31 standards · 6 domains
Built to standard.
WeLead Lab designs, builds, secures, and governs against the recognized AI, security, privacy, and sector standards — from NIST AI RMF, the EU AI Act, and ISO/IEC 42001 to the OWASP Top 10 for LLM Applications, MITRE ATLAS, ISO/IEC 27001, SOC 2, and GDPR. Standards are wired into the lifecycle, not bolted on at the end.
How we apply them
We align our delivery to every standard below. Governance frameworks shape what we build; secure-by-design practices govern how we ship it; AI-security knowledge bases drive threat modeling; privacy and sector rules constrain how data is handled. Where you need a formal certification or attestation, we run the conformity assessment with you — we don't claim badges we don't hold.
AI Governance, Risk & Trustworthiness
How we decide what to build, prove it is responsible, and keep it accountable — voluntary frameworks and binding regulation alike.
6 standards
AI Risk Management Framework
Voluntary framework for building trustworthiness into the design, development, use, and evaluation of AI. Our governance baseline.
Generative AI Profile
Companion to the AI RMF enumerating 12 generative-AI risk categories (confabulation, data privacy, information integrity, security…). Guides every GenAI build.
AI Management System (AIMS)
The certifiable management-system standard for AI. We structure governance, roles, and controls to its requirements.
AI Risk Management
Guidance on managing AI-specific risk across the lifecycle — how we identify, treat, and monitor risk.
Regulation (EU) 2024/1689
Binding, extraterritorial, risk-based AI law (prohibited / high-risk / limited / minimal). We classify and document systems against it.
OECD/LEGAL/0449
Five values-based principles (human-centred, transparent, robust, accountable). The ethical north star for our work.
AI Lifecycle, Quality & Assurance
How we run the AI system lifecycle, assess impact before launch, and hold output to a measurable quality bar.
5 standards
AI System Life Cycle Processes
Defines the processes for the AI lifecycle (built on 15288/12207). The backbone of how we run engagements.
AI System Impact Assessment
Guidance for assessing AI impact from design through decommissioning. We run an impact assessment before high-stakes launches.
AI Concepts & Terminology
Shared vocabulary and concepts for AI — so requirements, risk, and docs mean the same thing to everyone.
Framework for ML-based AI Systems
Reference framework for AI systems built with machine learning. Shapes our ML solution architecture.
Product Quality Model (SQuaRE)
The product-quality model (now including Safety). We specify, measure, and evaluate systems against its characteristics.
AI Security
How we threat-model and defend AI systems — against prompt injection, data poisoning, model theft, and the rest of the AI attack surface.
5 standards
LLM & GenAI application risks
The canonical LLM/agent security checklist (prompt injection, sensitive-info disclosure…). Every agent build is reviewed against it.
Machine-learning security risks
Top risks for ML systems (data poisoning, model inversion, evasion). Guides how we secure training and inference.
Adversarial Threat Landscape for AI Systems
Knowledge base of real adversary tactics & techniques against AI/ML. We threat-model against its TTPs.
Adversarial Machine Learning taxonomy
Taxonomy of attacks and mitigations across the ML lifecycle, including GenAI/RAG/agents. Informs our defenses.
Secure AI Framework
Practitioner framework for securing AI systems end to end. A reference for our AI security controls.
Secure-by-Design & Application Security
The security of the design and implementation itself — secure SDLC, hardened applications, and an information-security management system underneath.
7 standards
Information Security Management (ISMS)
The certifiable ISMS standard. We design and operate to its controls so security is managed, not improvised.
Information security controls
The control catalogue behind 27001 — the concrete safeguards we implement.
AICPA Trust Services Criteria
Security, availability, confidentiality, processing integrity, and privacy criteria. We build to them and support client attestations.
Secure Software Development Framework
Secure-by-design practices across the SDLC (with the SP 800-218A GenAI augmentation). How we write and ship code.
Cybersecurity Framework
Govern-Identify-Protect-Detect-Respond-Recover. The frame for operational security of what we run.
Application Security Verification Standard
The verification checklist we test web/app builds against before release.
CIS Critical Security Controls
Prioritized, prescriptive safeguards for infrastructure hardening and baselining.
Data Governance & Privacy
How we handle personal and sensitive data — lawfully, minimally, and with privacy engineered in.
4 standards
Regulation (EU) 2016/679
EU data-protection law — lawful basis, data minimization, DPIAs, data-subject rights. We engineer to it by default.
California Consumer Privacy Act
US consumer privacy rights and obligations. Honored for US data flows.
Privacy Information Management (PIMS)
Extends 27001 to privacy. Structures how we manage personal data as controller or processor.
Privacy Framework
Foundational privacy principles and terminology that anchor our privacy-by-design.
Cloud & Sector Compliance
Cloud-specific controls plus the regulated-industry rules that apply when AI touches health, payments, or other sensitive sectors.
4 standards
Cloud security controls
Cloud-specific security guidance. Applied to how we architect and operate on the cloud.
PII protection in public clouds
Protecting personal data processed in the cloud. Applied to client data handling.
45 CFR Parts 160 & 164
US healthcare privacy & security rules. Applied to healthcare AI engagements.
Payment Card Industry Data Security Standard
Security for systems that handle cardholder data. Applied to payments/fintech work.
FAQ
On compliance.
Are you certified to all of these? +
We design, build, secure, and govern our work to align with these standards. Several (ISO/IEC 42001, ISO/IEC 27001, SOC 2, EU AI Act conformity) are formal certifications or attestations earned per-organization or per-system — where you need one, we run the conformity assessment or audit-readiness with you rather than claiming a badge we do not hold.
Which standards apply to my project? +
It depends on what we build and where it runs. Every engagement starts with a Scan and Audit that maps the applicable standards — e.g. an EU-facing high-risk system pulls in the EU AI Act and ISO/IEC 42001; a healthcare build adds HIPAA; an LLM agent is reviewed against the OWASP Top 10 for LLM Applications and MITRE ATLAS.
How do you actually apply them? +
Standards are wired into the lifecycle, not bolted on at the end: governance and risk frameworks shape what we build, secure-by-design practices govern how we write and ship code, AI-security checklists drive threat modeling and testing, and privacy/sector rules constrain how data is handled. Every system ships with the evaluation, monitoring, and documentation the relevant standards expect.
Need AI you can defend?
Book a scan and we'll map exactly which standards your project must meet — and how we'll build to them.
Book a free scanAustin, TX · [email protected]