agents​

Vanta runs two versions of its MCP server. **The hosted remote server**, which this guide focuses on, lives at a regional URL, authenticates with OAuth in your browser, and is what Vanta now documents for every supported client. The older open-source local server ships as the **@vantasdk/vanta-mcp-server** npm package and runs on your machine with API credentials in an environment file. Vanta’s own repository for the local version now carries a deprecation notice pointing people to the hosted one, so treat it as a fallback for clients that can’t reach the hosted endpoint rather than the default.

Once connected, the agent can list and filter automated tests, pull the specific entities failing a test, browse controls and their framework mappings, download and upload policy documents, review vendors and their risk attributes, and surface vulnerable assets with their remediation status. **It reads live data every time it’s asked.** The GRC lead asking “which [SOC 2 controls](https://axipro.co/soc-2/) have the most failing tests?” and the engineer asking “why is aws-s3-bucket-server-side-encryption-enabled failing?” are hitting the same server through different clients.

### Key use cases: compliance, failing tests, and vulnerability triage

Most of the value sits in a few workflows.

- **Failing test remediation** is the headline: list failing tests, look at the resources behind them, and generate console steps, CLI commands, or infrastructure-as-code snippets to fix them.
- **Vulnerability triage** lets you query open CVEs by severity and SLA deadline, as long as at least one scanner (AWS Inspector, Tenable, Wiz, Snyk, or similar) is connected to Vanta. Without a scanner those queries come back empty.

[**Compliance gap analysis**](https://axipro.co/services/gap-analysis/) covers framework progress, control ownership, evidence gaps, and cross-framework overlap, which is where GRC teams spend most of their time anyway.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

### What Vanta MCP enables for AI agents​

Vanta runs two versions of its MCP server. **The hosted remote server**, which this guide focuses on, lives at a regional URL, authenticates with OAuth in your browser, and is what Vanta now documents for every supported client. The older open-source local server ships as the **@vantasdk/vanta-mcp-server** npm package and runs on your machine with API credentials in an environment file. Vanta’s own repository for the local version now carries a deprecation notice pointing people to the hosted one, so treat it as a fallback for clients that can’t reach the hosted endpoint rather than the default.

Once connected, the agent can list and filter automated tests, pull the specific entities failing a test, browse controls and their framework mappings, download and upload policy documents, review vendors and their risk attributes, and surface vulnerable assets with their remediation status. **It reads live data every time it’s asked.** The GRC lead asking “which [SOC 2 controls](https://axipro.co/soc-2/) have the most failing tests?” and the engineer asking “why is aws-s3-bucket-server-side-encryption-enabled failing?” are hitting the same server through different clients.

### Key use cases: compliance, failing tests, and vulnerability triage

Most of the value sits in a few workflows.

- **Failing test remediation** is the headline: list failing tests, look at the resources behind them, and generate console steps, CLI commands, or infrastructure-as-code snippets to fix them.
- **Vulnerability triage** lets you query open CVEs by severity and SLA deadline, as long as at least one scanner (AWS Inspector, Tenable, Wiz, Snyk, or similar) is connected to Vanta. Without a scanner those queries come back empty.

[**Compliance gap analysis**](https://axipro.co/services/gap-analysis/) covers framework progress, control ownership, evidence gaps, and cross-framework overlap, which is where GRC teams spend most of their time anyway.

### Worth Knowing: Vanta's Automated Tests

Vanta's automated tests confirm that a configuration exists. They don't confirm that a control operated across the audit period. An agent that closes every failing test has cleaned up the dashboard, which is a different thing from passing the audit. Auditors still sample evidence, and the Vanta review goes into which automated tests are shallower than they look.

## **Prerequisites Before Connecting Vanta MCP**

### Finding your Vanta MCP URL

Vanta hosts a separate MCP server per region. Use the one that matches your instance, because the client won’t authenticate against the wrong region. Every example below uses the US URL. Swap in yours.

### Required Vanta permissions and roles

**You need to be a Vanta Admin.** The hosted MCP server isn’t available to non-admin users during the beta, and Vanta’s help center says broader access is planned but hasn’t shipped. This matters more than it sounds. The engineer who’d fix a failing S3 bucket is rarely an admin in Vanta, so in practice either the admin runs the query and hands off the plan, or the admin grants a role they wouldn’t otherwise grant. Neither is great, and the second one deserves a conversation with whoever owns access reviews.

