Procurement evidence · v2026.10
Standards Map.
Every clause a procurement, audit or compliance team is likely to ask about, mapped to the exact modules of this course. Hand it to your compliance lead, your auditor, your insurer. They should not need to read the whole course to verify coverage.
Moorlnd is mapped to three: the EU AI Act, ISO/IEC 42001 and the NIST AI RMF. OWASP and the Cyber Resilience Act are listed for reference, and say so.
Find the standard. Find the clause. The module pills tell you which lessons satisfy it. Click any pill to jump.
This is an evidence map, not a certification statement. The auditor still does the audit. The map saves them hours in your training records.
Coverage matrix
Every clause below, against every module. A green check means that module satisfies the clause; the final column marks coverage by a Relevant Role track or template. Filter by standard, or tap a module to isolate its column. Full clause text and links are in the detailed tables underneath.
EU AI Act, Regulation (EU) 2024/1689
Article 4 is the literacy obligation in force today (since 2 February 2025). As replaced by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026), it says providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff. It is an obligation of effort, not of result, and does not require any individual to reach a set level. This course is one such measure. The high-risk regime was deferred by the same regulation: 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in a regulated product (Annex I).
| Article | What it requires | Where it lands in this course |
|---|---|---|
| Art 4 | Measures to support staff AI literacy (binding Feb 2025, amended 27 Jul 2026) | All modules entire course designed against this article |
| Art 5 | Prohibited AI practices (manipulation, social scoring, real-time biometric ID exceptions) | M7 (bias) M12 (standards) |
| Art 14 | Human oversight of high-risk AI systems | M5 (verifying) M-manager |
| Art 26 | Deployer obligations, use per instructions, monitor, log, inform affected persons | M4 (tools) M9 M-manager |
| Art 27 | Fundamental Rights Impact Assessment (FRIA) for high-risk AI use | FRIA template AUP template |
| Art 50 | Transparency, disclose AI-generated synthetic content, label deepfakes | M8 (IP/copyright) M6 (scams) |
| Art 73 | Serious incident reporting (providers); deployer involvement | M10 (incident) |
| Annex III | High-risk use cases, employment, education, essential services, biometrics, justice, migration, infrastructure | M7 M12 |
ISO/IEC 42001:2023
The world's first AI management-system standard. Clauses 7.2 (competence) and 7.3 (awareness), plus Annex A.4.6 (human resources: the competence of the people working with AI systems), are the human-capability spine. This course slots directly under them.
| Clause / Annex | What it requires | Where it lands in this course |
|---|---|---|
| Cl 5.2 | AI policy, documented, communicated to staff | AUP template |
| Cl 6.1 | Risks & opportunities; AI risk assessment | M3 M4 |
| Cl 7.2 | Competence, staff doing work that affects AI performance must be competent | Entire course + Relevant Roles |
| Cl 7.3 | Awareness, staff aware of policy, their contribution, implications of non-conformity | M1 M11 (checklist) |
| Cl 7.5 | Documented information, training records, version control | M9 (logging) |
| A.2 | Policies for AI use | AUP template |
| A.4.6 | Human resources: staff capability for AI | All modules + Relevant Roles |
| A.5.2 | AI system impact assessment | FRIA template |
| A.6.2 | AI system life cycle: requirements, design & development, verification, deployment | M7 |
| A.7 | Data for AI systems, quality, privacy, representativeness | M3 M7 |
| A.9 | Use of AI systems: processes, objectives and intended use (incidents are communicated under A.8.4) | M5 M10 |
| A.10 | Third-party AI relationships, supplier evaluation, contracts | M4 Vendor questionnaire |
NIST AI RMF 1.0 + GAI Profile (NIST AI 600-1)
| Function | What it covers | Where it lands in this course |
|---|---|---|
| Govern | Workforce capability, AI policy, accountability structures | Entire course M-manager |
| Map | Context, categorise AI use cases, risks, stakeholders | M4 |
| Measure | Assess and benchmark AI risks | M5 M7 |
| Manage | Allocate resources to act on risks; incident response | M10 M9 |
| GAI Profile | Generative-AI specific risks: confabulation, harmful content, IP, dangerous information | M5 M8 M7 |
OWASP Top 10 for LLM Applications
The development-track standard. Most of these belong in a future Developer Track module. Listed here so dev teams know where the course will expand.
| ID | Risk | Today / future coverage |
|---|---|---|
| LLM01 | Prompt Injection | Developer Track, planned |
| LLM02 | Sensitive Information Disclosure | M3 |
| LLM03 | Supply Chain | M4 + Dev Track planned |
| LLM04 | Data & Model Poisoning | Dev Track, planned |
| LLM05 | Improper Output Handling | M5 |
| LLM06 | Excessive Agency | M9 M-manager |
| LLM07 | System Prompt Leakage | Dev Track, planned |
| LLM08 | Vector & Embedding Weaknesses | Dev Track, planned |
| LLM09 | Misinformation | M5 |
| LLM10 | Unbounded Consumption | Dev Track, planned |
What to do with this page
If you're a buyer
This page is the audit-evidence pack. Share the URL with your compliance lead. The mapping is dated and versioned in the page footer.
If you're the trainer / champion
Print this page as your annexe to the training record. Combined with completion logs (planned), it satisfies most auditors' first request.
Cyber Resilience Act, Regulation (EU) 2024/2847
The CRA is on this page because procurement teams ask about it, and the honest answer is that it does not apply to the people this course trains.
It binds manufacturers, importers and distributors who place a product with digital elements on the EU market. It requires security by design, vulnerability handling, technical documentation, an EU declaration of conformity and CE marking. Reporting duties under Article 14 apply from 11 September 2026; the main obligations from 11 December 2027. Penalties reach €15 million or 2.5% of worldwide turnover.
None of that lands on a member of staff using an AI tool, which is who the eleven modules are written for. Mapping CRA clauses to lessons would imply a coverage that does not exist, so we have not done it. Two further limits worth stating plainly: pure software as a service is outside the CRA's scope unless it is a remote data processing solution integral to a product, and the CRA is EU law, so a UK organisation is only caught where it places products on the EU market.
Where the CRA does reach our customers is buying, not using. The Vendor Due Diligence register in the Moorlnd platform asks suppliers for their CRA scope position, their coordinated vulnerability disclosure contact, their declaration of conformity and CE marking position, and their software bill of materials with the declared security-update support period. That is the right place for it, because the duty sits with the supplier.
It is not a certification. We are not an accredited certification body and we do not certify your organisation against any standard. The map tells you which lessons cover which clauses. Auditors still audit.