Global frameworks are the spine. Jurisdictions add the depth.
A region here is a jurisdiction pack: the instruments held and cited in the obligation register, the applicability rules a determination runs on, and the frameworks mapped to them. Hosting and residency are agreed per engagement, and we say below exactly what stands today.
Three regions with complete packs, and a baseline everywhere else.
We publish the state of each one rather than a map with everything shaded in. Every instrument named below is in the register with its primary source, its tier and its dates, and every rule a determination runs on cites one of them.
Gulf Cooperation Council
All six states, with DIFC and ADGM treated as the separate legal systems they are — collapsing them into "UAE" would make every determination wrong for a free-zone entity. Six jurisdictions carry held instruments today, and three of them — UAE federal, DIFC and Saudi Arabia — carry the applicability rules a determination runs on; for the others we say what we hold and that the rules are not built yet. Kuwait has published no AI-specific instrument for financial institutions, and the ADGM FSRA initiative is an initiative rather than a rule, so we do not pad the count with them.
| Pack | 12 instruments across 6 jurisdictions · rules for UAE federal, DIFC and Saudi Arabia |
| Hosting | Shared stack in India today · in-region or in-country GCC hosting stood up per engagement where a regulator requires it |
| Sources | English and Arabic; Arabic-only instruments are held as our translation, marked as such, and the Arabic prevails |
| Channel | Direct |
India
The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, held with their phased commencement as data — the substantive duties run from 14 May 2027 and every determination line says so. Alongside them the RBI's FREE-AI framework for regulated entities, CERT-In's AI Bill of Materials guidelines and its 2026 blueprint on AI-assisted exploitation, and SEBI's consultation on AI/ML in the securities markets, held on the watchlist as the consultation it is. The India AI Governance Guidelines 2025 are in the framework library. IRDAI has published no AI instrument; a working group was formed in June 2026, and we hold nothing rather than guess.
| Pack | DPDP Act · DPDP Rules · RBI FREE-AI · CERT-In (two) · SEBI (watchlist) · MeitY guidelines in the framework library |
| Hosting | India stack — the shared stack every tenant runs on today |
| Sources | English, from MeitY, the RBI, CERT-In and SEBI |
| Channel | Direct and system integrator partners |
European Union · United Kingdom
The EU AI Act, held as amended by the Digital Omnibus on AI of July 2026, with its obligations split by the role you actually play — provider, deployer, general-purpose model — and the Annex III date of 2 December 2027 carried on every high-risk line. The GDPR provisions that bite on AI: principles, information about automated decisions, Article 22 and the impact assessment. For the UK, the automated-decision rules in force since 5 February 2026 under the Data (Use and Access) Act, the government's five principles held as the guidance they are, and the ICO's guidance on AI and data protection.
| Pack | EU AI Act by role · Digital Omnibus · GDPR touchpoints · UK GDPR Arts. 22A–22D · DSIT principles · ICO guidance |
| Hosting | Shared stack in India today · in-region EU hosting stood up per engagement where a regulator or a client requires it |
| Sources | English, from EUR-Lex, the Commission's AI Act Service Desk, legislation.gov.uk, GOV.UK and the ICO |
| Channel | Direct |
Everywhere else
There is no jurisdiction pack for the rest of the world, and we will not pretend otherwise. What still applies is the spine: ISO/IEC 42001 and NIST AI RMF are jurisdiction-neutral and in force for you today, and an ISO 42001 management system is defensible to a regulator that has not yet written its own rules.
Your region is agreed before the engagement starts, not after.
One home per tenant
A tenant is homed to one region stack. Its data, its backups and its gateway telemetry stay in that region.
Visible from inside
The region is shown in the Control Room shell, read from the tenant record, so anyone signed in can see where their data is without asking us. Where it has not been stated, the shell shows nothing rather than a guess.
In-country when required
Where a regulator requires in-country processing we host in that country, or work entirely inside your own tenancy.