You’ll also want at least one integration connected in Vanta. A cloud provider (AWS, GCP, or Azure) gives the agent failing resources to look at, and a version control integration (GitHub, GitLab, or Bitbucket) lets it trace failures back to the infrastructure-as-code that manages them.

### Generating authentication credentials

For the hosted server there’s nothing to generate. Every supported client authenticates with [OAuth](https://en.wikipedia.org/wiki/OAuth): it opens a browser window in your Vanta app, you click Allow, and the client stores a scoped token. **You never handle an API key, a client secret, or an environment file.**

The local open-source server is different. It needs a Vanta API application (client ID and secret) that an admin creates, stored in a JSON file and passed to the server through the VANTA_ENV_FILE variable. Vanta allows only one active access token per API application, so two teammates sharing the same credentials will keep logging each other out. If you go this route, create one application per person.

## **How to Connect Vanta MCP to Claude**

Vanta documents three ways in, and they aren’t equivalent.

### Option 1: One-click install for Claude

Vanta publishes a plugin in the Claude plugin directory, and the quickest path for anyone who isn’t an engineer is Claude Cowork. Add the Vanta plugin from the plugin directory, then go to Manage Plugins, open the Connectors tab, and install the Vanta MCP server as a custom connector using your regional URL. Complete the OAuth prompt, and you’re in. Adding custom connectors needs the right permission in your Claude workspace, so if the option is missing, your Claude administrator has to grant it.

This is the right choice for a GRC lead or founder who wants to ask questions of the compliance program without opening a terminal.

### Option 2: Installing the Vanta plugin for Claude Code

This is what Vanta recommends for engineers, because it’s the **only setup that includes the remediation skill, the slash commands, and the ability to open a draft pull request**. In the Claude Code CLI (the terminal app, not the browser), run these three commands in order:

```
/plugin marketplace update anthropics/claude-plugins-official
/plugin install vanta-mcp-plugin@claude-plugins-official
/reload-plugins
```

*Type them rather than pasting.* Claude Code treats a leading slash in pasted text as a file-path trigger and can open a file picker instead of running the command. Then run /mcp, select Vanta, choose your region, and finish the OAuth flow in the browser.

### Option 3: Manual MCP setup in Claude

If you only want the raw tools, one command registers the server:

```
claude mcp add --transport http vanta https://mcp.vanta.com/mcp
```

Then run /mcp, select vanta, and click Allow when the browser opens. You get every Vanta MCP tool. You don’t get /vanta:fix-test, /vanta:list-tests, or the PR-opening skill. For plenty of teams that’s fine, since the natural-language prompts in the workflow section below work the same way through the manual setup.

### Authenticating Claude with Vanta

All three options end on the same OAuth screen inside your Vanta app. Sign in as a Vanta Admin, click Allow, and the client stores the token. If the browser window never opens, Claude Code prints the authorization URL in the terminal, so open it yourself. If it’s expired by the time you get there, run /mcp, select Vanta, and choose Reconnect.

### Verifying the Claude connection

Run claude mcp list in the terminal, or /mcp inside the session, and check that vanta shows as connected. Then ask something that forces a live call: *“How many failing tests do I have in Vanta right now?”* If the plugin is installed, /vanta:list-tests should return a prioritized list. A response of zero failing tests either means a clean program or an expired token, and on a first run it’s almost always the token.

## **How to Connect Vanta MCP to Codex**

### Adding the Vanta MCP server to Codex

Codex Desktop and Codex CLI share a configuration, so you set it up once. In Codex Desktop: Settings, then MCP servers, then Add server. Name it Vanta, set the type to Streamable HTTP, enter your regional URL, and save.

