Independent. Cited. Accountable for the determination.
Ainoteq is an independent AI governance and regulatory applicability practice for regulated enterprises across the GCC. We determine which AI obligations reach your organisation — and which do not — find every AI system you are actually running, show you the gaps, and produce the evidence.
Six Gulf states now have AI instruments in force or in flight, and they do not agree with each other. A DIFC-licensed firm, a CBUAE-supervised bank and a Saudi government-linked entity face three different obligation sets, and most enterprises begin a governance programme without knowing which of them binds their own legal entity. They over-build in one place and miss another entirely.
That determination is the work. Everything else follows from it. We are deliberately small: what we sell is senior judgment on a narrow question, not headcount, and not software. The tooling we use to run an engagement is ours and never appears on your invoice.
Suman Pandey
AI Governance · Regulatory Applicability · Enterprise AI Architecture
25+ years designing and delivering complex enterprise technology — including 11+ years leading multi-country transformation programmes across the Middle East and Africa, spanning 10+ countries and large concurrent delivery portfolios.
That record matters here for a specific reason: an AI inventory is only as good as the person who can read an enterprise landscape. Knowing where AI is embedded inside an ERP, a service desk, a fraud engine or a vendor SaaS module is a systems problem before it is a governance problem.
Connect on LinkedInWhat we believe
You are buying judgment. It is only fair you can see how we think.
Applicability first
Nothing is worth building until you know which obligations reach you.
Cited, not summarised
Every line points at a clause in a primary source. Paraphrase is where error enters.
Not applicable is an answer
Telling you a rule does not reach you is worth as much as telling you it does.
Evidence over assertion
A control that cannot be evidenced has not been implemented.
Independence is structural
No commissions, no resale, no opinion on our own work. Not a policy — a constraint.
Publish the gaps
Where our coverage is thin, we say so. Silent gaps are how a register becomes untrustworthy.
When nobody can say what actually applies.
Your regulator has issued AI requirements and nobody owns them
We establish the obligation set for your entity, cited clause by clause, in two weeks.
You cannot list the AI systems you are running
Declared, detected and embedded — including the AI inside software you bought without calling it AI.
You operate across more than one Gulf jurisdiction
Different entities, different regulators, different obligations. We resolve the matrix rather than applying the strictest rule everywhere.
DIFC Regulation 10 names a role you have not filled
The Autonomous Systems Officer, held externally, with the registers kept and the annual report written.