Your entity. Your data. Your control.
A governance engagement means letting us see how your organisation actually runs. This page sets out, in plain language, how Ainoteq earns and keeps that access. These are principles and summaries — the binding versions live in the engagement agreement.
Three refusals, in writing.
Independence that depends on good intentions is not independence.
No vendor commissions
No referral fees, no reseller margin, no marketing development funds — from any AI platform, model provider or governance tool vendor. You pay us. Nobody else does.
No licence resale
We do not sell software. The tooling we use to run an engagement is internal and never appears on your invoice, so there is no product we are quietly steering you toward.
No opinion on our own work
We do not provide an independent validation opinion on any model or control we have built or remediated. CBUAE and SAMA both require validation independent of development. So do we.
Sourcing, citation and correction.
The GCC AI Obligation Register is a free public index. Its only value is that it is trustworthy.
Primary sources, linked
Every entry points at the instrument as published by the issuing authority — the regulator, the ministry or the official gazette. We link to the source rather than reproducing it, and we record the issue date, version and status we relied on.
Tiered, and published honestly
- Verified — counsel-reviewed, applicability rules tested
- Mapped — held and summarised, not yet counsel-verified
- Tracked — monitored, no applicability rules yet
Where an instrument sits in a lower tier, the entry says so on its face. We also publish what we do not yet cover.
A public corrections log
When an entry is wrong, we correct it and record what changed, when, and why. Corrections are not quietly overwritten. If you believe an entry is inaccurate, write to hello@fnoai.com and we will review it.
What the register will not do
It does not tell you whether an instrument applies to you — applicability depends on your entity, jurisdiction, licence, data and use case. It is regulatory information and structured analysis. It is not legal advice and does not replace qualified counsel.
What we collect — and what we never collect.
Before any discovery begins, you see and approve exactly this, per source.
Governance metadata
AI system inventory · model and vendor metadata · versions and deployment context · integrations and data flows · configuration metadata · control and evidence records · the documents you choose to upload. Only what an applicability determination and an assessment need.
Your sensitive data
Passwords or secrets · source code · customer or transaction data · email or document contents beyond what you upload · personal data · production payloads · model training data. Not unless you explicitly enable a specific, named exception in writing.
Discovery connectors are read-only, outbound-only and deployed by you inside your own environment. Ainoteq never initiates a connection into your network, and your credentials never leave it.
Where your data lives, and how it ends.
Residency
We support in-region hosting across the GCC, and where a regulator requires in-country processing we host in that country or work entirely within your own tenancy. Residency is agreed before the engagement starts, not after.
Retention
Engagement data remains available to your nominated team inside a tenant-isolated workspace for as long as your account is active. Access is by one-time code to your corporate email domain only.
Deletion — provable
Ask us to remove your data at engagement end and we comply in full and issue a deletion certificate. What we retain is de-identified pattern knowledge that cannot identify you or your organisation.
Yours, and ours — stated plainly.
Your data and your deliverables
Your facts, your uploads, your applicability matrix, your assessment and your remediation plan belong to you, without restriction on internal use or use with your regulator.
Method, register and anonymised patterns
Our methodology, the obligation register, the control library and the de-identified patterns that make each next engagement sharper remain Ainoteq's — without your identity ever travelling with them.
Deliverables are approved by your nominated approver, versioned, and sealed with a content hash — an auditable record of who approved exactly what, and when. We produce readiness, evidence and gaps. Regulators determine compliance, and accredited bodies certify it. We do not guarantee either.