#1
Enterprise architecture artefacts
- ArchiMate views: motivation, business, application, technology, migration
- Architecture decision records and design authority minutes
- TOGAF architecture definition and roadmap
- Data-flow and data-residency maps
#3 · We build · AI Factories
Build AI factories you own.
We design, build and run AI factories with your engineers: software, governance, cloud, data, MLOps and training. For banks, telcos and government entities. In your tenant, in your country, owned by your team when we leave.
Every run leaves evidence
$ factory run software --pack bian domain BIAN · Payment Execution route in-country · confidential ✓ gate 1 spec approved ✓ gate 2 design approved ✓ gate 3 merge approved → gate 4 release approved · evidence complete
$ factory run software --pack oda domain TM Forum ODA Component · Open APIs route in-country · confidential ✓ gate 1 spec approved ✓ gate 2 design approved ✓ gate 3 merge approved · conformance pass → gate 4 release approved · evidence complete
$ factory run software --pack govstack domain GovStack · Consent building block route in-country · NDMO classified ✓ gate 1 spec approved ✓ gate 2 design approved ✓ gate 3 merge approved · spec conformance pass → gate 4 release approved · evidence complete
Illustrative · people approve at four gates
We work with
01 · What
Six factories. One core.
Six factories share one governed core, in your tenant. A factory is a governed production system: agents and pipelines run versioned recipes inside guardrails, and every run leaves evidence. You choose which factories to build, and in what order. Each new factory costs less than the one before.
Six factories
- AI SoftwareBuilt first
- GovernanceEvidence
- Cloud IaCLanding zones
- Data PlatformData products
- MLOpsModels
- AI TrainingPeople
first factory, live in 16 weeks
Shared core
- Meta-model · recipes · model gatewayPolicy-as-code · evaluation · evidence
Your tenant · in-country
- Any major cloudIn UAE and KSA regions
The six factories
Build one. Add the next on the same core.
-
#1 AI Software Factory
From request to production, with human gates
Spec-driven, multi-agent delivery. Analyst, architect, developer, tester, security and reviewer agents do the work. People approve the spec, the design, the merge and the release.
TimingBuilt first · 16-week build
-
#2 Governance Factory
Audit-ready architecture and compliance evidence
Produces the enterprise architecture artefacts, control mappings and registers that auditors and regulators ask for. Every obligation is traced to a control, and every control to its evidence.
TimingAlongside the first factory · 8–12 weeks
-
#3 Cloud Factory · IaC
Compliant landing zones on any cloud
Infrastructure-as-code recipes for the major clouds, with configuration management built in. CBUAE, SAMA and NCA policy checks run on every plan before it applies.
TimingOften second · 8–12 weeks
-
#4 Data Platform Factory
Governed data products that stay in-country
Data contracts, quality rules, lineage and classification tags on every dataset. Classification decides where data may go. Every non-production environment uses synthetic data.
Timing8–12 weeks
-
#5 MLOps Factory
Validated models, monitored in production
Model registry, independent validation, deployment and drift monitoring, aligned to the CBUAE Model Management Standards. A prompt registry and RAG evaluation cover LLM applications.
Timing8–12 weeks
-
#6 AI Training Factory
Your people learn on the factory they run
Role-based certification with hands-on labs for each learner. Tracks for Factory Operator, Recipe Author, Agent Reviewer and AI Risk Steward. Labs use synthetic data only.
TimingRuns alongside every build
The shared core
One core makes every next factory cheaper.
- Factory meta-model and recipe catalogue
- Model gateway that routes each call by data classification
- Policy-as-code, evaluation harness and audit trail
Built on open standards and open source
Domain packs
Agents work in your sector’s language: BIAN service domains and semantic APIs for banks; TM Forum ODA, eTOM, SID and TAM for telcos; GovStack building blocks for governments.
See the sector modelsInside the Governance Factory
Obligation to evidence.
Every obligation is traced to a control, and every control to evidence. Audits and regulatory reviews fail on missing evidence, not missing intent.
The Governance Factory keeps the architecture and the compliance record current as the systems change. It reads the same specifications, code and pipelines that the other factories produce. The evidence is never a separate project.
- 1
Obligation
Agents extract obligations from regulations and policies, such as CBUAE, SAMA, NCA, PDPL and ISO/IEC 42001, into one register.
