The principles behind how the platform is built

These four principles guide the platform's engineering, content and commercial decisions. They are not aspirational; they are the tests applied to every shipped artefact.

Evidence over assertion. Every Reg 10 claim the platform makes is backed by a citation-pinned artefact: a DPIA, a transparency notice, an audit trail line, or an entry in the AI System Register. If the evidence cannot be produced, the claim is not made.

Sovereign by default. Regulated data sits at rest in UAE North. The platform is held to the same controls it produces for tenants: its own classification, DPIA and register entry are being built inside the platform, under the same named-reviewer sign-off required of tenants, and are not presented as done before a named reviewer has signed them. Cross-border data flows happen only under DIFC SCCs with a Transfer Impact Assessment on file.

Human in the loop, always. Autonomous outputs do not leave the platform without a human gate. The ASO, or a delegated reviewer, signs off on DPIAs, system classifications and any change to a deployed AI system before it is released to tenants or auditors.

Interoperability over lock-in. DPIAs and evidence packs are produced in formats designed for ISO/IEC 42001, the EU AI Act, the NIST AI RMF and the OECD AI Principles, not just Reg 10. Tenants who migrate jurisdictions should not have to redo the work.