Register & classify
Place each system on the risk ladder and screen it against Article 5 before it runs.
Product
Add a system. Run the modules. Keep the proof.
Everything Regulation 10 asks you to hold, produced in one place and sealed so it can be checked.
The modules
What each one produces
Assess & document
A DPIA, a transparency notice, bias testing and a threat model, each cited to its clause.
Evidence & audit
An append-only audit trail and a signed evidence pack an Accredited Certification Body can open directly.
Register & classify
Every system, named and cited.
Register each system once, place it on the DIFC risk ladder, and screen it against Article 5 on the way in. Bulk CSV import brings an existing estate under the register in one pass.
Produce evidence
Sealed, and pinned to a source.
DPIA, transparency notice in English, bias and fairness testing, threat model, cross-walk and a signed pack. Every artefact is citation-pinned and sha256-sealed by a deliberate Approve and Lock. The seal records the hash, it does not certify.
SystemUnderwriting copilot
Decision Allowed · PII redacted
Policyart5-prohibition · v2
Sealedsha256 c93b71a4f0e2…88cd
Runtime
The gateway decides, then records why
Point your model calls at an OpenAI-compatible gateway. For each call the gateway allows it, blocks it, redacts personal data, or routes it to a person. It writes a decision record naming the system, the decision, the policy version and the timestamp.
What it is not. It is not a monitoring agent inside your cloud. That is Sentinel, and it is on the roadmap.
See how it deploysThe record in situ
The record, exactly as a regulator reads it.
The audit room is dense, plain and printable. Every row names its system, superseded versions are struck so they can never read as current, and each sealed row carries its sha256.
By request
The audit room is shown live in a guided demo. The record, and how it reads, stays with the firms that use it.
Interactive demoWhere the platform stops
- It drafts. You approve. Nothing seals without a human clicking approve and lock.
- It cites. It does not advise. Your counsel checks the clause.
- It evidences. It does not certify. An Accredited Certification Body does that.
- It does not certify you. Certification may only be issued by an Accredited Certification Body or by the Commissioner, if the Commissioner establishes a certification scheme.
- It does not give legal advice. Every output cites a clause so your counsel can check it.
- It does not move your accountability. The officer named under Reg 10.3.1 still answers for the systems.
- Reg10 Sentinel, which watches models inside your own cloud, is on the roadmap. It is not built.
Run it on one of your own systems
Bring a system, a controller and an hour. You leave with a DPIA.