International AI standards
3 frameworksISO/IEC 42001:2023
AI management system requirements
controls113/127
ISO/IEC 23894
AI risk management guidance
controls24/28
ISO/IEC 5338
AI system lifecycle processes
controls18/22
Framework coverage
Built for every standard your auditor reads.
Wingback maps to international AI standards, national regulations, state laws, and the security frameworks that govern adversarial coverage. Each one is versioned, updated when the standard evolves, and re-mappable to your evidence backbone with one click.
National regulations
4 frameworksNIST AI RMF 1.0
US Federal risk management framework
controls38/41
EU AI Act
High-risk + GPAI obligations
controls47/52
Singapore AI Verify
Testing framework for AI systems
controls11/13
UK AI Safety Inst.
Evaluation framework
controls9/12
US state + sectoral
4 frameworksColorado AI Act (SB21-169)
Algorithmic discrimination protections
controls14/16
NYC Local Law 144
Employment AI bias audit requirements
controls6/6
SR 11-7
Fed Reserve · model risk management (FSI)
controls22/24
HIPAA (AI rules)
Healthcare AI · PHI handling controls
controls18/20
Adversarial / security
4 frameworksOWASP LLM Top 10 (2025)
Top vulnerabilities in LLM applications
controls10/10
OWASP Agentic Top 10 (2026)
Agentic threats · just released
controls10/10
MITRE ATLAS
Adversarial threat landscape for AI
controls14/14
AVID-AI
AI vulnerability database mapping
statusmapped
Trust & general compliance · SOC 2 Type II · ISO 27001 · ISO 27701 · GDPR · HITRUST · AIUC-1
Risk register
Every AI asset has a live risk score. Every change updates it.
Risk isn't a quarterly spreadsheet. Wingback maintains a continuously-updated AI risk register, each asset scored, owned, and tied to the frameworks that govern it. The register feeds the audit binder; the binder feeds the policy. One backbone, always current.
Tracked AI assets
489
across 12 business units
Open critical risks
3
routed to owners
Risk trend (30d)
↓ 12
points · improving
Top-risk assets · liveupdated continuously
Industry coverage
Built for the regulators that govern your industry.
Compliance isn't one-size-fits-all. Wingback ships purpose-built mappings for the regulations that actually apply to your sector, so the binder you export to your auditor is the binder your auditor was expecting.
Healthcare
Regulations
HIPAAHHS AI guidanceNIH model documentationState telehealth laws
Wingback automates
PHI tracking, model bias testing, audit trails for clinical decision support.
Financial services
Regulations
SR 11-7 (Fed model risk)OCC bulletin 2011-12NYDFS Part 500NAIC model AI bulletin
Wingback automates
Model risk register, validation reports, change governance, vendor risk for AI providers.
Employment / HR
Regulations
NYC Local Law 144Illinois HB 3773California AB 2930EEOC AI guidance
Wingback automates
Bias audit reports, candidate-impact assessments, public posting requirements.
Government / public sector
Regulations
FedRAMPCISA AI Cybersecurity CollaborationOMB M-24-10White House AI EO
Wingback automates
SBOM / AIBOM submission, FISMA evidence, AI inventory disclosure to public registers.
Industry-specific framework mappings ship pre-configured. Custom-industry mappings (insurance, education, telecom) on request.
What's in the binder
Open the folder. Read the receipts.
Every binder Wingback exports is organised by control. Each control links to the evidence behind it. Auditors open a folder, not a tickets queue.
01
Control coverage map
Every control in your selected framework with its status, last evidence date, and owner.
ISO 42001NIST RMFEU AI Act
02
AI Bill of Materials
Industry-standard CycloneDX 1.6 BOM per agent: models, data, prompts, integrations, permissions.
ISO/IEC 5338CycloneDX 1.6
03
Policy register
Every plain-English policy with its compiled rule, deploy date, and recent matches.
ISO 42001 · A.5.2NIST RMF · GOVERN
04
Posture & drift evidence
Findings with severity, owner, and the time-stamped runtime events behind each one.
NIST RMF · MEASUREOWASP LLM Top 10
05
Approved-vendor catalog
Per-integration allowlists with approver, review date, and renewal status.
ISO 42001 · A.10.4SR 11-7
06
Incident & response log
Detected attacks, blocked events, and the runtime decisions across the period.
NIST RMF · MANAGEEU AI Act Art 26
Policies in plain English
Write the policy. We compile the rule.
Policies don't live in slide decks. Wingback's policy editor accepts plain-English statements, compiles them to enforceable runtime rules, and ties every match back to the control the policy supports.
Plain English
“Agents must not read any file matching credential patterns. Block at the tool layer and alert the owner.”
Compiled rule→ ISO 42001 · A.7.4
when tool == "file_read" AND path matches credential_pattern then block, notify(agent.owner), evidence(ISO42001/A.7.4)
Plain English
“Agents may only invoke models from the approved-vendor list. New providers require approval.”
Compiled rule→ NIST RMF · MAP-2.3
when model.provider NOT IN approved_vendor_list then block, route(agent.owner), evidence(NIST RMF/MAP-2.3)
Plain English
“PHI may only flow to HIPAA-eligible providers. Block all PHI-classified data to non-eligible destinations.”
