Winners provides ISO 42001 × EU AI Act × Taiwan AI Law compliance — AI risk classification, algorithm review SOPs, and transparency reports.

The EU AI Act entered into force in August 2024, with high-risk AI systems required to comply by 2026. If your product or service has end-users in the EU, your company must comply — regardless of where you are headquartered.

Taiwan's AI Basic Act was passed in 2024, with subsidiary regulations still being developed. Winners tracks all regulatory updates to ensure your compliance roadmap stays current.

If your internal AI is used for high-risk scenarios like HR decisions or credit assessment, we recommend establishing a governance framework proactively, even without external sales, to mitigate future regulatory and labor dispute risks.

Typically 7–12+ months depending on AI system complexity. Winners offers modular pricing — you can start with your highest-risk systems and expand coverage incrementally.

In 2019, the Apple Card / Goldman Sachs AI credit scoring tool was alleged to grant lower credit lines to women, triggering a 16-month NYDFS investigation. ISO 42001 requires enterprises to establish bias testing, algorithm review SOPs, and decision explainability reports — the only institutional evidence accepted by regulators when an incident occurs. Winners helps complete bias risk assessment before AI deployment, preventing brand collapse and regulatory penalties.

In 2018, Amazon scrapped its internal AI recruiting tool after it was found to systematically discriminate against female candidates. Taiwan's Ministry of Labor has flagged AI recruitment fairness, and the EU AI Act lists HR and recruitment AI as high-risk with fines up to 7% of global annual revenue. Winners builds training data bias detection, decision transparency, and human review mechanisms aligned with ISO 42001 and the EU AI Act.

Clearview AI scraped 3 billion face images for AI training; between 2022 and 2024 it was fined under GDPR and privacy laws by France (CNIL), Italy, Greece, Netherlands, and the UK, with cumulative penalties exceeding €100M, and ordered to stop processing EU citizens' data. Winners builds AI training data legality review, biometric DPIAs, and cross-border transfer SOPs ensuring ISO 42001 × GDPR dual compliance.

EU AI Act Articles 9-15 require: (1) iterative risk management, (2) training data quality governance, (3) technical documentation (model cards), (4) automated logs, (5) transparency disclosure, (6) human oversight, (7) accuracy and robustness testing, (8) CE marking conformity declaration. Winners builds all eight in one engagement using the ISO 42001 framework, before the 2026 deadline.