In the Codex CLI:

```
codex mcp add vanta --url https://mcp.vanta.com/mcp
codex mcp login vanta
```

### Configuring authentication for Codex

In the desktop app, click Authenticate after saving and then Allow in the browser. In the CLI, codex mcp login vanta kicks off the same browser flow. Vanta lists Codex as a supported client, but the officially tested paths are Claude Code, Cursor, and Perplexity, so you may see a warning banner during setup saying the connection isn’t a first-party integration. *That’s expected.*

### Testing Vanta commands inside Codex

Check with codex mcp list, then ask Codex to show the highest-priority failing Vanta tests for the repository you have open. Codex has repo access, so it can match failing resources to the Terraform or CloudFormation that manages them and propose a diff. What it can’t do is run the Vanta plugin’s /vanta:* commands or open a draft PR through the Vanta skill. You can still ask Codex to make the change and commit it with its own git tooling. The difference is that nobody has pre-built the remediation logic for you.

## **How to Connect Vanta MCP to Cursor**

### Installing Vanta MCP in Cursor

Open Settings in Cursor, go to Tools & MCP, and choose Add custom MCP.

Configuring the MCP server file in Cursor

Paste this into the configuration:

```
{
"mcpServers": {
"vanta": {
"url": "https://mcp.vanta.com/mcp"
}
}
}
```

Save, then click Allow when Cursor opens the OAuth flow. Cursor connects straight to the hosted server with access to every Vanta tool. As with Codex, the Claude Code plugin skills aren’t available here.

### Running your first Vanta query in Cursor

Cursor is the strongest of the four for engineers who live in an IDE, because the agent sees both the failing resource from Vanta and the file that defines it. A good first prompt: *“List the failing Vanta tests for this repo, then show me which files in this project define the failing resources.”* If the answer comes back with tests that have nothing to do with your codebase, you probably have a different project open than the one Vanta’s version control integration is watching.

## **How to Connect Vanta MCP to Perplexity**

### Adding Vanta MCP to Perplexity

In Perplexity, create a new remote custom connector and enter your regional MCP URL.

### Authenticating Perplexity with Vanta

Set Authentication to OAuth and complete the Allow step in your Vanta app. That’s all there is to it.

### Running compliance queries from Perplexity

Perplexity has no repository or shell access, so it behaves differently from the three coding tools. Ask for failing tests “ranked by severity” rather than “relevant to this repository,” and paste a one-line description of your stack (*“we run on AWS with GitHub Actions”*) to steer the results. Remediation plans come back as console-first steps plus generic Terraform or CloudFormation snippets you can drop into a ticket. For a GRC lead who wants to check SOC 2 control coverage or find overdue vendor reviews before a Monday standup, that’s the right shape. **For an engineer it’s a briefing rather than a fix.**

## **What You Can Do With Vanta MCP Across These AI Tools​**

The four clients share the same server and the same tools. What differs is context and automation.

### Query and remediate failing tests

This is the core loop and it works in every client. The agent calls Vanta for failing tests, filters by what it can see, and returns test IDs with severity. Ask for the resources behind one test and you get the exact bucket, repo, or IAM policy that’s out of spec.

### Triage vulnerabilities from your IDE or chat

Prompts like *“list every critical vulnerability whose remediation deadline is in the next 30 days and tell me which are assigned”* work as written, with the scanner caveat from earlier. With repo access on top, an engineer can go from a CVE in Vanta to the dependency manifest that pulled it in without opening a browser tab.

### Generate remediation plans automatically

The plan format is consistent across clients: a CLI command for the fastest fix, console steps for resources that aren’t managed by code, and an IaC snippet to stop it recurring. **The agent won’t run commands that change live resources on its own.** It shows them to you and asks. Leave that behavior alone.

### Open draft pull requests from AI agents

Only the Claude Code plugin does this through Vanta’s skill. It scans for .tf files in the repo root and common subfolders (infra/, terraform/, ops/), matches your module structure, generates a minimal diff, and opens a draft PR against your current branch. It supports Terraform, CloudFormation, and CDK, so tell it which one you use. Review the diff for variable references and backend state before you mark it ready.

