■ AI Risk & Compliance

Walk into the audit with the binder already done.

Wingback maps every runtime event, posture finding, and red-team result to 15+ frameworks — ISO 42001, NIST AI RMF, EU AI Act, OWASP Agentic Top 10 (2026), state laws, and industry-specific regulations. The evidence binder isn't something you assemble in week 12 — it's something you export.

15+
frameworks mapped
continuous
evidence collection
1-click
binder export
wingback / compliance — audit dashboard
✕■Compliance Dashboard
Audit-ready
89%
Open findings
8
Frameworks active
5
Next audit
47 d
ISO/IEC 42001:202389%
NIST AI RMF93%
OWASP LLM Top 10100%
OWASP Agentic Top 10100%
EU AI Act (high-risk)90%
Framework coverage

Built for every standard your auditor reads.

Wingback maps to international AI standards, national regulations, state laws, and the security frameworks that govern adversarial coverage. Each one is versioned, updated when the standard evolves, and re-mappable to your evidence backbone with one click.

International AI standards

3 frameworks
ISO/IEC 42001:2023
AI management system requirements
controls113/127
ISO/IEC 23894
AI risk management guidance
controls24/28
ISO/IEC 5338
AI system lifecycle processes
controls18/22

National regulations

4 frameworks
NIST AI RMF 1.0
US Federal risk management framework
controls38/41
EU AI Act
High-risk + GPAI obligations
controls47/52
Singapore AI Verify
Testing framework for AI systems
controls11/13
UK AI Safety Inst.
Evaluation framework
controls9/12

US state + sectoral

4 frameworks
Colorado AI Act (SB21-169)
Algorithmic discrimination protections
controls14/16
NYC Local Law 144
Employment AI bias audit requirements
controls6/6
SR 11-7
Fed Reserve · model risk management (FSI)
controls22/24
HIPAA (AI rules)
Healthcare AI · PHI handling controls
controls18/20

Adversarial / security

4 frameworks
OWASP LLM Top 10 (2025)
Top vulnerabilities in LLM applications
controls10/10
OWASP Agentic Top 10 (2026)
Agentic threats · just released
controls10/10
MITRE ATLAS
Adversarial threat landscape for AI
controls14/14
AVID-AI
AI vulnerability database mapping
statusmapped
Trust & general compliance · SOC 2 Type II · ISO 27001 · ISO 27701 · GDPR · HITRUST · AIUC-1
Risk register

Every AI asset has a live risk score. Every change updates it.

Risk isn't a quarterly spreadsheet. Wingback maintains a continuously-updated AI risk register — each asset scored, owned, and tied to the frameworks that govern it. The register feeds the audit binder; the binder feeds the policy. One backbone, always current.

Tracked AI assets
489
across 12 business units
Open critical risks
3
routed to owners
Risk trend (30d)
↓ 12
points · improving
Top-risk assets · liveupdated continuously
AssetClassScoreTop factorOwnerReviewed
claims-triage-agentAgent78↓Excessive tool scope@claims2d ago
billing-sync-agentAgent67↑Cross-system access@payments1d ago
support-knowledgeData88↓PHI present · sanctioned@support5d ago
bedrock-prod-vendorVendor56↑DPA renewal due 14d@procurement7d ago
marketing-ragRAG pipeline82↓Source attestation low@marketing12d ago
internal-copilotAgent45↑Drift score 0.91@platformescalated
Industry coverage

Built for the regulators that govern your industry.

Compliance isn't one-size-fits-all. Wingback ships purpose-built mappings for the regulations that actually apply to your sector — so the binder you export to your auditor is the binder your auditor was expecting.

🩺

Healthcare

Regulations
HIPAAHHS AI guidanceNIH model documentationState telehealth laws
Wingback automates
PHI tracking, model bias testing, audit trails for clinical decision support.
🏦

Financial services

Regulations
SR 11-7 (Fed model risk)OCC bulletin 2011-12NYDFS Part 500NAIC model AI bulletin
Wingback automates
Model risk register, validation reports, change governance, vendor risk for AI providers.
👥

Employment / HR

Regulations
NYC Local Law 144Illinois HB 3773California AB 2930EEOC AI guidance
Wingback automates
Bias audit reports, candidate-impact assessments, public posting requirements.
🏛️

Government / public sector

Regulations
FedRAMPCISA AI Cybersecurity CollaborationOMB M-24-10White House AI EO
Wingback automates
SBOM / AIBOM submission, FISMA evidence, AI inventory disclosure to public registers.
Industry-specific framework mappings ship pre-configured. Custom-industry mappings (insurance, education, telecom) on request.
What's in the binder

Open the folder. Read the receipts.

