AI governance – ISO 42001, EN 18286 and the EU AI Act
Treat each AI use case as an asset with its own risks, controls and work plan, and show conformity with the EU AI Act from the same records.
Typical requirementsISO/IEC 42001:2023EN 18286:2026EU AI Act (EU) 2024/1689ISO/IEC 23894
Who it is forOrganisations that develop, provide or deploy AI systems, from internal assistants to high-risk systems placed on the EU market.
ISO/IEC 42001 sets up an AI management system. EN 18286, published in 2026, specifies the quality management system that providers need for EU AI Act purposes. The AI Act itself places obligations on providers and deployers according to the risk category of each AI system.
All three start in the same place: knowing which AI use cases exist, what each one does and who owns it. In WINGMAN each AI use case is an asset, so it takes the same links as everything else: risks, controls, suppliers, documents, incidents and audits. Controls already in place for ISO 27001 and GDPR are reused, and only the real gaps become work.
Videos
Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.
Registers WINGMAN keeps
Each register is a set of linked records in one model, not a separate spreadsheet. Pick an entity to see it in the data model.
AI use case registry
Every AI use case and system with purpose, owner, risk category, provider or deployer role, models, data and dependencies.
AI risk register
Risks per use case to people, the organisation and society, rated on the same scale as the rest of the register.
Impact assessments and technical documentation
AI system impact assessments, fundamental rights impact assessments, technical documentation and instructions for use, linked to the use case.
Obligations catalogue
ISO 42001, EN 18286 and AI Act articles as clause-level records, mapped to each other and to ISO 27001 and GDPR.
AI controls
Data governance, transparency, human oversight, logging, accuracy and robustness controls, each with an owner and evidence.
Model and AI service providers
Providers of models, platforms and AI features, with contracts, usage terms and assessments.
AI compliance work plan
The tasks to close gaps, with owners and dates, rolled up per use case and per obligation.
The governance cycle on the model
Step through how the regulation runs on WINGMAN records, from scope to proof.
Screens for this stage · Stage 1: AI use case inventory
Screens for this stage · Stage 3: Impact and risk assessment
GIF
Use cases from this angle
The same use cases, with what changes for this regulation.
Compliance
EU AI Act
The core of this angle. The AI use case registry, classification, risks and controls, and monitoring in use.
Compliance
New requirements
New guidance, standards and implementing acts are mapped onto existing controls instead of starting a new programme.
Compliance
GDPR and DPIA
Use cases that process personal data share their records with the DPIA, so the assessment is done once.
Operations
Supplier evaluation
Model and AI service providers are evaluated before use, and their changes reach the risk register.
Operations
Change management
A new model version or a new purpose is a change, assessed before it goes live.
Assurance
Auditing
Internal audits against ISO 42001 or EN 18286, with conclusions per clause.
Accountability
Roles and RACI
Provider and deployer duties, human oversight and AI literacy sit with named roles.
Questions it answers
Which AI systems do we use, and which of them are high-risk?
From the AI use case registry to the category and role recorded for each, with the reasons and who decided.
What does the AI Act require of us for this use case, and what is still missing?
From the use case to its applicable obligations, to the controls that meet them, to their evidence. Obligations with no control are the work plan.
Can existing ISO 27001 controls count for ISO 42001?
Requirements are mapped across standards, so a control that already meets an ISO 27001 clause shows where it also meets an ISO 42001 or EN 18286 one.
Who has to act when an AI system misbehaves?
From the incident to the use case, to the oversight role and the risks it realises, with the reporting deadline if it is a serious incident.
Other sectors and regulations
NIS2 and national cybersecurity law
Run the information security office of an essential or important entity from one registry of suppliers, assets, risks, incidents, vulnerabilities, threats and tasks.
Financial sector – DORA, MiCA and supervisory expectations
Run operational, financial, reputational and other non-financial risk management on one model, and catch the events that should move it.
ISO 27001 and SOC 2 Type 2
Keep the whole ISMS in one model, with control ownership, recurring reviews, management review and evidence that holds up over an audit period.
Cyber Resilience Act
Design CRA compliance into how products are built and supported, from risk assessment and SBOM to vulnerability handling and reporting.
GDPR and data protection
Keep the record of processing, DPIAs, processors, data subject requests and breaches as linked records, so accountability can be shown at any time.