→ Obligations register
- 2
Control
Each obligation maps to controls in a shared library. A named person owns each control. Policy-as-code enforces it where possible.
→ Control library
- 3
Evidence
The factories collect evidence on every change: specs, decisions, scans, tests, approvals and deployments.
→ Evidence on every change
- 4
Audit pack
The factory assembles audit and regulator packs on demand, versioned and signed. A compliance officer approves each pack before release.
evidence is produced by the work, not collected after it
→ Signed, versioned packs
What the Governance Factory produces
#2
Regulatory registers
- Obligations register and control library
- Outsourcing and subprocessor register
- Model inventory with model cards and owners
- Data protection impact assessments
#3
Audit and regulator packs
- Evidence bundle for every production release
- Control test results with dates and owners
- Regulator submission and cloud-approval packs
- Exit and continuity plans
Agents draft; people approve. The Chief Architect signs off architecture artefacts. The compliance officer signs off registers and packs.
02 · Why
Factories, not pilots.
Regulated institutions need a delivery factory, not more pilots. AI coding tools are now on almost every desk. Without a governed system around them, they move risk faster than they move value.
-
#1 Adoption
90% of surveyed technology professionals use AI at work
AI raises throughput, but it still goes with lower delivery stability. The gain depends on platforms, small batches and safety nets.
SourceGoogle Cloud DORA, State of AI-assisted Software Development, 2025
-
#2 Sovereignty
Frontier models are not in-country by default
From UAE and KSA regions, many frontier models run only through cross-region routing. Route each model call by data classification, and log each route.
SourceAWS Bedrock, Azure AI Foundry and Google Vertex AI regional documentation, 2026
-
#3 Regulation
Supervisors ask for evidence, not intent
Outsourcing rules, AI guidance and cyber controls expect data residency, human oversight and a model inventory. ISO/IEC 42001 makes the system auditable.
ReferencesCBUAE Circular 14/2021 · CBUAE AI/ML Guidance Note, 2026 · SAMA CSF 3.4.3 · NCA ECC
-
#4 Capability
An outsourced factory leaves nothing behind
When a vendor runs the factory, the know-how leaves with the contract.
SoYour team must own the recipes, the policies and the evaluation suites.
Two kinds of AI factory
One sells capacity. One builds what you own.
Compute factories
Sell capacity and tokens
- GPU infrastructure and token production
- Often one vendor’s stack
- Operated for you
- Capability stays with the provider
Factory Builder Programme
Builds delivery factories you own
- Software, governance, cloud, data, MLOps and training factories
- Vendor-neutral, on open standards
- In your tenant, in-country, with regulator-ready evidence
- Your engineers certified to run and extend it
The two work together: our delivery factories run on the AI infrastructure you choose.
The case for factories
The path to production.
Most AI projects stall on the path to production. A proof of concept is easy. Production is not. Before go-live, every project must pass three control gates: Security, Legal & Compliance, and Production Sign-Off (PSO).
Pilots arrive at these gates without the evidence they ask for, and they wait. A factory produces that evidence on every change, so the gates become checks, not walls. Governance is the seatbelt, not the brake.
#A · Pilot by pilot
The proof of concept works. Then it waits at the gates.
- 01Idea
- 02Proof of concept
- 03Security · ■ Blocked
- 04Legal & Compliance · ■ Blocked
- 05PSO · ■ Blocked
✕ Production · not reached
#B · Factory
The same gates, passed with evidence.
- 01Idea
- 02Recipe and governed build
- 03Security · ● Passed with evidence
- 04Legal & Compliance · ● Passed with evidence
- 05PSO · ● Passed with evidence
✓ Production · live, with evidence
every delivery improves the recipe for the next one
Three gates
What each gate asks for, and what the factory brings.
-
#1 Gate
Security
The gate asks forA threat model, secure code, scanned dependencies, controlled data flows and access.
The factory bringsA threat model per design, code and dependency scans, secret checks, a software bill of materials and signed builds on every change.
-
#2 Gate
Legal & Compliance
The gate asks forData residency, outsourcing rules, data protection and model risk, with proof.
The factory bringsData classification, in-country model routing, control mapping to CBUAE, SAMA, NCA and PDPL, and a model inventory with owners.
-
#3 Gate
Production Sign-Off (PSO)
The gate asks forOperational readiness: runbooks, monitoring, rollback and an approved change.