Every binder Wingback exports is organised by control. Each control links to the evidence behind it. Auditors open a folder, not a tickets queue.

01

Control coverage map

Every control in your selected framework with its status, last evidence date, and owner.

ISO 42001NIST RMFEU AI Act
PDF + JSON
02

AI Bill of Materials

Industry-standard CycloneDX 1.6 BOM per agent — models, data, prompts, integrations, permissions.

ISO/IEC 5338CycloneDX 1.6
JSON
03

Policy register

Every plain-English policy with its compiled rule, deploy date, and recent matches.

ISO 42001 · A.5.2NIST RMF · GOVERN
PDF + linked URLs
04

Posture & drift evidence

Findings with severity, owner, and the time-stamped runtime events behind each one.

NIST RMF · MEASUREOWASP LLM Top 10
JSON
05

Approved-vendor catalog

Per-integration allowlists with approver, review date, and renewal status.

ISO 42001 · A.10.4SR 11-7
PDF + CSV
06

Incident & response log

Detected attacks, blocked events, and the runtime decisions across the period.

NIST RMF · MANAGEEU AI Act Art 26
JSON
Policies in plain English

Write the policy. We compile the rule.

Policies don't live in slide decks. Wingback's policy editor accepts plain-English statements, compiles them to enforceable runtime rules, and ties every match back to the control the policy supports.

Plain English
“Agents must not read any file matching credential patterns. Block at the tool layer and alert the owner.”
Compiled rule→ ISO 42001 · A.7.4
when tool == "file_read" AND path matches credential_pattern
then block, notify(agent.owner), evidence(ISO42001/A.7.4)
Plain English
“Agents may only invoke models from the approved-vendor list. New providers require approval.”
Compiled rule→ NIST RMF · MAP-2.3
when model.provider NOT IN approved_vendor_list
then block, route(agent.owner), evidence(NIST RMF/MAP-2.3)
Plain English
“PHI may only flow to HIPAA-eligible providers. Block all PHI-classified data to non-eligible destinations.”
Compiled rule→ HIPAA · 164.502 + EU AI Act · Art 9
when data.classification == "PHI" AND destination NOT IN hipaa_eligible_list
then block, evidence(HIPAA/164.502, EU_AI_Act/Art_9)
Plain English
“Any agent used for employment decisions must run an NYC bias audit quarterly. Block deployment if audit is stale.”
Compiled rule→ NYC LL144
when agent.use_case == "employment_decision" AND last_bias_audit > 90d
then block_deploy, evidence(NYC_LL144)
AI Bill of Materials

Industry-standard format, versioned per agent.

Wingback emits a CycloneDX 1.6 AIBOM for every agent — models, data sources, system prompts, integrations, and permissions, with a versioned history. Drop it into any SBOM-aware compliance tool you already use.

  • ✓CycloneDX 1.6 — interoperable with the SBOM tools you already have
  • ✓Versioned history per agent; diff between any two versions
  • ✓Models, datasets, system prompts, integrations, and permissions in one document
  • ✓Linked to ISO 42001 + NIST RMF + EU AI Act controls automatically
  • ✓Wingback contributes to the CycloneDX AI BOM working group
checkout-agent.aibom.json — CycloneDX 1.6
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "metadata": {
    "component": "claims-triage-agent",
    "version": "18.4.0",
    "owner": "@claims"
  },
  "components": [
    { "type": "model",
      "name": "claude-opus-4-7",
      "supplier": "anthropic",
      "approved": true },
    { "type": "dataset",
      "name": "kb/triage-policy@v3",
      "sensitivity": "internal · PHI" },
    { "type": "service",
      "name": "patient-lookup-tools",
      "permissions": ["records:read","triage:write"] }
  ],
  "compliance": {
    "iso42001":   ["A.5.2", "A.7.1", "A.8.5", "A.9.1"],
    "nist_rmf":   ["GOVERN-1.1", "MAP-2.3", "MEASURE-1.1"],
    "owasp_agentic": ["ASI03"],
    "hipaa":      ["164.502", "164.514"]
  },
  "history": {
    "versions": 18,
    "last_change": "2026-05-28T10:14Z"
  }
}
Third-party governance

Every AI vendor — scored, contracted, audited.

