Relevant approaches are beginning to emerge. Since 2023, ISO\/IEC 42001 has provided the first international standard for AI management systems [4], addressing governance requirements at the organizational level. In addition, process-oriented approaches are being developed that build on human-centered work design criteria [1] to assess whether the use of AI in work processes is human-centered in practice.<\/p>\n\n\n\n
A credible certification label can become a significant differentiator, provided it is more than just a certificate displayed on the wall. However, formal structures and day-to-day practice do not necessarily align [5], and the degree of implementation varies considerably [6,7]. Although established certification domains have generated substantial knowledge about the conditions and indicators associated with different levels of organizational institutionalization, these insights have not yet been systematically applied to the emerging field of AI certification. This article addresses this gap by examining the following research questions:<\/p>\n\n\n\n
Which indicators characterize the effective embedding of normative requirements within organizations, and how can this be identified through certification processes?<\/strong><\/p>\n\n\n\n What enabling and inhibiting conditions influence this process, and what specific characteristics emerge in the context of AI?<\/strong><\/p>\n\n\n\n The research sample comprises six experts from certification consulting, auditing, IT consulting in certified companies, and AI-specific standardization. Participants were purposively selected to cover perspectives across the entire certification process. The interview guide was divided into three sections: experiential knowledge from established standardization domains, transferability to the AI context, and reflection. The interviews were transcribed and analyzed using qualitative structured content analysis according to Kuckartz [8] with MAXQDA. Deductive categories were derived from the research questions and the guide, while inductive categories were added whenever recurring themes in the data were not adequately captured by the initial coding framework. The coding scheme is illustrated in Figure 1. The presentation of results follows its main categories and synthesizes conceptually related results.<\/p>\n\n\n\n A key finding from the interviews is that the substantive embedding of normative requirements is not evident in the certification process itself but becomes apparent only in day-to-day organizational practice beyond the audit. Whether normative requirements have truly been embedded can be reliably determined over the course of surveillance audits. This finding provides a more specific understanding of the decoupling between formal structures and organizational practice [5] described in the research.<\/p>\n\n\n\n The respondents unanimously described a characteristic pattern associated with a low degree of institutionalization: organizational activity increases shortly before an audit and declines again afterward. Symbolic compliance is therefore characterized not by complete nonimplementation but by recurring cycles of heightened and diminished system activity. Organizations with a high degree of institutionalization, by contrast, exhibit a different pattern. The intensity of management system activities increases from one audit cycle to the next because the organization regards the management system as an integral management tool rather than merely a certification requirement.<\/p>\n\n\n\n This pattern can be observed empirically using document management data, the development of internal audit reports, and trends in key performance indicators. At the process level, substantive integration is evident in modified interface workflows as well as in responsibilities accompanied by genuine decision-making authority. At the leadership level, it is evidenced by managers’ willingness to participate in internal audits themselves and by management reviews that are conducted as meaningful organizational self-assessments, resulting in the definition of concrete objectives for the following year.<\/p>\n\n\n\n The interviews further suggest that a low degree of institutionalization is often not the result of deliberate deception but rather of a lack of perceived meaning. When employees do not experience normative requirements as meaningful for their own work, or when the relationship between quality requirements and their daily activities remains unclear, these requirements remain abstract rules administered by a small group rather than being translated into routine organizational practice. This observation adds a process-oriented dimension to the decoupling mechanisms described in the literature [6, 7]. Decoupling is not solely the result of strategic exploitation but also of gaps in understanding and insufficient organizational translation efforts.<\/p>\n\n\n\n A particularly consistent finding across all interviews is the paramount importance of leadership commitment. Substantial embedding is most likely to succeed when senior management views normative requirements not as external impositions but as tools for organizational improvement and actively models this approach. Organizations whose leadership uses certifications to advance their own improvement objectives achieve long-term and more sustainable effects compared to those that act primarily in response to external pressure.