Compiled rule→ HIPAA · 164.502 + EU AI Act · Art 9
when data.classification == "PHI" AND destination NOT IN hipaa_eligible_list then block, evidence(HIPAA/164.502, EU_AI_Act/Art_9)
Plain English
“Any agent used for employment decisions must run an NYC bias audit quarterly. Block deployment if audit is stale.”
Compiled rule→ NYC LL144
when agent.use_case == "employment_decision" AND last_bias_audit > 90d then block_deploy, evidence(NYC_LL144)
AI Bill of Materials
Industry-standard format, versioned per agent.
Wingback emits a CycloneDX 1.6 AIBOM for every agent: models, data sources, system prompts, integrations, and permissions, with a versioned history. Drop it into any SBOM-aware compliance tool you already use.
- CycloneDX 1.6, interoperable with the SBOM tools you already have
- Versioned history per agent; diff between any two versions
- Models, datasets, system prompts, integrations, and permissions in one document
- Linked to ISO 42001 + NIST RMF + EU AI Act controls automatically
- Wingback contributes to the CycloneDX AI BOM working group
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"metadata": {
"component": "claims-triage-agent",
"version": "18.4.0",
"owner": "@claims"
},
"components": [
{ "type": "model",
"name": "claude-opus-4-7",
"supplier": "anthropic",
"approved": true },
{ "type": "dataset",
"name": "kb/triage-policy@v3",
"sensitivity": "internal · PHI" },
{ "type": "service",
"name": "patient-lookup-tools",
"permissions": ["records:read","triage:write"] }
],
"compliance": {
"iso42001": ["A.5.2", "A.7.1", "A.8.5", "A.9.1"],
"nist_rmf": ["GOVERN-1.1", "MAP-2.3", "MEASURE-1.1"],
"owasp_agentic": ["ASI03"],
"hipaa": ["164.502", "164.514"]
},
"history": {
"versions": 18,
"last_change": "2026-05-28T10:14Z"
}
}Third-party governance
Every AI vendor: scored, contracted, audited.
Your AI stack runs on dozens of third-party providers. Each one is a vendor governance question waiting to be asked. Wingback inventories every provider, scores its risk, tracks the DPA, and feeds the answer to your procurement and audit committees.
Vendor inventory · live
Vendor onboarding workflow
1Vendor request submitted by service team
2Wingback pulls model card + ToS + data-handling docs
3Risk score auto-computed (scope, controls, residency, training-tier)
4Procurement + Security + Legal sign-off captured
5Wired into approved-vendor allowlist · DPA tracked to expiry
6Continuous re-scoring as ToS / model versions change
Anatomy
60 days to your ISO 42001 stage 1 audit. Here's what Wingback did each week.
Most teams start audit prep when the auditor confirms a date. Wingback starts it months earlier, silently in the background, so when day 60 arrives, the binder is 89% complete on day one of the prep window.
STEP 0
6 months prior
Continuous evidence collection
Wingback runtime + posture + red team scans have been running for 6 months. 113/127 ISO 42001 controls already have automated evidence in the system.
active
STEP 1
Day 60
Audit confirmed · scope locked
Auditor confirms a date. Framework selected: ISO 42001 stage 1 · 127 controls in scope. Wingback's coverage view shows 89% ready · 14 gaps.
scoped
STEP 2
Day 50
Gap review with the auditor
14 gaps reviewed jointly. 8 require policy additions (will be auto-evidenced once written); 6 require manual evidence (assigned to named owners).
gap review
STEP 3
Day 38
Policies authored · compiled · evidence emitting
8 plain-English policies authored in Wingback. Each compiles to runtime rules and starts emitting evidence automatically. Coverage climbs to 95%.
policies shipped
STEP 4
Day 25
Remaining gaps closed by named owners
6 manual gaps closed. Each sign-off captured as an audit artifact with timestamp + signer. Coverage reaches 100% on the 127 in-scope controls.
owner signoff
STEP 5
Day 14
Binder generated · 184 pages · indexed by control
184-page PDF + JSON sidecar generated · 6.4 MB. Every control linked to evidence with timestamps + session IDs. Re-generates in 2 minutes if anything changes.
binder generated
STEP 6
Day 7
Internal rehearsal · last refinement
GRC team walks the auditor scenario. Discovers 1 control needing a clearer narrative. Updates the policy text · re-exports the binder in 2 minutes.
rehearsal
STEP 7
Day 1
Auditor opens the binder · zero follow-ups
Auditor receives the export · works through the controls · returns the most-organised-binder-they've-seen feedback. No follow-up questions. Stage 1 closed in two working days.
complete
What this prep replaced
- Manual binder assembly: 8 weeks of cross-team meetings, scattered evidence requests, late nights
- Quarterly evidence collection: gaps are inevitable · auditor finds what you missed
- Per-framework rebuild: switching to NIST RMF or EU AI Act = start over from scratch
- Wingback: 7-day final-prep · 0 auditor follow-ups · re-mappable to any framework with one click
Trusted by GRC and security teams
SOC 2 Type II
Audited and current
SOC 2 Type I
Audited and current
ISO 27001
Certification in progress
ISO 42001-mapped
AI management system
Ship the binder, not the spreadsheet.
Map your AI stack to ISO 42001, NIST RMF, the EU AI Act, and the OWASP Agentic Top 10 this week, and export the binder before your auditor confirms a date.
Generate a sample audit pack