Your AI stack runs on dozens of third-party providers. Each one is a vendor governance question waiting to be asked. Wingback inventories every provider, scores its risk, tracks the DPA, and feeds the answer to your procurement and audit committees.

Vendor inventory · live
ProviderTypeVolumeDPAScoreStatus
OpenAIFoundation model2.4 M tokens / movalid · expires 47 d82sanctioned
AnthropicFoundation model1.8 M tokens / movalid · expires 89 d88sanctioned
AWS BedrockProvider3.1 M tokens / movalid · enterprise MSA79sanctioned
PineconeVector store14 M queries / moexpired 12 d ago56review
Notion MCPIntegration4 200 calls / movalid71sanctioned
HuggingFace SpacesModel hosting280 K tokens / monone on file38blocked

Vendor onboarding workflow

1Vendor request submitted by service team
2Wingback pulls model card + ToS + data-handling docs
3Risk score auto-computed (scope, controls, residency, training-tier)
4Procurement + Security + Legal sign-off captured
5Wired into approved-vendor allowlist · DPA tracked to expiry
6Continuous re-scoring as ToS / model versions change
Anatomy

60 days to your ISO 42001 stage 1 audit. Here's what Wingback did each week.

Most teams start audit prep when the auditor confirms a date. Wingback starts it months earlier — silently, in the background — so when day 60 arrives, the binder is 89% complete on day one of the prep window.

STEP 0
6 months prior

Continuous evidence collection

Wingback runtime + posture + red team scans have been running for 6 months. 113/127 ISO 42001 controls already have automated evidence in the system.

active
STEP 1
Day 60

Audit confirmed · scope locked

Auditor confirms a date. Framework selected: ISO 42001 stage 1 · 127 controls in scope. Wingback's coverage view shows 89% ready · 14 gaps.

scoped
STEP 2
Day 50

Gap review with the auditor

14 gaps reviewed jointly. 8 require policy additions (will be auto-evidenced once written); 6 require manual evidence (assigned to named owners).

gap review
STEP 3
Day 38

Policies authored · compiled · evidence emitting

8 plain-English policies authored in Wingback. Each compiles to runtime rules and starts emitting evidence automatically. Coverage climbs to 95%.

policies shipped
STEP 4
Day 25

Remaining gaps closed by named owners

6 manual gaps closed. Each sign-off captured as an audit artifact with timestamp + signer. Coverage reaches 100% on the 127 in-scope controls.

owner signoff
STEP 5
Day 14

Binder generated · 184 pages · indexed by control

184-page PDF + JSON sidecar generated · 6.4 MB. Every control linked to evidence with timestamps + session IDs. Re-generates in 2 minutes if anything changes.

binder generated
STEP 6
Day 7

Internal rehearsal · last refinement

GRC team walks the auditor scenario. Discovers 1 control needing a clearer narrative. Updates the policy text · re-exports the binder in 2 minutes.

rehearsal
STEP 7
Day 1

Auditor opens the binder · zero follow-ups

Auditor receives the export · works through the controls · returns the most-organised-binder-they've-seen feedback. No follow-up questions. Stage 1 closed in two working days.

complete
What this prep replaced
  • ✗Manual binder assembly: 8 weeks of cross-team meetings, scattered evidence requests, late nights
  • ✗Quarterly evidence collection: gaps are inevitable · auditor finds what you missed
  • ✗Per-framework rebuild: switching to NIST RMF or EU AI Act = start over from scratch
  • ✓Wingback: 7-day final-prep · 0 auditor follow-ups · re-mappable to any framework with one click
Why this is different

An evidence backbone built for the regulator you actually have.

Most competitors lead with policy authoring; Wingback leads with the evidence backbone the policy enforces against. Most cover a handful of frameworks; Wingback ships 15+ including the brand-new OWASP Agentic Top 10. And where most show a generic compliance dashboard, we built industry-specific mappings for healthcare, finance, employment, and public sector, so the binder you export matches the auditor you're actually meeting. Your forward-deployed engineer maps your in-house evidence sources to controls, customizes the binder for your auditor's preferred structure, and stays in your Slack channel during audit season.

Trusted by GRC and security teams
SOC 2 Type II
Audited and current
SOC 2 Type I
Audited and current
ISO 27001
Certification in progress
ISO 42001-mapped
AI management system

Ship the binder, not the spreadsheet.

Map your AI stack to ISO 42001, NIST RMF, the EU AI Act, and the OWASP Agentic Top 10 this week — and export the binder before your auditor confirms a date.

Generate a sample audit pack