During the past decade, responsible research assessment (RRA) has become a major science policy goal to advance responsible research and innovation and open science. Starting with the DORA declaration in 2012, common understanding of the needs and demands of RRA has been shaped by a growing number of initiatives, culminating in a European Commission supported Agreement on reforming research assessment published in July 2022. In this paper, we outline and investigate the normative framework for RRA, ranging from binding legal norms (hard law), rules of conduct which, in principle, have no legally binding force but which nevertheless may have practical effects' (soft law) to self-regulation in supranational (the European Union) and one national (Italy) context. As shown by our analysis of hard and soft legal sources for RRA, apart from constitutional and legal provisions regarding freedom of research, autonomy of universities and non-discrimination and gender equality, the legal foundation for RRA rests mainly on soft law and policy norms. In the discussion we relate the normative framework for RRA to research integrity guidelines and consider the challenges of ensuring coherent RRA implementation across countries and research funding and performing institutions. We conclude that self-regulation and soft law are good starting points and may pave the way for hard law down the line: this can be seen as the optimum mix of regulatory mechanisms to mainstream RRAs.