The factory bringsRunbooks, service levels and alerts, a tested rollback plan and a complete change record, produced with the release.
The numbers
Pilots stall. Partners help.
Pilots
95%of generative AI pilots show little or no measurable P&L impact
Proofs of concept
30%of generative AI projects forecast to be abandoned after proof of concept by the end of 2025
Source: Gartner prediction, 2024
Partnering
3×Working with a specialist partner succeeds about three times as often as building alone
| Why pilots stall | What the factory does |
|---|---|
| Weak data quality | Data contracts, quality rules and classification are part of every recipe. |
| Insufficient risk controls | Policy-as-code, four human approval gates and evidence on every change. |
| Rising costs | One shared core and reusable recipes. We measure the cost per change, and it falls over time. |
| Unclear business value | A delivery and cost baseline before the build. We measure value against it. |
| Tools that never learn the workflow | Workflow-first design from your SOPs. Recipes improve with every delivery. |
Causes: Gartner (2024) and MIT NANDA (2025). DORA 2025 adds that 90% of organisations already run an internal platform, and that high-quality platforms are what let AI benefits scale. A factory builds on that platform.
03 · How
Five phases. Three gates.
Five phases, three decision gates, one owner at the end. You buy one phase at a time. Each phase ends at a gate where you decide whether to continue. At every gate, you keep everything delivered so far.
- S0
Executive briefing
Half day
A briefing for your ExCo on AI factories and regulation, with a live factory demo.
→ Decision: assess, or not
- S1
Readiness assessment
3–4 weeks
We score maturity on eight dimensions, take your DORA baseline and map your SOPs and value chain.
G-A · Go to design
Sponsor, pilot team and budget named - S2
Factory design
4–6 weeks
ArchiMate target architecture, factory definition, policy pack, operating model and business case.
G-B · Go to build
Design and data flows approved - S3
Build the Software Factory
16 weeks
We co-build the AI Software Factory in your tenant. A pilot team delivers real work on it.
your team runs it from here
G-C · Go to scale
Pilot targets met, staff certified - S4
Scale to factories 2–6
8–12 weeks each
Governance, Cloud IaC, Data Platform, MLOps and Training factories. Our share of the work falls with each one.
→ One factory at a time
Around the build
Certify the people. Keep the factory current.
S5 · Alongside, from S3
Factory Academy certifies the people who run it
Five tracks. Labs run on a separate, low-cost environment with synthetic data only.
- Factory Executive
- Factory Operator
- Recipe Author
- Agent Reviewer
- AI Risk Steward
S6 · After, annual
Factory Care keeps the factory current
Three tiers: Essential, Professional, Sovereign.
- Recipe and policy updates arrive as pull requests
- Quarterly health reviews
- Regulatory watch
- A bank of advisory hours
Three ways to work with us
Pick our share of the build. It falls over time.
Advise
Your team builds; we design and assure
For institutions with a strong platform team. We lead the design and the gate reviews.
- Our share of the build: about 20%
Co-build · Default
One joint team, with paired engineers
Our engineers pair with yours. By week 10 of the build, your engineers make half of the factory commits.
- Our share: about 50%, falling to 20%
Accelerate
We stand up the Builder kit fast
For thin teams or urgent mandates. We deploy the licensed kit; your team trains alongside us.
- Our share: about 70%, falling to 30%
Principles we hold
Five rules for every factory.
01Workflow-first, from your SOPs
BPMN for processes, DMN for human decisions, CMMN for exception cases.
02Sovereign by default
Your tenant, in-country, with classification-aware model routing.
03Specs and evidence are the product
Every change leaves a specification, a decision record and test evidence.
04Open standards
No single model or cloud is load-bearing.
05Capability over dependency
Every phase has a transfer target, and we measure it.
04 · Sectors
Sector models.
Each sector starts from its own reference model. We do not invent a domain model. Banks start from BIAN, telcos from TM Forum ODA, and governments from GovStack. Agents and recipes speak that language from day one.
#1 Banking · BIAN
For banks, we start from BIAN
The Banking Industry Architecture Network (BIAN) is our reference model for banks. It divides banking into standard service domains, each with a defined purpose, semantic APIs and business objects. Agents use it to name, scope and connect every service they build.
