Know what applies. Prove what you run.
Four lines, licensed separately, because you may only need one. Every engagement starts from what your regulators actually require of your organisation — and what they do not.
What we do, in the order it has to happen.
AinoTeq consultants deliver Determine, Discover and Assess; you keep working in the Control Room afterwards. A partner can deliver Assess and Discover under its own mark instead.
Which obligations reach you
Jurisdiction, sector, role and system risk class go in. A signed applicability determination comes out, with the predicate behind every line shown and cited to the clause. No language model participates in deciding what applies to you.
Every AI system you are actually running
Declared by owners in the register, extracted from the documents you already hold, detected through read-only connectors into your cloud accounts, through an agent you run inside your own network, and by reading your own dependency manifests and published endpoints. The detected layer routinely contradicts the declared one, and both are kept.
Start with the free Readiness Quick Scan → — ten minutes, anonymous, an indication from your own answers.
Where you are short, against law and standard alike
ISO 42001 readiness and the Statement of Applicability, NIST and EU AI Act coverage, control assurance tested against the evidence you actually hold, and an architecture assessment against the target enterprise AI architecture.
Keeping it true after the report is filed
The Control Room holds continuous posture — what you run, what applies, what is proven, what has drifted. It also ingests the decisions your own AI gateway makes, so what your AI actually did is evidence rather than an assertion. AinoTeq does not today sell a gateway that enforces policy or inspects content in your traffic; when we do, this line will say so.
Applicability Determination
Two weeks from a completed profile, fixed fee.
Four answers, every line cited
We establish which obligations apply to your entity, in your jurisdictions, for your AI use cases — and, just as usefully, which do not.
- Applicable — with the clause that triggers it
- Conditionally applicable — with the condition stated
- Not applicable — with the reason
- Watchlist — proposed and consultation instruments
Scope down before you spend
Most organisations begin an AI governance programme without knowing which rules bind them. They over-build in some areas and miss others entirely.
Telling you that CBUAE requirements do not reach your entity is worth as much as telling you that Regulation 10 does. Both shrink the problem to its real size.
Engagements
Each rung stands alone. Each one earns the next.
Applicability Determination
Which obligations apply to you, which do not, and why.
AI Regulatory Readiness Assessment
Your full AI estate — declared, detected and embedded — classified by risk, mapped to your obligations, with the control gaps named.
- Enterprise AI inventory
- Risk classification per system
- Regulatory applicability matrix
- Gap assessment
- Executive risk report
- Target governance framework
- Remediation roadmap
AI Governance Implementation
Closing the gaps the assessment found — the operating model, the frameworks, the registers, the controls and the evidence.
- AI governance operating model
- AI policy and risk frameworks
- AI register implementation
- Control implementation and evidence framework
- Vendor and third-party AI assessment
- Model and agent governance
- Monitoring architecture and board reporting
Continuous AI Governance
Governance decays without attention. New systems appear, models change, vendors change, and regulations move.
- AI inventory monitoring
- Regulatory change alerts, mapped to your systems
- Risk reassessment and evidence tracking
- Control monitoring with expiry
- Quarterly management reporting
Outsourced Autonomous Systems Officer
DIFC Regulation 10 names the role. Most firms are too small to appoint one internally.
- Registers of use cases, processing and automated decisions
- High Risk Processing assessments
- Transparency notice review
- Annual report to the board
Regulatory filing preparation
Where a regulator sets the cadence, the work repeats whether you are ready or not.
- QCB pre-approval submissions
- QCB annual disclosures
- CBUAE remediation updates
- Oman compliance reports
What we will not do.
The refusals are part of the service, not a limitation of it.
No vendor commissions
No referral fees, no reseller margin, no marketing funds — from any AI platform or model provider. You pay us; nobody else does.
No licence resale
We do not sell software. The tooling we use to run an engagement is ours, and it is not on your invoice.
No opinion on our own work
We do not provide an independent validation opinion on any model we have built or remediated. Regulators require validators to be independent of development, and so do we.