On 13 July, Indra Group became the first Spanish company to receive AENOR’s “Responsible AI Technology based on Microsoft tools” certification. The assessment validates the operational controls around two specific AI agents built with Microsoft Copilot Studio—not just the underlying models. For organizations that have been wondering whether their AI bots can survive a compliance audit, the certification provides a practical starting point.
What the Certification Actually Covers
AENOR’s scheme doesn’t examine a company’s AI policy document or a broad statement of principles. It drills into the guardrails wrapped around particular agents: traceability, data quality, cost management, technical configuration, version control, testing protocols, and the collection of objective evidence across the agent’s lifecycle. As Indra Group’s Head of Systems Governance, Carmen Bauset, notes, “Control lies in the iterative nature of the process, rather than in the algorithm itself.”
The two certified use cases—an onboarding assistant for new employees and a regulatory-compliance supervisor supporting ISO/IEC 20000—were built with Microsoft Copilot Studio. Each had to follow Indra’s six-stage agent-development methodology: defining business requirements, understanding data, preparing and labelling data, designing and configuring the agent, conducting internal evaluation and pilot testing, then iteratively deploying and maintaining it.
Crucially, the certification does not extend to every AI deployment inside Indra Group. It’s a stamp on these two agents and the processes that manage them. That granularity is deliberate. “The challenge lies not in the AI model itself, but in how it is designed, configured and operated,” says Bauset. AENOR’s assessment reflects that: it’s about the operational wrapper, not blanket approval.
What It Means for You
For Windows and Microsoft 365 administrators, the certification is a wake-up call. Microsoft provides tools like Copilot Studio, but the responsibility for building and operating agents safely remains squarely with the customer. The AENOR framework indicates what auditors will start asking for: documented controls, test records, data-source approvals, and clear human-in-the-loop sign-offs for high-risk workflows.
Consider the average Copilot Studio project today. A line-of-business department might spin up a bot to answer HR queries or route IT tickets. An admin might configure a few knowledge sources and hand it over. Under the kind of scrutiny AENOR applied to Indra’s agents, that approach would fail. You’d need to show:
- Which datasets the agent can access and why.
- Who is allowed to modify its instructions or knowledge.
- How its outputs are monitored for accuracy and drift.
- That spending limits are set and monitored (FinOps).
- That version history is retained for every configuration change.
- That test results and evidence of review are available for inspection.
This isn’t just about compliance paperwork. For an HR onboarding assistant, getting an answer wrong about benefits could create legal liability. For a compliance supervisor, missing a regulatory update could lead to a failed audit. The certification signals that organisations will need to treat AI agents as managed production systems, with the same rigour they apply to a payroll application.
For power users and citizen developers, the message is similar: your clever little bot may soon need an owner, a documented change log, and a feedback loop. IT departments are likely to tighten governance around all Copilot Studio deployments as frameworks like AENOR’s gain traction.
How We Got Here
Microsoft and AENOR announced their collaboration on an ethical and responsible AI certification framework in September 2024. At the time, they said the work would align with Microsoft’s responsible-AI principles—fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability—as well as international standards such as ISO/IEC 42001 and European AI regulation.
That timeline is important. The EU AI Act’s high-risk provisions are approaching, and companies with a presence in Europe are racing to shore up their AI governance. ISO/IEC 42001, the first global standard for AI management systems, provides a playbook for organisations to establish, implement, maintain, and continually improve an AI management system. AENOR, as Spain’s national standards body, is well positioned to turn those high-level requirements into auditable criteria for specific technology stacks—in this case, Microsoft tools.
Microsoft itself has been building responsible AI tooling into its platforms. Azure AI Content Safety, prompt shields in Azure AI Studio, and the Responsible AI dashboard for machine learning models are all part of that effort. But Copilot Studio sits a layer above: it’s a low-code environment where non-developers can string together AI capabilities. The risk is that the very accessibility that makes it popular also makes it easy to bypass traditional IT controls. The AENOR certification is one of the first attempts to bridge that gap in a measurable way.
What to Do Now
If your organisation is using or planning to use Microsoft Copilot Studio, start treating agents like production services. Here are concrete steps you can take today:
-
Inventory your agents. List every Copilot Studio agent, its purpose, its creator, and its contact person. Many organisations are surprised by how many bots have been deployed informally.
-
Define approved data sources. For each agent, document which knowledge bases, SharePoint sites, or databases it can tap. Restrict access to the minimum necessary.
-
Enable logging and monitoring. Turn on Copilot Studio’s built-in analytics and export conversation logs. Store them in a secure location for at least 90 days.
-
Set spending alerts. Configure the message consumption quota and set up alerts in the Power Platform admin centre so no department accidentally runs up a five-figure AI bill.
-
Implement version control. Export agent solutions regularly and store them in a git repository or SharePoint document library. Label each version with a description of what changed.
-
Document your testing. For high-stakes agents, run test prompts, record the outputs, and have a subject-matter expert sign off on accuracy before deployment. Keep those records.
-
Establish a review cadence. Schedule quarterly reviews of each agent to check for performance drift, outdated knowledge, and new security requirements.
For organisations that want to go further, Indra’s six-stage methodology offers a template. Microsoft also publishes a Responsible AI Standard v2 and a Copilot Studio governance guide that can help build your own framework.
Outlook
The AENOR certification is unlikely to remain a one-off. Microsoft has signalled that it wants to see similar certifications pursued by other partners, and the underlying standards are only getting more detailed. Over the next twelve months, expect to see more national standards bodies releasing comparable schemes for AI tools built on hyperscaler platforms.
For Windows and Microsoft 365 admins, the headline is simple: AI governance is moving from theory to practice. Indra Group’s certification provides a concrete example of what that looks like in a Microsoft shop. The companies that start building their audit trail now will be the ones that avoid a painful scramble when an auditor—or a regulator—comes calling.