### Manage Vanta programmatically via API

MCP is a conversational layer over the same Vanta REST API. Anything you want to run on a schedule, in CI, or in a dashboard belongs in a script against the API with a proper API token. **The MCP server is for poking around and one-off fixes.**

**Insider Note:** The failing tests we see most on first-time SOC 2 programs are branch protection and MFA enforcement, and once teams start using an agent to fix them the pattern is predictable. The resource gets fixed by CLI, the Terraform never gets updated, and the next terraform apply puts it right back. The draft-PR path exists so the IaC changes along with the resource. *If you fix by CLI, open the IaC ticket in the same breath.*

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## **Example Workflow: Remediating a Failing Test With Vanta MCP**

Vanta’s own quickstart budgets 15 minutes for this. That’s realistic for the query and the plan. It doesn’t include the time to apply and verify the fix.

### Step 1: List your highest-priority failing tests

Ask: *“Show me the highest-priority failing Vanta tests relevant to this repository.”*

In the Claude Code plugin, /vanta:list-tests does the same thing. A typical response names a dozen failing tests and ranks the top five for your repo, something like GitHub repos requiring pull request reviews (github-repo-require-pr-reviews, HIGH), S3 server-side encryption (HIGH), and an IAM password policy minimum length (MEDIUM). Pick a HIGH severity test ID.

### Step 2: Inspect failing resources

Ask: *“Show me which specific resources are failing the github-repo-require-pr-reviews test.”*

You get the list: four repositories, each with the reason (no branch protection rule on main, protection that requires zero reviewers, and so on). If you see resources you don’t recognize, check the integration field. Companies with several GitHub orgs or AWS accounts routinely find failing resources in an account someone else owns.

### Step 3: Generate a remediation plan with your AI agent

Ask: *“Generate a remediation plan for this test. Include console steps, CLI commands, and a Terraform snippet I can adapt.”*

In the plugin, /vanta:fix-test github-repo-require-pr-reviews. The response gives you three options: a gh api call to set branch protection per repo, the UI path under each repo’s Settings, and a github_branch_protection Terraform resource that requires one approving review. Pick based on whether the resource is managed by code.

### Step 4: Open a draft PR

This step is Claude Code plugin only. With the repo open locally and push access, ask: *“Open a draft pull request with the IaC changes from this plan.”*

You get a PR number and a link. If the plugin can’t find your Terraform files, point it at the folder. If it can’t find the failing resource in this repo at all, the resource lives somewhere else, and the CLI option from Step 3 is your fallback.

### Step 5: Verify the fix in Vanta

After the PR merges or the CLI runs, ask: *“What is the current status of the github-repo-require-pr-reviews test in Vanta?”*

Vanta re-evaluates on its next sync, usually within 24 hours. Until then the test still shows as failing, and re-asking the agent won’t change that. You can trigger a sync from the Vanta dashboard if you need it sooner.

### Pro Tip: Run the Verification Prompt

Run the verification prompt the next morning rather than five minutes after the merge. Teams that expect an instant green check assume the fix failed, reopen the ticket, and sometimes apply a second change on top of the first. The 24-hour lag is how Vanta syncs, and says nothing about your fix.

## **Troubleshooting Vanta MCP Connections**

### Fixing plugin install errors in Claude

Two errors cover most cases.

- **“Invalid marketplace source format”** means you skipped the first command. Run /plugin marketplace update anthropics/claude-plugins-official and retry the install.
- **“Repository not found”** on install usually means an outdated Claude Code version, a stale marketplace listing (run the update command again), or a VPN or corporate proxy blocking github.com.

Claude Code fetches the plugin from both anthropics/claude-plugins-official and VantaInc/vanta-mcp-plugin, so both need to be reachable. If it still fails, fall back to the manual claude mcp add setup. You lose the slash commands and keep every tool.

### Resolving authentication failures

Zero failing tests on a program you know has failures means the OAuth token expired. Reconnect through /mcp in Claude Code, re-trigger OAuth in Cursor or Perplexity settings, click Authenticate in Codex Desktop, or run codex mcp login vanta.

If authentication fails outright, check that you’re signed into Vanta as an Admin, that you’re using the URL for your region, and that you completed the Allow step in the same browser profile the client opened.

### Debugging MCP server not appearing in Cursor, Codex, or Perplexity

In Claude Code, /plugin and /mcp only work inside the CLI, so if you typed them into a web chat window nothing got registered. Run /reload-plugins and wait a few seconds. If Vanta is still missing, reinstall. In Cursor, check that the JSON saved without a syntax error and that the key is url rather than command (the command form is for the local stdio server). In Codex, codex mcp list tells you whether the server registered before you go digging in the desktop settings. In Perplexity, a connector that saved but never prompted for OAuth is usually one where Authentication got left on the default instead of OAuth.

