“We have an AI mandate and a deadline. Where do we start?”
Turn the mandate into a sequenced programme backed by evidence, with a fractional Chief AI & Product Officer if you need one.
Sovereign Artificial Intelligence
Your Artificial Intelligence ambition,
built on ground you control.
Not a promise: proof. We help governments and regulated enterprises, in the Gulf and worldwide, adopt Artificial Intelligence (AI) in which the data, the models and the decisions stay under their control, and can be shown to regulators, boards and citizens.
What leaders ask us
The questions we hear,
and how we answer them.
From ministries in the Gulf to banks in Europe and funds in Africa, the questions are remarkably similar. These are the ones we hear most, and how we answer.
“Our sensitive data can’t leave our control, or the country.”
Each class of data is matched to a hosting tier, with no silent fallback abroad. We deliver in-country.
“We must prove compliance to regulators and auditors.”
We map controls to the standards that apply to you and keep an evidence pack for every release.
“It has to work in our languages.”
Arabic–English and other local languages by design, tested on your own documents and dialects, with Arabic-speaking team members.
“We don’t want to be locked in to one vendor or model.”
Rules stay outside the model, the evaluation set is yours, and the exit is rehearsed.
“Connect AI to our ERP safely.”
Product-agnostic, with deep experience across SAP, Oracle, JD Edwards EnterpriseOne, Workday and Odoo. Agents are read-only by default, with human approval for anything irreversible.
“People must stay accountable for decisions about citizens and customers.”
An autonomy model (advise, prepare, execute) with clear no-go zones and a full audit trail.
“Build our own capability, not dependence on consultants.”
Forward-deployed engineers build alongside your team, then hand over.
Where it pays first
Start where the need is real,
in your market.
Typical first uses we see in each market. Each starts from a local need, keeps the data where it must stay, and leaves the decision with a person.
Gulf
Arabic–English government services
The need
Residents and businesses expect answers in Arabic and English, at any hour, about licences, permits and applications.
What it does
A bilingual assistant that answers from approved policy and tracks each application, with a named officer approving every decision.
Gulf
Arabic document and case processing
The need
Applications, contracts and correspondence arrive as scanned Arabic documents with stamps and handwriting.
What it does
Extraction, classification and summaries in Arabic and English, checked by case officers, with the data kept in-country.
Gulf
National energy and utility assets
The need
Critical infrastructure data cannot leave national control, yet maintenance teams need faster answers.
What it does
Inspection findings, maintenance history and manuals brought together for engineers, on sovereign hosting.
Europe
Regulated financial services
The need
Banks and insurers must show how every model decision is made, under the EU AI Act, GDPR and DORA.
What it does
Complaints, KYC and claims review assisted by models held in-region, with the evidence pack a regulator expects.
Europe
Public-sector casework
The need
Caseworkers handle rising volumes in several languages while data stays within national systems.
What it does
Case summaries, drafting and triage for caseworkers, with the decision always left to a person.
Africa
Social security and member services
The need
Pension and social-security funds serve members across languages and channels, often on stretched teams.
What it does
Member enquiries, claims checking and contribution queries in local languages, integrated with the fund’s core system.
Africa
Agriculture and food security
The need
Farmer registration, crop intake and payments depend on reliable records, and advice must reach farmers in their language.
What it does
Farmer advisory and intake checks in local languages, working from the grower platform’s own data.
Global
Finance and procurement on the ERP
The need
Finance teams spend days matching invoices, explaining spend and chasing exceptions.
What it does
Agents that match, explain and flag inside your ERP, read-only by default, with approvals kept in the platform.
How we engage
Assess, design, prove, run.
Each stage ends with evidence your sponsor can act on, and you can stop, change course or continue at every step.
First 90 days
Assess and decide
Readiness assessment, data classification, the first use cases chosen and the business case agreed.
Months 3 to 6
Design and prove
Architecture, hosting tiers and controls agreed; one or two use cases proved on real work against your acceptance criteria.
Months 6 to 12
Scale and run
Proven use cases in production, the operating model and evidence packs in place, and the exit rehearsed.
Year 2
Build your capability
More use cases, on your own platform and team, with our engineers stepping back.
An indicative roadmap. Yours is agreed in the readiness assessment, around your deadlines and priorities.
Start here
The sovereign Artificial Intelligence readiness assessment
Fixed scope, agreed upfront. Contact us for pricing.
Request an assessment ↗What you receive
- A scored eight-dimension readiness report, today and in 12 months
- A map of your data classes to hosting tiers
- A control map against the standards that apply to you
- A shortlist of first use cases, each with a business case
- A 12-month roadmap with owners and decision points
- A briefing for your board or minister
What sovereign means
Control and choice,
not just a local data centre.
Sovereign Artificial Intelligence means your organisation keeps control over where data is processed, who operates the system, which models run and how you can change them. No supplier or foreign jurisdiction holds that control for you. We build that control into the architecture and the ERP ecosystem, then prove it with evidence a board or regulator can inspect.
Residency is a location. Sovereignty is control.
A local data centre does not help if support tickets, logs or fallbacks quietly send your data abroad.
Sovereignty is a spectrum, not a switch.
Few organisations own every layer. What matters is keeping control and choice when it counts.
Adapt, don’t pre-train.
Today’s open-weight models, including strong Arabic–English ones, are good enough for most enterprise and government work. Invest in the platform, the data and the governance.
