Fawzooz · Wise AI Ambassador

Mapping to international standardsThe curriculum, clause by clause.

Where the programme’s units teach the clauses of ISO/IEC 27001, ISO/IEC 42001 and ISO 45003, and the principles of UNESCO and IEEE on the ethics of AI.

3 ISO standards
UNESCO · IEEE ethics principles
61 clauses and principles

Where the programme’s units teach the clauses of three international standards, and the principles of UNESCO and IEEE on the ethics of AI. This is a curriculum mapping, not a claim of compliance or of anyone’s approval: the standards are written for organisations’ management systems and the principles for states and designers, and the programme prepares you to understand them and apply them where you work.

ISO/IEC 27001:2022Information security18 rows

The programme rests on this standard’s logic: Degree 4 starts from the triad of information security, and unit 5.3 applies the standard to small teams.

Clause or control	Subject	Units	What you learn
4–10	The information security management system	5.3	Applying the logic of ISO 27001 to a small team without bureaucracy, with six controls enough for a team of five
6.1.2	Information security risk assessment	4.1 4.3	Confidentiality, integrity and availability and what AI systems add to them, the five layers, and ranking risks by impact
9.1	Monitoring and measurement	5.5	Measuring maturity in four dimensions, five levels and twenty items
A.5.7	Threat intelligence	4.2 4.4	Five attacks on models (direct and indirect injection, poisoning, extraction, tool misuse), and the four stages of a cognitive attack
A.5.10	Acceptable use of information	1.2 3.2	No confidential data in a public system, a rule without exception
A.5.12	Classification of information	3.2 5.1	Asking before any use: is there sensitive data in the input?
A.5.14	Information transfer	4.4 4.5	Checking through a second channel and an agreed word before any sensitive request
A.5.23	Information security for the use of cloud services	1.2 3.2	Telling a public system from an organisation’s own, and masking what is sensitive before it goes in
A.5.24–A.5.26	Incident management	4.5	An incident procedure for deepfakes, among four procedural controls
A.5.29–A.5.30	Security during disruption and ICT readiness	5.6	Resilience through reserves, diversity and learning
A.5.31	Legal and regulatory requirements	5.4	The four levels of risk in regulation, and building to the strictest
A.5.34	Privacy and protection of personal data	5.1	Privacy as a principle asked about before acting
A.6.3	Awareness, education and training	4.4	Five habits of cognitive security, and the forgotten layer: people
A.8.2	Privileged access rights	3.3	Least privilege for an agent, stopping points and a kill switch
A.8.11–A.8.12	Data masking and data leakage prevention	3.2 5.3	Masking what is sensitive as a professional habit, and the risk of an idea leaking in creative work
A.8.15–A.8.16	Logging and monitoring	3.3 4.2	A log for every agent, and why an attack looks like ordinary work in the log
A.8.24	Use of cryptography	4.6	Quantum computing and post-quantum cryptography
A.8.29	Security testing in development and acceptance	4.3	Red-teaming models in six stages, and its one-page report (the fourth gate’s deliverable)

What the programme does not cover: Physical controls (A.7), screening and terms of employment (A.6.1–A.6.2), most technical controls for networks and devices, and internal audit and management review (9.2–9.3).

ISO/IEC 42001:2023AI management system15 rows

Unit 5.2, “ISO 42001 in practice”, covers the whole standard, and the fifth gate’s deliverable applies it where the scholar works: a register of AI systems, and a use policy their organisation has approved.

Clause or control	Subject	Units	What you learn
5.2 · A.2	AI policy	5.2	A two-page policy: allowed, forbidden, and needs approval (the fifth gate’s deliverable)
5.3 · A.3.2	Roles and responsibilities	5.1 6.3	“A human in the loop” needs time, information, authority and a named responsibility; the tool is given the production, and the judgement stays with people
A.3.3	Reporting of concerns	6.5	Silence is a choice, and recording an objection is the least one owes
6.1.2 · 8.2	AI risk assessment	3.3 4.1 4.2	“What can it do if it is wrong?”, can the action be undone, and when does the error show; and the five attacks
6.1.4 · 8.4 · A.5	AI system impact assessment	5.1 6.5	Four questions before acting: a person’s right, sensitive data, how errors show, and whether it can be explained; and “who pays the price?”
7.2 · 7.3	Competence and awareness	1.3 6.3	Six degrees from zero to leading, each ending in work Fawzooz reviews
7.5	Documented information	5.2	Six documents you cannot do without, the first being the register of systems
9.1	Monitoring and measurement	5.2 5.5	A policy is measured by what people do, not by what was signed, and maturity by the UCSMM model
10	Improvement	5.2 5.5	The four-step cycle: plan, do, check, improve; and rising one level in one dimension each cycle
A.4	Resources for AI systems	3.4 6.3	The quality of sources in a knowledge assistant, and growing the skills of the newcomers in a team
A.6.2.4	Verification and validation	2.2 3.4 3.6	“Measured on what?” before any accuracy figure, testing an assistant with questions whose answers you know, and verifying before you sign
A.6.2.6 · A.6.2.8	Operation, monitoring and event logs	3.3	Five limits for an agent: least privilege, a loop ceiling, stopping points, a log and a kill switch
A.7	Data for AI systems	2.2 3.4	Data is the teacher, and its gaps and leanings become traits of the system
A.8	Information for interested parties	6.5	Disclosing when it would change how the other side judges, and claiming nothing that is not yours
A.9	Use of AI systems	1.1 3.1 3.5	You hand over the task, not the consequence; a commission in five layers; and a red line in every field

What the programme does not cover: The organisation’s context and the system’s scope (4.1–4.4), supplier and customer relationships (A.10), and internal audit (9.2).