## **Best Practices for Using Vanta MCP With AI Coding Agents**

### Choosing the right AI tool for each Vanta task

Use the Claude Code plugin when the failing resource is managed by IaC in a repo you have locally, because the draft PR closes the loop. Use Cursor or Codex when your team already lives there and wants the same repo-aware investigation with its own commit workflow. Use Perplexity or Claude Cowork for status questions, control coverage, vendor reviews, and anything a non-engineer needs before a meeting. *Trying to remediate infrastructure from Perplexity gets you a good ticket and nothing more.*

### Securing credentials and scopes

The hosted server’s OAuth model removes the worst credential risk, which is long-lived secrets sitting in config files. Connecting an agent to your compliance system is still a decision your security program should record. The [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) puts token mismanagement and over-broad scopes near the top of its list, and [OWASP’s write-up on MCP tool poisoning](https://owasp.org/www-community/attacks/MCP_Tool_Poisoning) explains the mechanism that should worry you most: a malicious or compromised MCP server returns tool responses with hidden instructions inside, and the agent treats them as trusted input. A [2026 study on arXiv](https://arxiv.org/html/2603.21642v1) tested real-world MCP clients against these injection vectors and found the protections uneven from one tool to the next.

None of that means avoiding MCP. It means connecting only first-party servers you trust (Vanta’s hosted endpoint qualifies), keeping the agent’s write access off by default, reviewing every diff before it merges, and treating the Vanta MCP connection as a vendor integration in your access review, with an owner and a way to revoke it. Since only admins can connect right now, the list of people with an active token should be short and known.

**Important:** Everything the agent returns is Vanta’s data filtered through a language model. It can misread a test ID, propose a Terraform change against the wrong module, or confidently summarize a control’s status from stale context. Vanta’s own documentation tells users to verify AI-generated output before acting on it. For anything touching production infrastructure, that means a human reads the diff.

### Combining multiple AI clients in a single workflow

Nothing stops you connecting all four. The GRC lead runs coverage queries in Perplexity and files the failing test in the tracker, and the engineer picks it up in Claude Code with /vanta:fix-test. Each client holds its own OAuth token against the same server. The only coordination problem is a human one: agree on who applies fixes and who verifies them, or two people will remediate the same resource on the same afternoon.

## **Where an Implementation Partner Fits**

The MCP server makes it faster to see and fix individual test failures. It doesn’t decide which frameworks you need, scope the audit, write the policies, build the risk register, or deal with the auditor. Those are the parts that stall first-time SOC 2 and ISO 27001 programs, and they’re the parts a [Vanta implementation partner](https://axipro.co/vanta/) exists to carry. Axipro runs the program inside the client’s Vanta workspace, from gap analysis through external audit, on the Achievement Plan with guaranteed certification. Partner pricing on the platform itself is covered in the [Vanta cost guide](https://axipro.co/how-much-does-vanta-cost/). Once the program is live, the engineers keep the tests green from their own IDE. That split is what MCP is good for.

## **Conclusion**

Vanta MCP turns a compliance dashboard into something you can question from Claude Code, Codex, Cursor, or Perplexity. Setup is one URL and one OAuth prompt per client, the failing-test workflow is the same everywhere, and the Claude Code plugin is the only path that opens a draft PR for you. The limits are real. Access is admin-only during the beta, fixes take up to a day to show as passing, and nothing replaces a human reading the diff. Inside those limits, it takes most of the friction out of getting from “the test is failing” to “the fix is in review.”

## Frequently Asked Questions

Is Vanta MCP free to use?

There’s no separate charge for the hosted MCP server. Vanta released it in beta to all customers, and the original 2025 launch made the local server available on the Core package and above. The AI tool on the other side has its own cost, since Claude Code, Codex, Cursor, and Perplexity each need their own paid plan for real use.

Which AI tools officially support Vanta MCP?

