Twelve Jobs in Search of a Market

The Norm Lands on 30 April 2026

The first reaction to the publication of UNI 11621-8, the Italian standard that defines the twelve professional profiles of artificial intelligence, should be suspicion. Standardising the trades of a field that changes every six months is an almost paradoxical exercise, and doing it before the rest of Europe means taking on the risk of being wrong first. The norm arrived on 30 April 2026, signed by UNINFO with the coordination of the Italian Department for Digital Transformation. The regulatory anchor goes to Regulation EU 2024/1689, the AI Act, and to Italian Law 132/2025 on AI. The Italian Law 4/2013 on non-regulated professions acts as the ramp to certification.

A Word in Search of a Metric Since February

For anyone working in compliance every day this closes a circle that had stayed open since 2 February 2025. That day, Article 4 of the AI Act required providers and deployers to ensure a sufficient level of staff literacy, without explaining what, exactly, the adjective sufficient meant. Over the last months, working on compliance projects for clients in highly regulated sectors, that word came back in every conversation as an unanswered question. No document kit and no DPIA template managed to pin down its meaning without circumlocutions. What does “sufficient competence” actually mean? When is a client’s request reasonable, and when is it a demand for which no metric yet exists? UNI 11621-8 provides that metric, and it provides it in Italian, with names that the buyer at a healthcare company or a regional public office can read without translating them.

Twelve Profiles, From the CAIO to the Researcher

The twelve profiles cover the spectrum from governance to research. They go from Chief AI Officer to AI Research Scientist. For each profile the standard specifies mission and tasks, together with a map of required competences, the expected level and the associated performance indicators. The methodology is the consolidated one of UNI 11621-1, and the anchor is the European e-Competence Framework, UNI EN 16234-1. Technically the work is solid, and it is important to say so before getting to the problems.

The Material Being Codified Is Still in Motion

The problems start with the material the norm tries to freeze. A profession is codified when it has reached a sufficient degree of stability, and today’s AI has not. The Prompt Engineer, present in the list as a separate profile, is already an interesting case. When it existed as a distinct role, it had a short life, and was quickly absorbed by developers and product managers working directly with generative models. Keeping it as a dedicated profile means chasing a practice that has already evolved elsewhere. The same applies, to a different degree, to the sharp separation between Data Scientist and Machine Learning Engineer, two roles that in real practice overlap widely. The boundaries of codified professional figures are much sharper than the boundaries of the competences people actually exercise. A good Data Scientist touches ML engineering, and a competent ML engineer knows how to move in the data pipeline. When an AI Security Specialist does not understand models at the root, they stop being a security professional and become a document reviewer.

Who Writes the Standard, and Why

There is a subtler matter, and it concerns the origin of professional-profile standards in Italy. They are produced by committees that include certification bodies and training providers, along with trade associations. Legitimate actors, all of them, and all with an economic interest in the final outcome. This does not make the standard less useful, it changes how it should be read. Under the technical surface there is the construction of a market. The market of professional certification and accredited training. The Italian ITS Academy programmes, the country’s higher technical education tracks, are aligning in these very weeks, and certification bodies are preparing their own schemes. Law 4/2013 provides the hook: those who can certify a profile earn from that certification. The question is not whether the system is legitimate, it is. The question is what we are actually buying when we spend to certify an internal Chief AI Officer.

The Substitution Effect, As With the DPO

A third caution concerns the substitution effect, which is probably the most serious risk. Having UNI-compliant profiles does not mean having competent AI governance. The recent history of the GDPR is full of organisations that had a certified DPO and disastrous processes, because the DPO was an administrative slot, not an operational function. The same can happen with the Chief AI Officer and the Security Specialist. Compliance by checklist produces organisational comfort and little real safety. If UNI 11621-8 is read as a documentary obligation, we will have companies with clean tables and fragile AI systems. If it is read as a skeleton around which to build real practice, we will have something useful.

A Trajectory We Have Already Seen

Having said all that, the publication of the standard is worth taking seriously. For a reason that has little to do with technique and a lot to do with the timing of a regulated market. The pattern, in Italy, is one we have already seen. The Cloud Italia Strategy of 2021 generated a framework for the classification of data and services for the public administration. That framework became a regulation of the Italian cybersecurity agency between 2022 and 2023. The catalogue of qualified cloud services then entered public-administration procurement procedures, all the way to Consip MEPA, the Italian central purchasing platform. Initially vague clauses on cloud-service security turned into verifiable technical requirements and conditions for participation. Whoever arrived later competed as a generic supplier against pre-qualified ones, and lost significant tenders. UNI 11621-8, applied within the AI Act frame, follows an analogous trajectory. The standard starts as a voluntary reference and ends in procurement specifications. Passing through the Department’s policy directives is almost an administrative detail. The useful window opens now and closes when the first significant tender cites the norm.

Inside a Multi-Framework Compliance Kit

For those of us, like Oltrematica, who work on multi-framework compliance, the standard is first of all a defensible documentation instrument. The RACI matrix of a high-risk AI project, built on the UNI profiles, becomes evidence that holds up in audit. The internal training plan, mapped to the profiles, stops being an administrative cost and becomes an integral part of the AI risk-management programme. The form we are giving to our internal documentation kits absorbs the standard without effort, because it speaks the same language as the frameworks we already use, from the GDPR to the Cyber Resilience Act.

An Imperfect Map, But a Map

There is a line of work more interesting than mere conformity, and probably less profitable in the short term. The standard is an occasion for internal intelligibility. It allows organisations that adopt AI to talk about it with a shared vocabulary, before they talk to regulators or to certification bodies. It is an imperfect vocabulary, partly dated and built around recognisable economic interests. But it is the first available vocabulary, and its imperfection is smaller than its usefulness. The real question, the one that will decide whether UNI 11621-8 is a good norm or a bad one, is not written in the text. It will be written in the coming months, in the interpretations organisations give it, and in the tenders that use it to filter suppliers.

In the meantime, it is worth reading it for what it is. An imperfect map of a territory we are already crossing, which at least proposes a shared toponymy so that we do not all get lost in the same way.

The author

Andrea MargiovanniAI

I follow the relationship between AI and European regulation as a political fact, not a technical spectacle. I work with teams that have to make AI compliant with AI Act, CRA, NIS2 without reducing compliance to a checklist.

See the guide →