ISO 45003:2021Psychological health and safety at work8 rows

ISO 45003 is guidance, not requirements, and follows the structure of ISO 45001. The programme takes up the psychosocial risks that AI brings into work: fear for one’s job, changing roles, pressure and manipulation.

Clause or control	Subject	Units	What you learn
5	Leadership and worker participation	6.2 6.3	Removing the “punishment of the one who tries”, and a leader showing their use of the tool rather than hiding it
6.1	Psychosocial risks: how work is organised, and change	1.1 6.3 6.4	Tasks are displaced, not professions; assessment moves from quantity to judgement; roles are reshaped around what cannot be automated
6.1	Psychosocial risks: job security	1.2 6.4	The half-truth in the myth of being replaced, and four skills that hold
6.1	Psychosocial risks: social factors and career development	6.3	Protecting a newcomer’s growth: they produce, then compare, then explain; and paying attention to the quiet ones in the team
6.1	Psychosocial risks: pressure and manipulation	4.4 4.5	Slowing down under pressure, checking the source, and meeting impersonation with procedural controls
7.2 · 7.3	Competence and awareness	1.3 1.4	A diagnostic in four dimensions that starts with the person, and a plan to climb from the weakest
7.4	Communication	6.3 6.5	Being open about using the tool, and recording an objection instead of staying silent
8.1	Management of change	6.1	An exit criterion for every stage, and a stopping condition written before you begin

What the programme does not cover: Rehabilitation and return to work, emergency preparedness, and measuring workload through workers’ surveys.

UNESCO 2021UNESCO Recommendation on the Ethics of AI12 rows

A recommendation adopted by UNESCO’s member states in 2021, with ten principles and areas of policy. The programme takes up nine of the ten principles, and three of the policy areas.

Principle or area	Subject	Units	What you learn
Proportionality and do no harm	Proportionality and do no harm	3.3 3.5	Can the action be undone, and when does the error show; and a red line in every field that is not crossed
Safety and security	Safety and security	4.1 4.2 4.3	The five layers and their controls, the five attacks, and red-teaming models
Privacy and data protection	Privacy and data protection	1.2 3.2 5.1	No confidential data in a public system, masking what is sensitive before it goes in, and privacy as a principle asked about before acting
Multi-stakeholder and adaptive governance	Multi-stakeholder and adaptive governance	5.2 5.4	A management system in a four-step cycle, the regulatory landscape in Europe and the Gulf, and building to the strictest
Responsibility and accountability	Responsibility and accountability	1.1 5.1	You hand over the task, not the consequence; and accountability as one of four principles asked about before acting
Transparency and explainability	Transparency and explainability	5.1 6.5	Can the decision be explained, and disclosing when it would change how the other side judges
Human oversight and determination	Human oversight and determination	3.6 5.1 6.3	“A human in the loop” with time, information, authority and a named responsibility; verifying before you sign; and the judgement staying with people
Fairness and non-discrimination	Fairness and non-discrimination	1.2 2.2 5.1	A system is not neutral by itself but inherits what is in its data, and the data’s gaps and leanings become its traits
Awareness and literacy	Awareness and literacy	2.1 2.3 2.6	What AI is and how a machine learns, why models hallucinate, and the machine’s three limits
Policy area: Ethical impact assessment	Policy area: ethical impact assessment	5.1 6.5	Four questions before acting, and “who pays the price, and what if everyone did it?”
Policy area: Communication and information	Policy area: communication and information	4.4 4.5	A cognitive attack aims at what you believe; deepfakes; and that the greater danger is denying what is true
Policy area: Economy and labour	Policy area: economy and labour	6.4	Tasks are displaced, not professions; four skills that hold; and four local gaps

What the programme does not cover: The principle of sustainability and the area of environment and ecosystems, and the areas of gender, health and culture.

IEEE EAD (2019)IEEE Ethically Aligned Design8 rows

A document of principles from IEEE for autonomous and intelligent systems, first edition 2019, with eight general principles. The programme takes up all eight, from the side of those who use and lead these systems.

Principle	Subject	Units	What you learn
Human Rights	Human rights	5.1	The first question before acting: does the decision touch a person’s right?
Well-being	Well-being	1.2 6.3 6.4	The fear for one’s job and the half-truth in it, protecting a newcomer’s growth, and the skills that hold
Data Agency	Data agency	3.2 5.1	Give what is needed, not all you have; mask what is sensitive; and privacy as a principle before acting
Effectiveness	Effectiveness	2.2 3.4 3.6	“Measured on what?” before any accuracy figure, testing an assistant with questions whose answers you know, and verifying before you sign
Transparency	Transparency	3.3 5.1 6.5	A log for every agent, being able to explain, and being open about using the tool
Accountability	Accountability	1.1 5.1 6.3	You hand over the task, not the consequence; a named responsibility; and judgement and responsibility staying with people
Awareness of Misuse	Awareness of misuse	2.5 4.2 4.5	The technology that generates is the one that fakes; the five attacks; and the controls for deepfakes
Competence	Competence	1.3 3.5 6.3	A diagnostic at the start, the mature uses in every field and its red line, and leading a team that works with the tool

What the programme does not cover: The programme takes up the principles from the side of the user and the leader, not the design engineer: it does not go into the detailed design recommendations or the IEEE 7000 series of standards.