Vanta lists Claude Code, Cursor, and Perplexity as officially tested paths, with Codex (Desktop and CLI) and Claude Cowork documented alongside them. Any client that supports a remote MCP server with OAuth should connect using the same URL, including VS Code through an MCP-capable extension and Windsurf, though those aren’t formally validated. You can connect several clients at once, and each holds its own token.

Does Vanta MCP work with self-hosted or local models?

The hosted server doesn’t care which model sits behind the client, only that the client speaks MCP over HTTP with OAuth. A local model running inside an MCP-capable client would work in principle. The practical question is quality. Remediation plans and Terraform diffs are where smaller local models tend to fall down, and no local setup gets the Vanta plugin’s slash commands.

What’s the difference between the Vanta MCP server and the Vanta API?

They expose the same underlying data. The API is for code: scheduled jobs, CI checks, dashboards, anything automated, authenticated with an API token. The MCP server is for conversation, meaning an engineer or admin investigating and fixing things interactively through an AI agent, authenticated with OAuth. If you find yourself running the same MCP prompt every morning, that prompt wants to become an API script.

How secure is connecting an AI agent to Vanta?

The connection itself uses OAuth with per-client tokens and no stored secrets, which is the right design. The risk is in what the agent does with what it reads and what it’s allowed to change. Keep changes behind human approval, connect only trusted first-party MCP servers, review diffs before merging, and log the connection as a vendor integration with an owner and a way to revoke it. The OWASP MCP Top 10 is the current reference for the risk categories worth covering in that review.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- September 1, 2026
- [Vanta](https://axipro.co/category/vanta/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [All Blog](https://axipro.co/category/blog/), [Customer Stories](https://axipro.co/category/stories/), [Denmark](https://axipro.co/category/denmark/), [ISO-27001](https://axipro.co/category/iso-27001/)

- September 19, 2026

#### [How Haime got through its first ISO 27001 internal and external audits in under four weeks with Axipro](https://axipro.co/haime-iso-27001-internal-external-audit/)

Haime, a Danish AI governance software company, completed independent ISO 27001 internal and external audits with Axipro in under four weeks in 2026.

[Read more](https://axipro.co/haime-iso-27001-internal-external-audit/)

- [ISO-9001](https://axipro.co/category/iso-9001/)

