Certifying the system or certifying the person: how ISO/IEC 42001 and ISO/IEC 17024 fit together

Two standards come up constantly in conversations about AI assurance, and they are routinely treated as alternatives. They are not. ISO 42001 and ISO 17024 certify different objects, answer different questions, and are most useful when an organisation holds both kinds of evidence. ISO/IEC 42001 is a management system standard; ISO/IEC 17024 sets out what a body must do before it can certify people.

What ISO/IEC 42001 certifies

ISO/IEC 42001 is a management system standard for artificial intelligence. A certified organisation has shown an auditor that it has an AI policy, an inventory of its AI systems, a risk and impact assessment process, assigned roles, controls over suppliers and data, and records showing that all of this is operated rather than merely written down.

The certificate is issued to the organisation. It survives staff turnover, which is a feature: the system is supposed to outlive the individuals. But that same property is its limit. A management system certificate says nothing about whether the person who performed the risk assessment understood the model they were assessing.

What ISO 17024 governs

ISO 17024 works one level up. It does not certify a person directly; it sets requirements for bodies that certify persons. An accredited body has to demonstrate that it is impartial, that the certification scheme rests on a defined competence rather than on a course it also sells, that the assessment is valid and reliable, that decisions are separated from training, and that recertification means something.

That last point is where most market credentials fall down. A certificate issued by the same organisation that sold the preparation course, with no separation between teaching and awarding, is a receipt rather than an assessment.

Two failure modes that explain the difference

• A certified system, staffed by people who have never read it. The policies are in place and the audit passed. The engineers deploying models have no idea which obligations apply to them, and the first they hear of the AI policy is during an incident review.
• A competent professional, in an organisation with no system. The individual knows exactly what should happen, raises it, and has nowhere to raise it to. No register, no owner, no process for recording the concern.

Neither certificate prevents the other failure. That is the whole argument for treating them as complementary.

How they combine in practice

• Procurement. Ask for the management system certificate, then ask who on the account holds a personal credential. The second question is the one suppliers are rarely prepared for.
• Audit. Competence of personnel is itself an auditable element of a management system. A personally held certification is cleaner evidence than a training log.
• Regulatory readiness. Article 4 of the EU AI Act places an AI literacy obligation on providers and deployers. An organisation discharges it through its people, which means it needs something that describes what its people can do.
• Incident response. A system tells you what should have happened. A professional standard tells you what the individuals owed, which is the question that actually gets asked afterwards.

Where AIEI sits

AIEI runs two tracks on purpose. One addresses organisations, through assessment and alignment with its AI ethics principles. The other addresses individuals, through the Responsible AI Professional Standard and the certification built on it. The personnel scheme has been designed for conformity with ISO/IEC 17024 since its first draft, and accreditation is in progress.

The short version: a management system certificate tells you an organisation has a process. A personal certification tells you someone in the room knows what to do with it.

Read next

• Why responsible AI needs a standard for people – why organisational frameworks leave the competence of individuals unaddressed.
• How we built AIEI-STD-RAIP-01 – the research behind the standard, from 171 coded obligations to 17 duties.

The Responsible AI Professional certification is the personnel scheme AIEI is building against ISO 17024.