<\/p>\n\n\n\n The respondents consistently distinguished between organizations that pursue certification due to external pressure and those that recognize an intrinsic need for improvement. This distinction reflects the logic of institutional isomorphism described in the literature [5, 9] and the legitimation paradoxes of standards [10]: Certifications are adopted without this necessarily being linked to a change in internal practices. However, motivation is not a fixed characteristic. Certification can act as a catalyst for changes that would otherwise be difficult to implement.<\/p>\n\n\n\n Another enabling condition is the design of the internal representative\u2019s role: With hierarchical access to senior management and the mandate to communicate uncomfortable findings, this role makes a significant structural difference. Conversely, when organizations deliberately fill this role without providing sufficient organizational support\u2014a practice repeatedly described in the interviews\u2014 they implicitly signal that implementation of the standard is not an organizational priority.<\/p>\n\n\n\n Among the most significant obstacles is the rejection of shared responsibility. When decision-making authority is concentrated among only a few and compliance requirements are perceived as a constraint, substantive embedding is unlikely to occur. A further challenge is standards inflation. When companies are required to comply simultaneously with multiple, sometimes contradictory requirements, their willingness to engage substantively with individual standards declines. Finally, according to the respondents, poor audit quality creates incentives for superficial compliance\u2014a connection confirmed by research [7]. Effective auditing therefore requires in-depth process understanding and domain-specific expertise.<\/p>\n\n\n\n The enabling and inhibiting factors identified in this study are summarized in Figure 2<\/strong>.<\/p>\n\n\n\n Respondents generally consider it possible to transfer the identified patterns to the process certification of human-centered AI use but note that this involves specific challenges. Three specific characteristics were identified in this context. First, the respondents described the operationalization of certification requirements as more difficult compared to traditional management system certification. While ISO 9001 builds on a long-established and operationalized concept of quality, concepts of human-centered work design\u2014such as transparency, traceability, and the promotion of human potential [1]\u2014must first be translated into organizational practice. The risk of decoupling [6] is particularly pronounced here: human-centered principles may be endorsed by senior management as organizational values without actually guiding day-to-day decision-making.<\/p>\n\n\n\n Second, the respondents pointed to the rapid evolution of AI systems as a fundamental challenge for traditional certification approaches. When AI systems and their effects on work processes evolve faster than recertification cycles, certificates risk becoming snapshots of past conditions or hindering the organization\u2019s adaptability. This creates a fundamental trade-off: certification requirements that are highly specific may become obsolete as the technology evolves, whereas requirements that are too generic may fail to capture the characteristics of individual AI applications.<\/p>\n\n\n\n Third, the interviewees identified the general availability of AI tools as a structural challenge without a direct counterpart in other certification domains: Since AI tools are easily accessible to employees on a personal basis, certified processes can effectively be undermined through the parallel use of unauthorized systems without this becoming visible to external auditors.<\/p>\n\n\n\n Taken together, these three points point to a fundamental shift: The primary challenge is not the establishment of a management system but the continuous monitoring and evaluation of dynamic human-AI interactions within the work process.<\/p>\n\n\n\n Three areas of action can be derived from the identified findings (Figure 1). They address complementary dimensions of effective certification and build on the key findings of the analysis: the importance of continuous audit cycles, the role of leadership commitment and internal representatives, and the challenges of operationalizing human-centered criteria in an AI context.<\/p>\n\n\n\n Design certification as a learning process rather than a compliance event. The findings suggest that the effectiveness of certification lies less in the certificate itself than in the organizational learning and reflection it stimulates. Certification for human-centered AI should therefore be conceived not as a one-time assessment of compliance but as a continuous process of organizational reflection that regularly encourages organizations to critically evaluate their use of AI. Because AI systems evolve more rapidly than conventional certification cycles, surveillance audits become more important than the initial certification itself. In practical terms, organizations should invest not only in achieving initial certification but also in establishing robust and continuous surveillance processes.