- September 18, 2026

#### [ISO 9001:2026 Changes: What’s New and How to Transition](https://axipro.co/iso-9001-2026-changes/)

ISO published ISO 9001:2026 on September 16, 2026, and the 2015 edition is now formally withdrawn. If you hold a certificate, the good news is that the structure and the process approach are the same, and the list of new requirements is short. Top management now has to promote a quality culture and ethical behavior. Risks and opportunities get handled separately, change management carries more weight, and the 2024 climate change amendment sits inside the core text. That’s most of it. Below, we go through each change clause by clause, cover what stayed where it was, set out the transition timeline, and list the work a certified company has to do before the deadline. Key Takeaways ISO 9001:2026 is the sixth edition of the standard and replaces ISO 9001:2015. Most of the new text is guidance, and only a small part of it adds requirements. The changes that carry audit weight are in Clause 5.1 (quality culture and ethical behavior), Clause 6.1 (risks and opportunities addressed separately), and Clause 6.3 (planning of changes). ISO 9001:2015 certificates stay valid during the transition period, which is expected to run for three years, until around September 2029. Your certification body confirms the exact date. Certification bodies need their own accreditation to the new edition before they can issue 2026 certificates, so nobody has to panic this quarter. A healthy 2015 system needs a gap analysis, some document updates, and better leadership evidence. You won’t have to rebuild it. ISO 9001:2026 Is Now Published: Where the Revision Stands On September 16, 2026, ISO announced the publication of ISO 9001:2026. ISO describes the edition as a set of targeted updates that make the standard clearer and easier to use, built on the framework more than one million organizations already work with. The official ISO 9001:2026 standard page is live. ISO’s page for ISO 9001:2015 now marks that edition as withdrawn and tells certified organizations to speak to their certification body about transition arrangements. It took longer to get here than planned. ISO’s quality committee first voted to leave the 2015 edition alone, then changed its mind in August 2023 after wider consultation. The Draft International Standard followed in August 2025, the final draft went to ballot in spring 2026, and publication hit the September target. Two companion documents came out earlier in the year. ISO 9000:2026, the fundamentals and vocabulary standard, was published in May 2026, and ISO 19011:2026, the auditing guideline, was updated around the same time. If your internal audit procedure cites either one by year, add it to the update list. Why ISO 9001:2015 Was Revised Eleven years is a long time for a management standard. Since 2015, supply chains have become more fragile, remote, and hybrid work has changed how processes run, and customers ask harder questions about ethics and data integrity than they used to. ISO reviews its standards on a regular cycle, and in 2023 the consensus was that a revision would be worth the effort. According to ISO/TC 176/SC 2, the subcommittee responsible for ISO 9001, 81 experts from 46 countries and liaison bodies took part. The result is still conservative, and that was a choice. A standard with a million-plus users can’t afford a rewrite every decade, so the committee went for clarification. ISO 9001:2026 vs ISO 9001:2015: Summary of Changes Area ISO 9001:2015 ISO 9001:2026 Structure Annex SL high-level structure, Clauses 4 to 10 Same clause layout, updated to the latest Harmonized Structure Clause 3, terms Points entirely to ISO 9000 Includes a limited set of core terms; ISO 9000:2026 remains the normative reference Climate change Added by Amendment 1 in 2024 Built into Clauses 4.1 and 4.2 Leadership (5.1) Commitment to the QMS and customer focus Adds promotion of quality culture and ethical behavior Risks and opportunities (6.1) Addressed together Addressed separately, with distinct actions for each Planning of changes (6.3) Brief requirement Reinforced to protect intended results Annex A Short clarification of structure and terms Expanded guidance on the intent of requirements, informative only Annex B Listed other ISO/TC 176 standards Removed; references moved to Annex A and the committee website Key Changes in ISO 9001:2026, Clause by Clause Clause 3: Core Terms Now Sit Inside the Standard The 2015 edition sent readers to ISO 9000 for every definition. The 2026 edition brings a limited number of core management system terms into Clause 3 itself, and ISO 9000:2026 remains the normative reference for the full vocabulary. There’s nothing to set up here. Just check that your quality manual and procedures don’t cite definitions by their old source or year. Clause 4: The Climate Change Amendment Is Now Core Text In February 2024, ISO amended every major management system standard. Organizations had to determine whether climate change is a relevant issue (4.1) and whether interested parties have related requirements (4.2). That amendment took effect immediately, with no transition period, and ISO 9001:2026 folds the same text into the body of the standard. If you handled the amendment properly in 2024, you have nothing new to do. If you wrote “not applicable” on a sticky note, go back to it, because auditors will now read this as a standing requirement. Not relevant is a perfectly acceptable conclusion for many businesses, as long as there’s a reason written down behind it. Clause 5.1: Quality Culture and Ethical Behavior Become Leadership Duties This is the change everyone is talking about, and it’s the hardest one to evidence. Top management now has to show leadership by promoting a quality culture and ethical behavior. The same themes turn up in the requirements for awareness (7.3) and the environment for the operation of processes (7.1.4). You don’t need a culture program for this, and you don’t strictly need a new code of conduct, although one helps. What the auditor wants is for top management to show what they do day to day. Management review minutes where quality problems get discussed without blame are good evidence. So is a working route

[Read more](https://axipro.co/iso-9001-2026-changes/)

- [ISO 42001](https://axipro.co/category/iso-42001/), [SOC-2](https://axipro.co/category/soc-2-2/)

