Analysis. Aurigo Software announced on 22 September that it has achieved ISO/IEC 42001 certification for its artificial intelligence management system. The Austin company sells capital program management software — the systems that public owners and large facility owners use to plan, budget and deliver infrastructure — and the certification is the kind of announcement that reads as housekeeping until you look at who it is written for.
It is written for whoever fills in the security section of a request for proposal.
What Was Actually Certified
The distinction that governs everything below is in the release’s own wording. What was audited is Aurigo’s AI management system — the internal machinery by which the company decides what to build, what to ship and what to watch — not any individual model, feature or output.
The release sets out the scope: the assessment “covers Aurigo’s role in developing AI capabilities and providing AI products to customers,” and the audit “examined how Aurigo assesses risk before an AI feature ships, how model behavior is monitored once it’s live, how issues get escalated and fixed, and what evidence exists to show the management system is operating as intended.” Lumina AI, the company’s AI platform, “operates inside this management system.”
Read that list again as a procurement officer would. Every item is a process question — is there a gate, is there monitoring, is there an escalation path, is there evidence — and none of them is an accuracy question. That is what a management-system standard is for. ISO/IEC 42001 was published in 2023 as the international standard for AI management systems, and certification against it is performed by accredited third-party bodies; LRQA, one such body, describes the assessment as an independent two-phase audit covering governance obligations including data privacy and algorithmic bias.
A certificate under it is a statement that the company has a governed, auditable way of handling AI risk. It is not a statement that a given takeoff, forecast or summary produced by the software is correct. Both of those are worth having. They are not the same thing, and the gap between them is where most of the confusion about AI assurance currently lives.
“AI introduces risks that go beyond traditional cybersecurity, from data leakage and model drift to bias and unreliable outputs,” says Manish Sharma, Aurigo’s chief information and security officer, in the release. “ISO/IEC 42001 gives us a disciplined way to govern those risks across how we build, buy and use AI.”
Why a Capital-Program Vendor Wants This Particular Certificate
Aurigo’s customer base explains the timing better than the standard does. The company says it is trusted by over 300 organizations across infrastructure and facilities, manages more than $450 billion in capital programs, and has over 40,000 projects on the platform throughout North America. Those are Aurigo’s figures, and they describe a book of business weighted toward public owners — the agencies that buy software through formal, documented, contestable procurement.
The rest of the company’s compliance list points the same way. Aurigo says its Masterworks product is FedRAMP Class C Certified and GovRAMP Authorized, that it has recertified its business continuity management system against ISO 22301:2019 for 2026, and that it maintains SOC 1 and SOC 2 Type 2 attestations. That is a stack assembled for buyers who have to justify a selection in writing.
The release is unusually direct about the intended use. ISO/IEC 42001, it argues, “provides a recognized benchmark during RFPs, security reviews, and due-diligence processes,” rather than, in its words, “relying solely on vendor policies or self-attestation.” “AI is moving from helping teams find and summarize information to supporting decisions and actions across capital programs,” says Kevin Koenig, Aurigo’s chief technology officer. “For capital owners, the opportunity is to make AI part of day-to-day planning and execution, not a standalone feature. That only works if technology and governance mature together.”
Whatever else it is, that is a vendor telling its market that the AI questionnaire is coming.
On “Among the First”
The release states that “Aurigo is among the first construction and capital program management software providers to achieve ISO/IEC 42001.” That is Aurigo’s characterisation, and it is carefully scoped to its own category.
The wider record is worth giving readers, because the certificate is not new to this industry’s software. Autodesk announced ISO 42001 certification in August 2025 for the AI management system supporting its AI/ML Portal, which Autodesk describes as “our central platform for developing customer-facing AI products and features” — a platform-level scope across its AI products rather than a capital-program one, and more than a year earlier. We did not attempt a census of every AEC vendor’s certification status, so treat this as one documented prior example in the sector rather than a complete list of them.
Two things the 22 September announcement does not contain, both checked against its full text: it does not name the certification body that performed the audit, and it does not give the date the certificate was issued or the period it runs for. Neither omission is unusual in a release of this kind. Both are the sort of thing a buyer reading the certificate rather than the press release would want in front of them.
What It Changes, and What It Doesn’t
Analysis. The useful way to read this is as an early data point on how AI assurance gets priced into construction software procurement — not as a verdict on Aurigo’s products.
Public capital programs are the part of this industry with among the most formal buying processes and little appetite for decisions it cannot explain on the record. A state transportation department cannot easily defend a schedule or a payment decision by saying the software suggested it. As vendors move, in Koenig’s framing, from summarising information to supporting decisions, the owner’s exposure moves with them — and the natural institutional response is to demand a document.
ISO/IEC 42001 is the document that currently exists. Its limitation is the one named above: it certifies that a company governs its AI in an auditable way, which is a real and non-trivial thing to demonstrate, and says nothing about whether any particular output is accurate. A certified vendor can still ship a bad forecast. What it cannot easily do is ship one with no gate, no monitoring and no record of who knew what.
That is a lower bar than the industry’s marketing language implies, and a higher bar than a self-written AI policy. This newsroom’s own reporting keeps landing on the same underlying problem from the other direction: in ServiceTitan’s September survey, a majority of AI-using commercial contractors reported a positive impact while about one in seven could point to clear ROI — a gap that exists largely because the before-state was rarely instrumented. Governance standards attack the same weakness from the vendor side. They force the evidence to exist.
The prediction worth making is narrow: if AI features keep migrating into the decision path of publicly funded work, the AI-governance question stops being a differentiator and becomes a line item, the way SOC 2 did. Vendors with the certificate will stop advertising it. Vendors without it will start being asked why. Aurigo, along with Autodesk’s much broader AI push across Forma and Revit, is early to a requirement rather than ahead of a market.
Sources
- Aurigo Software’s announcement, GlobeNewswire, 22 September 2026. All quotations from Aurigo and all company figures in this article are drawn from that release. GlobeNewswire blocks automated fetching; the release text was read verbatim from its FinancialContent syndication.
- Aurigo Software
- Autodesk’s announcement of its own ISO 42001 certification, 27 August 2025.
- LRQA’s description of ISO/IEC 42001 certification, used here for what an accredited assessment involves.
