You are running more AI than you think.
Your regulator is about to ask. We determine exactly which AI obligations apply to your organisation — and which do not — then find every AI system you are running, show you the gaps, and produce the evidence. Global frameworks are the spine; jurisdictions add the depth.
AI rules are arriving in every market at once. Few enterprises know which ones reach them.
The EU AI Act is phasing in its obligations, India has published its AI Governance Guidelines, and since 2024 the UAE, Saudi Arabia, Qatar and Oman have each issued binding or supervisory AI instruments, the most recent in February 2026 — and the GCC, India and the EU with the UK are the regions where our depth is complete. Wherever they are written, they demand the same five things in different words — and almost nobody can produce them:
An inventory. A risk assessment per system. Independent validation or prior approval. Human oversight. And a periodic report to somebody.
We tell you what applies, find what you run, and prove it is governed.
Independent AI governance for regulated enterprises. Assurance and runtime are separate service lines, separately licensed — and every deliverable states which, if any, AinoTeq-operated control was in its scope.
Applicability Determination
Which obligations reach your entity, which do not, and why — every line citing a clause, in two weeks from a completed profile.
- Entity, jurisdiction & licence analysis
- Applicable · conditional · not applicable
- Watchlist for proposed instruments
- Scoped programme, not a checklist
Regulatory Readiness Assessment
Every AI system you run — declared, detected and embedded — classified by risk and mapped to your obligations.
- Enterprise AI inventory
- Risk classification per system
- Control gap assessment
- Remediation roadmap
Continuous Governance
Governance decays. New systems appear, models change, and regulations move. We keep the picture true.
- Inventory & drift monitoring
- Regulatory change alerts
- Evidence expiry tracking
- Quarterly board reporting
Every determination is grounded in the obligation register and the framework library — cited to the clause, versioned, and open="" for you to check.
The AI Obligation Register
A cited, versioned index of the AI instruments in force, by jurisdiction — what each one demands, whom it reaches, and where the official text sits. Free to use, and we publish our coverage gaps alongside our coverage.
Jurisdictions, not countries
UAE federal with DIFC and ADGM held separately, Saudi Arabia, Qatar, Oman, Bahrain and Kuwait; India; the European Union and the United Kingdom — each tiered by how far we have verified it.
Cited, not summarised
Every entry links to the official text, with force, status and effective dates stated.
Versioned
Superseded instruments stay reachable and marked. Changes are logged publicly, never applied silently.
Gaps published too
We list what we do not hold. A register you cannot calibrate is a register you cannot rely on.
One index of the law. One library of the standards. Mapped to each other.
The register tells you what reaches you. The library tells you what discharges it. The mapping between them tells you how much of one you already hold by having done the other.
AI Obligation Register
A cited, versioned index of the AI instruments in force, organised by jurisdiction. Every entry names its issuer, the force it actually carries, its dates, and a link to the authority’s own text.
Framework Library
ISO/IEC 42001 with Annex A, NIST AI RMF 1.0, the EU AI Act and the India AI Governance Guidelines 2025, broken to control level against a library of 122 controls in 12 domains. ISO 42001 and NIST are jurisdiction-neutral and apply to you everywhere, today.
Determination first. Always.
Most AI governance work catalogues systems and then asks which rules might apply. We start from the obligations, because that is what decides which questions are worth asking.
Establish what applies
Your entity, jurisdictions, licences, data and AI use cases resolve to a cited obligation set — applicable, conditional, not applicable, and watchlist.
Find what you actually run
Declared by owners in the register, extracted from the documents you already hold, detected through read-only connectors into your cloud accounts, an agent you run inside your own network, and a scan of your own dependency manifests and published endpoints. Then risk-classified and tested against the evidence you hold. Start with the free Quick Scan →
Close it and keep it closed
Every gap gets an owner, a date and a target architecture. Then attestations expire, systems change, and the picture stays true.
The most valuable answer is often which rules do not reach you.
The method behind every engagement.
Determine, discover, assess and remediate — one connected path from your regulatory position to evidence a board can rely on.
Why we can find the AI you did not buy as AI.
An AI inventory is a systems problem before it is a governance problem. Most of the exposure sits inside software nobody procured as AI.
Assurance without the sales agenda.
AinoTeq takes no commission from any AI platform or model provider, resells no licences, and gives no independent opinion on any system it has built or remediated — so the advice you get is about what's right for you, not what's easy to bill.
That independence is not a marketing line. Regulators require validators to be independent of development. Where AinoTeq operates a control in your runtime, the assurance line and the runtime line are licensed separately and the deliverable discloses it by name — independence you can read, not independence you are asked to trust.
What actually applies to us?
Your entity, jurisdictions and use cases — resolved to a cited obligation set, including what does not reach you.
What AI are we actually running?
Declared, detected and embedded — including the AI that arrived inside software you already bought.
Where are the gaps?
Controls tested against the evidence you hold, with every finding owned and dated.
How do we stay ready?
Attestations expire, systems change and regulations move. We bring you each change, dated, and work out with you which of your systems it reaches.
Not sure what applies to you?
Tell us about your entity, your jurisdictions and what you are running. We will tell you whether an Applicability Determination is the right first step — no pitch, no obligation.