<\/p>\n\n\n\n Leadership must lead the way. Substantive embedding stands or falls with the commitment of senior management. Leaders who subject themselves to audits, empower internal representatives with genuine authority, and use management reviews to define and monitor meaningful organizational objectives create the organizational conditions necessary to ensure that human-centered requirements extend beyond the executive level into day-to-day work. Substantial integration also requires a basic level of organizational awareness: Without an understanding of the risks associated with unauthorized AI tools, even certified processes remain vulnerable to informal workarounds. Organizations seeking certification for human-centered AI should therefore appoint an internal management representative with a clear mandate and direct access to executive management, integrate AI governance into existing management systems, and raise employee awareness of the responsible use of AI tools, including those used outside formally certified processes.<\/p>\n\n\n\n Develop practically applicable indicators. Human-centered requirements become embedded in organizational practice only when they are translated into operational indicators that can be applied in everyday work without sacrificing their normative intent. Requirements that remain overly abstract encourage superficial implementation rather than meaningful organizational change [6,7]. Frameworks such as the requirement structure of ISO\/IEC 42001 [4] provide an important starting point. However, because they primarily address organizational governance, they must be extended to assess the human-centered impact of AI at the process level. Initial practical support may be provided through professional training programs, such as certification courses for AI management representatives.<\/p>\n\n\n\n The patterns identified should be further examined and refined using real-world AI certification processes. Several methodological limitations should be acknowledged. Because the sample consisted of experts from established certification domains rather than AI-specific certification, the direct transferability of the findings is necessarily limited. Furthermore, profession-specific perspectives and potential biases among the interviewees were not systematically controlled. The proposed fields of action should therefore be regarded as an initial framework that requires further empirical validation.<\/p>\n\n\n\n Overall, the results suggest that the challenges of human-centered AI certification [1] do not lie in the certification event itself but in developing mechanisms capable of continuously monitoring, evaluating, and shaping the effects of AI on work over time. Current standardization initiatives [4] provide an important foundation for this objective. Their effectiveness, however, will depend largely on whether they succeed in integrating continuous organizational learning, leadership responsibility, and robust operational indicators into a coherent certification approach.<\/p>\nResearch design<\/h2>\n\n\n\n
![\"Figure](\"https:\/\/industry-science.com\/wp-content\/uploads\/2026\/08\/Morsch_Figure_2.jpg\")
Indicators of effective norm embedding<\/h2>\n\n\n\n
Enabling and inhibiting conditions<\/h2>\n\n\n\n
![\"Figure](\"https:\/\/industry-science.com\/wp-content\/uploads\/2026\/08\/Morsch_Figure_2_final-e1787575593208-1024x456.png\")
Characteristics specific to the AI Context<\/h2>\n\n\n\n
Paths to effective implementation: Implications for practice<\/h2>\n\n\n\n
Bibliography <\/h2>[1] Wilkens U, Lupp D, Langholf V: Configurations of human-centered AI at work: Seven actor-structure engagements in organizations. In: Frontiers in Artificial Intelligence 6 (2023), S. 1\u201317.\r
[2] Yates J, Murphy CN: Introduction: Standards and the Global Economy. In: Yates J, Murphy CN (Hrsg.): Engineering Rules. Baltimore 2022, S. 3\u201315.\r
[3] Brunsson N, Rasche A, Seidl D: The Dynamics of Standardization: Three Perspectives on Standards in Organization Studies. In: Organization Studies 33 (2012) 5\u20136, S. 613\u2013632.\r
[4] ISO: ISO\/IEC 42001:2023 \u2013 Informationstechnik \u2013 K\u00fcnstliche Intelligenz \u2013 Managementsystem. URL: www.iso.org\/standard\/42001 , Abrufdatum: 10.06.2026.\r
[5] Meyer JW, Rowan B: Institutionalized Organizations: Formal Structure as Myth and Ceremony. In: American Journal of Sociology 83 (1977) 2, S. 340\u2013363.\r
[6] Christmann P, Taylor G: Firm Self-regulation through International Certifiable Standards: Determinants of Symbolic versus Substantive Implementation. In: Journal of International Business Studies 37 (2006) 6, S. 863\u2013878.\r
[7] Boiral O, Gendron Y: Sustainable Development and Certification Practices: Lessons Learned and Prospects. In: Business Strategy and the Environment 20 (2011) 5, S. 331\u2013347.\r
[8] Kuckartz U: Qualitative Inhaltsanalyse. Methoden, Praxis, Computerunterst\u00fctzung. 4. Aufl. Weinheim 2018.\r
[9] DiMaggio PJ, Powell WW: The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in Organizational Fields. In: American Sociological Review 48 (1983) 2, S. 147\u2013160.\r
[10] Haack P, Rasche A: The Legitimacy of Sustainability Standards: A Paradox Perspective. In: Organization Theory 2 (2021) 4, S. 1\u201325.<\/div>Your downloads<\/h2>