If you haven’t rehearsed the exit, you don’t have one.
Keep permissions and business rules outside the model, keep your evaluation set, and test a model swap before you need it.
Put intelligence on a dependable core.
Sovereign Artificial Intelligence that cannot safely read from and act on your ERP ecosystem is only a demo.
Why now
Governments everywhere
are setting the rules.
We start at home. The UAE and Saudi Arabia are setting the pace, and national AI goals and data rules are arriving elsewhere too. Enterprises that serve governments, and regulated sectors such as finance, energy and health, now need AI that meets those rules by design.
UAE
- National strategyA national AI strategy to 2031, with a minister for AI since 2017.
- Personal dataA federal personal data protection law, with conditions for transferring data abroad.
- Emirate programmesEach emirate runs its own digital government and AI programmes on top of the federal strategy.
Saudi Arabia
- National strategyA national strategy for data and AI, from SDAIA.
- Personal dataA personal data protection law, with rules for transferring data abroad.
- Cyber securityNational cybersecurity controls from the NCA for government and critical sectors.
Europe
- European UnionThe EU AI Act sets risk-based obligations, alongside GDPR and the EU Data Act.
- Regulated sectorsOperational-resilience rules such as DORA and NIS2 reach the suppliers and cloud services behind every model.
Africa and Asia
- Kenya and NigeriaNational data protection laws with cross-border transfer conditions.
- UgandaThe Data Protection and Privacy Act sets duties for collecting, processing and transferring personal data.
- IndiaThe Digital Personal Data Protection Act sets new duties for anyone processing personal data.
For your CIO
The detail behind the promise.
How we score readiness, the reference architecture, the hosting tiers and the standards we map your controls to. Each part has a tested alternative, so no single supplier decides your future.
Readiness: eight dimensions, one honest view
Each dimension is scored from 0 (Exposed) to 4 (Verified), today and as a realistic 12-month target. Level 4 is not achievable on every dimension for any single organisation. Chips, for example, are made by a handful of companies.
0 · Exposed1 · Nominal2 · Controlled3 · Resilient4 · Verified
Strategy & value
Governance & accountability
Data residency & control
Operational control & security
Model sovereignty & language
Compute & resilience
Portability & exit
People & operating model
Reference architecture: six layers, two planes
Governance & assuranceAI register, model and agent registry, evaluation and release gates, Arabic benchmarks
- Channels & identityStaff single sign-on, national digital identity where relevant, staff and customer or citizen assistants.
- Knowledge & agentsRetrieval over governed content, including Arabic documents; agents connected to the ERP, read-only by default.
- Gateway & guardrailsRouting by data classification, redaction of personal data, prompt-injection filtering, quotas and no cross-border fallback.
- ModelsOpen-weight models, for example Falcon or Jais for Arabic–English, plus permitted commercial models, chosen to fit your requirements.
- Platform & orchestrationGPU scheduling and isolated tenancy for each entity or business unit.
- Sovereign infrastructureHosting tiers matched to data classification, on the in-country or sovereign cloud your rules require, with multi-site recovery.
Security & observabilityCustomer-held keys, immutable logs, security operations feed, cost metering
Three hosting tiers. No silent fallback.
Tier A · Restricted
On-premises or air-gapped
For the most sensitive government and commercial data.
Tier B · Confidential
Certified in-country sovereign cloud
For confidential and internal data that must stay in-country, on the national or sovereign cloud you choose.
Tier C · Public
In-region cloud or API
For public information only, never as a silent fallback for the tiers above.
Models, clouds and tools are examples. We are product-agnostic, and the choice follows your requirements and your regulator.
Standards we map your controls to
- UAE Information Assurance Regulation
- Dubai Information Security Regulation
- ADHICS (Abu Dhabi health)
- NCA Essential Cybersecurity Controls
- SAMA Cyber Security Framework
- SDAIA and NDMO data rules
- EU AI Act
- GDPR
- ISO/IEC 42001
- ISO/IEC 27001
- NIST AI Risk Management Framework
Who it is for, and who leads it
Built for public trust.
Guided by people who have carried it.
For governments
Ministries, authorities and government-owned entities with national AI goals, citizen services and strict data rules.
For enterprises and regulated sectors
Banks, energy, health, telecoms and industrial groups that must keep data in-country or in-region, and show regulators how every model decision is made.
Who leads this work
Ravi Shankar RFounder & Managing PartnerLed the Abu Dhabi Farmers Services Centre grower platform: registration, crop intake and payment for 2,000+ farmers on customised JD Edwards.
Shankar VisveswaranCo-Founder & Managing PartnerLed British Council’s finance platform across 153 countries: an SAP-certified reference architecture, closing in 4 days.
Mohammed Yasser AmmarSenior VP — Business Transformation24 years guiding government and retail organisations across the UAE, GCC and Egypt from strategy to working platforms.
Ganapathy SivakumarHead of AI & ProductAI healthcare innovator: 10+ programmes, including document intelligence and revenue-cycle automation for US healthcare.We build sovereign AI on the core systems our partners have already been trusted with, including Saudi Aramco’s finance transformation (partner-led) and the Abu Dhabi Farmers Services Centre grower platform, and on Ganapathy Sivakumar’s 10+ AI programmes in regulated healthcare. Before you commit, we prove it on your own work.
Request a sovereign AI readiness assessment ↗Read: Sovereign-ready AI is an architecture decision ↗
The next conversation