Professional body says mandatory testing and certification should scale with a system's risk and public impact, not apply as a uniform burden