- September 17, 2026

#### [AI Agent Audit Log Requirements: ISO 42001 & SOC 2](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

An AI agent reads a customer record, decides a refund is warranted, and calls the payments API. The trail it leaves looks nothing like a human doing the same job. The log says a user logged in, a service account made three API calls, and the transaction cleared. It doesn’t say why the agent decided on a refund, what it read first, which model version did the reasoning, or who gave the agent permission to act in the first place. That missing “why” is the whole audit problem. This article covers what ISO/IEC 42001:2023 and the SOC 2 Trust Services Criteria expect from AI agent audit logs, where the two overlap, the fields a log needs to satisfy both, how long to keep records, what you shouldn’t record, and how to package it all for an auditor. It’s written for the CTO, platform lead, or founder who owns compliance for a product that now ships with autonomous agents and needs a certification and a Type II report without running two separate logging programs. The Compliance Gap: Traditional Application Logs vs. AI Agent Audit Logs Why Standard Logs Fall Short for Autonomous Agents Application logs were built for deterministic software. Same input, same state, same output, so recording the input, the state change, and the result is enough to reconstruct what happened. A SOC 2 auditor sampling access logs can trace a database write back to a login, a role, and a change ticket without much effort. Agents break that chain in a few places. They usually run under a shared service account or a borrowed OAuth token, so the log pins the action to a machine identity with no link to the human who set the task. The action itself was picked at runtime by a model rather than fixed in code, so there’s no source line to point at. The same prompt can produce a different tool call tomorrow, so a single sampled log entry proves almost nothing about how the system behaves in general. The Shift from Deterministic State Logging to Intent and Reasoning Capture Traditional logs answer “what changed.” Agent audit logs also have to answer “what was the agent trying to do, what did it consider, and what held it back.” That means capturing the task as delegated, the context the model was handed, the reasoning or planning steps it produced, the tools it picked and the arguments it passed, and every point where a guardrail stepped in. The unit of audit moves from the event to the decision, and each decision needs enough surrounding context that a reviewer can judge whether it was reasonable. Unique Audit Challenges of Non-Deterministic AI Behavior Non-determinism is the part auditors struggle with most. In a normal control test, the auditor re-performs the control and expects the same result. Re-run the same input through an agent and you may get a different path. The practical answer is to stop trying to prove that any single output was correct and instead prove that every output was recorded, attributed, bounded by policy, and reviewable. Logs show that the management system works. They don’t show the model is infallible, and nobody expects them to. ISO 42001 accepts this framing outright. SOC 2 auditors are still catching up, and you’ll spend some time educating them. Insider Note: Auditors don’t expect you to explain the model’s weights. They expect you to show that when the agent did something unexpected, you could find it, see what it read, see what it did, and see who was accountable. Frame every logging decision around that reconstruction test. What ISO 42001 Requires for AI Agent Audit Logs ISO/IEC 42001:2023 is the certifiable standard for an AI Management System (AIMS). It follows the same Plan-Do-Check-Act structure as ISO 27001 and comes with 38 Annex A controls. The phrase “audit log” barely appears in it, but logging obligations run through the main clauses and at least three Annex A areas. Our ISO 42001 certification services map these to your existing controls where possible. Clause 8: Operational Logging and Documentation Requirements Clause 8 asks you to plan, run, and control the processes needed to meet your AI requirements, and to keep documented information showing those processes ran as planned. For an agent in production, the process is the runtime behavior, so documented evidence means logs of the agent operating, not a procedure document on its own. Clause 8.4 adds an AI system impact assessment whose results you have to retain. When an agent’s scope or toolset changes, the record of that change and the updated assessment are both Clause 8 evidence. Clause 9: Performance Evaluation and Evidence of Monitoring Clause 9.1 asks you to decide what to monitor and measure, how, and when, and to keep evidence of the results. An auditor will want the monitoring you defined for each agent (error rates, guardrail block rates, tool-call anomalies, how often humans override) and the records showing you reviewed it. Clause 9.2 internal audit and 9.3 management review both feed off those records. Without operational logs, there’s nothing to measure, and Clause 9 falls over. Annex A.6: AI System Lifecycle Logging Obligations Annex A.6 is where logging gets explicit. A.6.2.8, AI system recording of event logs, requires you to decide at which phases of the AI system lifecycle event logging is switched on, and the Annex B guidance ties this to traceability and anomaly detection. A.6.2.6, AI system operation and monitoring, requires ongoing monitoring in operation, including AI-specific threats like data poisoning and model theft. Read together, they mean logging can’t start at go-live. Design decisions, validation runs, deployment configs, and production behavior all need a record. Annex A.9: Logging Requirements for AI System Operation Annex A.9 covers responsible use: processes for responsible use (A.9.2), objectives for it (A.9.3), and intended use (A.9.4). The logging consequence is that you need to show the agent stayed inside its intended use. That takes logs of the tasks it was given, the actions it took,

[Read more](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

WhatsApp us