Why responsible AI needs a standard for people, not another framework for companies

Ask for a responsible AI standard today and you will be handed something written for a company. ISO/IEC 42001 gives an organisation a management system. The NIST AI Risk Management Framework gives it a risk process. The EU AI Act gives it obligations, and the harmonised standards behind it will give it conformity routes. Every one of these is addressed to an organisation, not to a person.

None of them answers the question that surfaces in hiring conversations, procurement reviews and post-incident meetings: was the person doing this work competent to do it?

What the existing frameworks actually certify

An organisation certified to ISO/IEC 42001 has demonstrated that it runs an AI management system: policies exist, risks are assessed, roles are assigned, records are kept. That is worth having. It is also not a statement about any individual. The certificate stays with the company after the people who earned it have moved on.

A framework can establish that a control was required. It cannot establish that the engineer who implemented it understood why, or that the manager who waived it understood what was being waived.

Where the gap shows

• Hiring. A CV lists AI governance experience. There is no common instrument to verify what that experience amounts to.
• Procurement. Buyers increasingly ask suppliers to show that the people on the account are competent. Suppliers answer with training hours, because training hours are the only artefact they have.
• Regulation. Article 4 of the EU AI Act requires providers and deployers to ensure a sufficient level of AI literacy among the people operating AI systems on their behalf. It does not define the level, and the market has no shared way to evidence it.
• Incidents. After something goes wrong, the question is rarely whether a policy existed. It is whether anyone in the chain recognised the problem and said so in time.

A professional standard is a different kind of object

Mature professions settled this question a long time ago. A hospital holds accreditation; a doctor holds a licence. An audit firm maintains quality controls; the auditor holds a personal qualification. The two certificates answer different questions, and neither is accepted as a substitute for the other.

A professional standard states what an individual owes: competence kept current, limits acknowledged, evidence recorded, concerns raised through the right channel, claims not overstated. Those duties travel with the person between employers, which is exactly what makes them useful to the employer doing the hiring.

What a responsible AI standard for people contains

AIEI-STD-RAIP-01, the Responsible AI Professional Standard, sets out 17 duties in six parts: Duty, Competence, Responsible practice, Honesty and openness, Accountability, and Integrity under pressure. It is deliberately short and deliberately flat – one standard and one examination for people who develop, deploy, manage or use AI systems. Differences between roles are handled in a guidance annex rather than by splitting the credential into tiers.

It is also written to be assessable. Every duty is phrased so that a candidate can be examined on whether they would apply it in a realistic situation, which is a stricter filter than it sounds: a large share of what circulates as responsible AI guidance does not survive it.

Where this goes next

The Responsible AI Professional certification launches on 11 November 2026, with the first examination window opening in early December. The scheme was designed for conformity with ISO/IEC 17024 from the first draft onwards. Accreditation is in progress, and we will describe it that way until it is not.

Frameworks for organisations are necessary. They are not sufficient, because an organisation does not assess a model, waive a control or sign off a deployment. A person does.

Read next

• How we built AIEI-STD-RAIP-01 – the research behind this responsible AI standard, from 171 coded obligations to 17 duties.
• ISO 17024 and ISO 42001 – how certifying a person and certifying a management system fit together.

The Responsible AI Professional certification is the credential built on this responsible AI standard.