Digital and artificial intelligence

Why train teams in applied AI rather than AI in general?

Because a keynote on artificial intelligence changes no one’s job. What changes the work is a quality manager who can have a tool sort fifty non-conformity reports, check the output and turn it into an action plan. Applied AI starts from the job, not from the technology.

In companies across Morocco and Africa the picture is often the same. Employees already use AI assistants, each in their own way, with no common rules. Some paste employee or customer data into them without knowing where it goes. Others refuse any use out of caution. In between, management has neither a policy nor any measure of what the tools actually deliver.

This domain exists to end that grey zone: it gives each function the uses that work, the limits to respect and the security reflexes to adopt.

What does the Digital, Applied AI and Cybersecurity domain cover?

Six families of courses, from everyday AI use to data protection. Each is built on real cases from your company or sector.

These topics match the courses of the digital and artificial intelligence domain of the 2027 training catalogue; ISO/IEC 27001 and information security sit in the management system standards domain.

The catalogue’s artificial intelligence path combines generative AI (2 days), three weeks of remote support and practice at the workstation, agentic AI (2 days) and a 90-day roadmap presented to management, for 12 to 16 participants.

What does AI change for a QHSE manager?

It speeds up preparation, sorting and drafting, and frees time for the shop floor. It replaces neither judgement, nor accountability, nor evidence.

In a management system, the uses that work best are concrete:

• Non-conformity and complaint analysis: grouping reports by cause, spotting recurrences, preparing the management review.
• Audit preparation: building a question list from a procedure, comparing a document against the requirements of a standard, preparing an internal audit.
• Drafting: producing a first draft of a procedure, work instruction or training material, then reviewed, corrected and approved.
• Monitoring: summarising a regulation or a new version of a standard, always going back to the official source.
• Multilingual awareness: adapting a safety message into French, Arabic and English for mixed teams.

The framework matters as much as the use, and standards are starting to write it down. FSSC 22000 Version 7, published in May 2026, has a section on the use of AI by certification bodies: a governance framework, a documented risk assessment for each AI system, testing before deployment, AI as an aid that does not replace human judgement, and staff trained in AI ethics and governance. These requirements apply to certification bodies, not to certified sites, yet they are a sound model for any QHSE department framing its own use of AI.

The AI-augmented QHSE path (AI basics, AI applied to QHSE, digitalisation, dashboards, 5 to 6 days) is one of the 12 paths of the 2027 catalogue: see custom programmes and learning paths.

Before handing a QHSE task to an AI tool

• The task is identified and the expected output is defined.
  
• The data used is classified: public, internal, confidential, personal.
  
• No personal or confidential data is entered without a legal basis and management approval.
  
• You know where the service is hosted, in light of the transfer rules of law 09-08.
  
• A competent person reviews and validates every output before use.
  
• Sources cited by the tool are checked against the official text.
  
• Any document produced enters the management system’s document control.
  
• The real gain is measured: time spent, errors, lead times.
  

How do you digitise a management system without losing control?

Digitise the processes that produce evidence first, then the indicators, and only then the management dashboards. A bad process, digitised, is still a bad process, only faster.

The course follows that order: mapping the current state (where records live, who fills them in, where information gets lost), digital document control, access rights and change traceability, retention of evidence, then indicators and reporting.

Solvitas products illustrate the approach. Normativa is a SaaS platform for standards compliance in food safety and ISO, used to run a management system on a self-service subscription. Inspirra, which runs ACG’s consulting and training assignments, produces QR-code attendance, evaluations, certificates and monthly reporting in the client area.

Power BI and dashboards

A useful dashboard fits on one page and triggers a decision. The Power BI course teaches participants to import and clean existing data, build reliable indicators, choose the right visual and publish a monthly report. Exercises use QHSE, production or logistics indicators: non-conformity rate, workplace accidents, complaints, service level.

Cybersecurity: which reflexes should you train first?

The ones that stop the most common attacks: recognising a fraudulent message, protecting access, reporting without delay. Most incidents start with a click, a reused password or an unknown USB stick.

The core module covers phishing and social engineering, passwords and multi-factor authentication, updates, backups, personal devices and public networks, and what to do when an incident occurs. Advanced modules for managers and IT focal points cover access rights and incident response.

In Morocco, the framework is Law No. 05-20 on cybersecurity, whose text is published by the General Directorate for Information Systems Security (DGSSI). Published in Official Bulletin No. 6906 of 6 August 2020, it covers three circles (art. 1): state administrations, local authorities, public bodies and companies and other public-law entities; critical infrastructure; and “operators”, meaning public telecommunications network operators, internet access providers, cybersecurity service providers, digital service providers and internet platform publishers. These operators keep for one year the technical data needed to analyse an incident, inform their customers of vulnerabilities that affect them and report without delay to the national authority any event that threatens their customers’ systems (art. 26, 27 and 30). For private companies outside these categories, the law remains a useful benchmark. DGSSI also runs maCERT, the Moroccan Computer Emergency Response Team.

Implementing an information security management system under ISO/IEC 27001 belongs to the ISO standards and management systems domain.

Law 09-08: what must teams know before using personal data?

That a file of employees, applicants or customers is personal data processing, governed by Law No. 09-08 and supervised by the CNDP. AI does not change the rule; it only multiplies the chances of breaking it.

Law No. 09-08 on the protection of individuals with regard to the processing of personal data was enacted by Dahir No. 1-09-15 of 18 February 2009 and published in Official Bulletin No. 5714 of 5 March 2009. It established Morocco’s National Commission for the Control of Personal Data Protection (CNDP). For a business team, six points prevent most mistakes:

ACG holds a CNDP authorisation for processing personal data; the course draws on that practice and does not replace legal advice. For HR processing, national ID numbers and transfers to the countries where AI services are hosted, it refers to the decisions published by the CNDP, to be reread before each new processing operation.

How are these courses delivered and funded?

In-house, open-enrolment or online, in French, Arabic or English, with Spanish and Portuguese on request. In-house, exercises use your own tools and documents; in open sessions, fictitious datasets.

Online modules run on OmniLearn, the platform where every classroom course has its digital twin, and the CourseTwin AI tutor supports participants after the session. Every course follows the same sequence, from placement test to final report: see before, during and after training.

In-person sessions in this domain may qualify for OFPPT special training contracts (CSF); online modules are not eligible. Under the CSF procedures manual (May 2006, Amendment No. 2 of 2 June 2014), the reference rules are 70% for planned training delivered by an external provider, 40% for unplanned training and, for in-house training, the same rates applied to a retained cost of MAD 800 per day per participant, calculated excluding tax, within a ceiling based on the declared TFP. Under the GIAC procedures manual, GIAC may reimburse 70% of the cost of training engineering excluding tax, up to MAD 100,000 per year per company. ACG never promises an amount: we simulate on your data and prepare the file, see CSF and OFPPT funding. Any simulated amount is indicative, before ceilings, and not a commitment.

What does ACG do for your digital and AI projects?

ACG, “The Tech-Enabled Consulting Firm”, links training with consulting and products. The firm is ISO 9001 certified for its consulting and training activities, has trained more than 120,000 people and delivered 502 projects with 32 consultants and experts.

• Assessment of digital and AI use by function, and of the related risks.
• In-house, open and online courses, from awareness sessions to the catalogue paths.
• An AI use charter and data protection rules, for your management to approve.
• Supported roll-out on Solvitas products where they fit the need.

For a broader transformation project, see our AI and digital transformation consulting page. When digital tools serve the management system, see also QHSE and ISO management systems and outsourced QHSE. For the full offer, browse our training catalogue, then describe your project.