The People-Vector Evidence Layer: A new paper for compliance officers who need more than training certificates

An auditor asking "show me that your people catch AI errors" cannot be answered with a training certificate.

Three governance frameworks now converge on a requirement most organizations cannot satisfy: demonstrable evidence that the humans operating AI-enabled workflows exercise meaningful oversight. NIST AI RMF asks organizations to measure the human-AI configuration. ISO/IEC 42001 requires competent personnel. The EU AI Act makes effective human oversight a legal obligation for high-risk systems.

Each framework points at the same place: the behavior of the people in the loop. Almost no organization has an instrument that produces evidence there.

"The People-Vector Evidence Layer" is a new paper from PAICE (People + AI Collaboration Effectiveness) that maps PAICE behavioral assessment output to the specific clauses that concern the human vector — and shows how a compliance officer can place that output directly into an audit file.

The Evidence Gap

Compliance teams fill the human-oversight requirement with the artifacts they have: training-completion records, usage logs, and self-attestations. The paper names why none of these qualifies as behavioral evidence.

Training completion records attendance, not competence. A professional can complete an AI-use course with a perfect quiz score and still accept a fabricated citation from a model the following week.

Usage logs record activity, not reliability. Volume is not quality. A high-usage employee may be the one most likely to accept output uncritically.

Self-assessment records what a person believes about their own practice — the weakest signal of all, because the gap between believed verification and actual verification is precisely where organizational risk concentrates.

An auditor asking "show me that your people catch AI errors before those errors reach a client" cannot be answered with any of them.

The Crosswalk

The core of the paper is a framework-by-framework crosswalk that maps each human-vector requirement to specific PAICE output. It is designed to be lifted out and placed directly into an audit file or control-mapping spreadsheet:

NIST AI RMF MEASURE function → Dimensional behavioral scores per operator; aggregate cohort distribution as a recurring trustworthiness metric
ISO/IEC 42001 Clause 7.2 competence → Objective competence evidence per role; periodic reassessment record for the AIMS audit trail
EU AI Act Article 14 human oversight → Behavioral demonstration that operators detect and act on AI error, scored and dated
EU AI Act Article 4 AI literacy → Measured collaboration capability, not training attendance; evidence of literacy in practice
EU AI Act Article 26(2) deployer duties → Defensible record that assigned overseers meet a behavioral competence threshold

The detailed clause-level mappings in the appendix cover NIST's Govern/Map/Measure/Manage functions, ISO/IEC 42001 clauses 7.2, 9.1, 10, and Annex A, and EU AI Act Articles 4, 14, and 26 — including the current timeline following the Digital Omnibus: Article 4 in force since February 2025, high-risk provisions from December 2027.

Three Audit Artifacts

A PAICE deployment generates three artifacts a compliance officer can hand to an auditor:

Individual assessment record — a dated, dimensional score demonstrating that a specific overseer met a behavioral threshold before being assigned oversight duties. This answers Articles 14 and 26 at the individual level.
Cohort readout — an aggregate, privacy-preserving distribution across a team or function, returned only above a ten-completion floor. This answers NIST AI RMF's MEASURE function and ISO/IEC 42001's expectation of a monitored, improving management system.
Methodology and privacy record — the documented scoring philosophy, evidence hierarchy, and architectural privacy guarantees. This is what lets an assessor trust the first two artifacts.

Together, they move a compliance officer from "we have a policy on human oversight" to "we can show you the oversight happening, measured, and trending."

Honest Scope

The paper names its boundaries explicitly — because overstating what an evidence instrument does is the fastest way to lose an auditor's confidence. PAICE does not certify an organization against any framework. Conformity is a whole-of-organization determination. PAICE addresses the human-oversight and competence dimension specifically, and supplies the People-vector evidence those frameworks ask for that the rest of the governance stack does not generate.

Read the Paper

The full paper is available now at paice.work/papers/people-vector-evidence-layer — readable in-browser or as a PDF download. It includes detailed clause-level appendix tables for NIST AI RMF, ISO/IEC 42001, the EU AI Act, and illustrative sector mappings for financial services, legal practice, and healthcare.

Ready to generate the evidence your governance program is missing? Take the PAICE assessment to see your behavioral profile, or establish your organization's baseline to produce the audit artifacts described in this paper.

Get Involved:

Take the assessment (free, always — ES, PT, FR available)
Read the full paper (in-browser or PDF)
Browse all papers (six papers in the library)
Explore the AI Capability Baseline (cohort-level analytics for organizations)
Contact us about your specific requirements

The People-Vector Evidence Layer