The certificate is issued. The control isn't.

Here is an uncomfortable observation: inside seven days, three separate organisations started selling AI trust. KPMG opened a Trusted AI Centre of Excellence. Gartner crowned its first leaders in "AI agent management platforms" – a category that barely existed a year ago. And a brand-new firm launched with one product line: monitoring, governing and certifying other people's AI operations. An assurance market, essentially overnight. I have seen this film before. It was called ISO 9001, and the certified plants still shipped scrap.

What a certificate can actually see

External certification sees what you choose to surface. Policies, model cards, risk registers, committee minutes, questionnaires answered by people whose job is answering questionnaires. All of it true. Most of it beside the point. AI systems do not fail in the policy layer. They fail in the integration layer – the connectors, the context handed between agents, the data boundaries nobody drew on the architecture diagram, the escalation path nobody volunteers to demonstrate for an auditor.

I say this as someone who builds and runs these systems, not someone selling assurance for them. I designed and built MultiPS, an orchestration platform running 63+ models in parallel with consensus synthesis, currently in private beta. Nothing in it has ever failed because a document was wrong. What fails: a vendor silently changes a model's behaviour and three downstream agents inherit the damage. A consensus threshold swallows the one model that dissented – and the dissenter was right. Those are runtime failures. They live in deployment. No questionnaire reaches them.

Certification measures your system on its best day. Production measures it on its worst.

The ISO 9001 lesson, again

Every quality professional of a certain age carries a private collection of these audits. Mine includes a supplier stamped and plated – IATF 16949, ISO 9001, certificates framed in reception, a forty-slide welcome deck. Two days into a VDA 6.3 process audit, that same plant could not tell me what the late-shift operator was supposed to do when a torque tool failed its daily check. The reaction plan existed. It lived in the manual. The parts had kept running for four hours. That is not an insult to auditors; it is structural. A scheduled visit, a prepared site, an agenda agreed in advance – the audit design guarantees what it will find.

The certificate said the supplier could produce documents on demand. The process audit said the system did not fail safely. Different properties. Only one of them reaches your customers. The 70% defect-cost reduction we delivered at the 900-person greenfield plant – where I built the QA/QC department from the ground up – came from QRQC, reaction plans taped where operators could actually read them, and containment discipline. Not one euro of it came from a certificate.

Governance you build, not buy

If AI is going to run inside your processes, treat every deployment the way a good plant treats a new production process – because that is what it is. Ownership sits with the process owner: the person whose numbers the AI touches, whose customers receive its output. A centre of excellence can advise. It cannot own your failure modes. Quality departments learned this decades ago.

Before go-live, run a PFMEA-style analysis with drift, hallucination, prompt injection, data leakage and model deprecation on the failure-mode list – severity, occurrence, detection, and a reaction plan for each. Treat a model version change as an engineering change: the golden test set re-runs before production, the way PPAP requalification works for a tooling change. Then audit in layers – daily output sampling, weekly drift review, a monthly deep audit at the integration seams, the same cadence as layered process audits on a line. And keep a human stop: someone empowered to pull the AI out of the process within minutes, tested quarterly, like an evacuation drill.

The ethical-hacking half of my career sharpened this rule. The clickjacking flaw that put me in T-Mobile's public Hall of Fame was invisible in every security questionnaire that company had ever passed. A certifier checks what you show them. An attacker – or a drift event – tests what you hid. Eventually, what you forgot you hid.

Buy control, not comfort

The certificate will hang nicely next to the ISO 9001 one. Same wall, same distance from the shop floor. Comfort is what the assurance market sells, because comfort scales and control does not – which is precisely why control is worth more. Before signing anything, weigh the asymmetry: when an agent misroutes an order, leaks across a data boundary or invents a price, nobody calls the certifier. They call you. Ownership of failure never transfers with the certificate.

Across two decades in automotive and aerospace I learned that trust is manufactured, not purchased – produced by reaction plans, revalidation triggers and audits that show up unannounced where the work actually happens. Some of the new assurance offering is competent and worth having, after you have built control. Never instead of it. Skip that discipline and somebody will run the audit for you – an attacker, a defect, a drifted model – on their schedule, at your cost, in production rather than in policy.