- Step 1
- Map requirements to service domains. We place each requirement in the BIAN Service Landscape, by business area, business domain and service domain, so the scope is clear before the build.
- Step 2
- Domains become bounded contexts. Each service domain becomes a bounded context. Its semantic APIs and business objects are the contract between services.
- Step 3
- Conformance in the pipeline. Recipes scaffold services from BIAN API definitions, and the pipeline checks every API against them. We record each deviation as a decision.
- Step 4
- Regulation on each domain. We overlay CBUAE and SAMA controls on each service domain: data residency, outsourcing and model risk.
- Elements we use
- Build unit
- Service Domains: the unit agents build and test against.
- Example service domains
- Payment Execution · Current Account · Customer Agreement · Party Reference Data Directory · Consumer Loan
- Source
- BIAN Service Landscape, accessed October 2026. We apply BIAN’s published standard; BIAN is an independent industry association.
#2 Telco · TM Forum ODA
For telcos, we build on TM Forum ODA
TM Forum’s Open Digital Architecture (ODA) is our reference model for telcos. It replaces monolithic BSS and OSS with standard ODA Components that expose TM Forum Open APIs and run on the ODA Canvas. Frameworx stays the shared language for processes, data and applications.
- Step 1
- Map to processes and data. We map each requirement to eTOM processes and SID information entities, and place it in the application map with TAM.
- Step 2
- Components become recipes. Each ODA Component becomes a factory recipe: TM Forum Open APIs, SID-aligned data and a deployment for the ODA Canvas.
- Step 3
- Conformance in the pipeline. Open API conformance tests run in the pipeline for every component before it is released.
- Step 4
- AI-native ODA, local rules on top. We follow TM Forum’s AI-native ODA direction, where components expose MCP interfaces to agents, and add UAE TDRA and KSA CST requirements.
- Elements we use
- Build unit
- ODA Components: the unit agents build, deploy and certify.
- Frameworx
- Kept as the shared language: eTOM for business processes · SID for information and data · TAM for applications
- Source
- TM Forum Open Digital Architecture, accessed October 2026. We apply TM Forum’s published standards; TM Forum is an independent industry association.
#3 Government · GovStack
For governments, our method builds on GovStack
GovStack defines reusable building blocks for digital public services: autonomous software modules that expose REST APIs, are standards-based, preferably open source, and designed for scale. Its specifications inspire our government method and form the domain pack for government factories.
- Step 1
- Start from the public service. We map each citizen or business service to the building blocks it needs, with GovStack service patterns and use-case examples.
- Step 2
- Specifications become recipes. Each building block specification becomes a factory recipe and a conformance test. Agents build to the spec, and the pipeline checks every API against it.
- Step 3
- Requirements become gates. GovStack cross-functional requirements for development, deployment, architecture, quality, security and data run as policy-as-code gates.
- Step 4
- Local rules on top. We add the national layer: UAE TDRA and KSA NCA controls, NDMO data classification, and in-country hosting.
- Building blocks
- Information Mediator
- Secure data exchange between agencies.
- Principles we apply
- Openness · modularity · interoperability · sustainability · security · data ownership · user-centred design · API-first access · reusability
- Source
- GovStack specifications, accessed October 2026. GovStack is an independent initiative; we apply its open specifications.
05 · Outcomes
What the build commits to.
The 16-week build commits to these default targets for the pilot team. We set the final targets during design, from your own baseline.
Speed
−20%Lead time for changes, with change-failure rate no worse
Quality
60%Agent pull requests accepted by human reviewers
Ownership
50%Factory commits made by your engineers by week 10
Sovereignty
0Confidential data sent on offshore model routes
Evidence
100%Production changes with complete evidence
Source: programme targets, not reported results.
-
What you keep
Everything we build in your tenant is yours.
The core Builder kit is licensed to you for internal use. Without a subscription, the factory keeps running; only updates stop.
-
How we stay out of your data
Your staff operate the factory.
We need no standing access to production or customer data. Your compliance team can classify the work correctly from the start.
One practice, three ways in
We advise. We train. We build.
- #1 · Majlis AdvisoryWe adviseDecide fast, with one owner and a control your regulator can test.See the advisory
- #2 · Majlis AcademyWe trainShort, always-current programmes on a solid core. Your people run the method themselves.See the courses
- #3 · You are hereWe buildAI factories, built with your engineers in your own tenant.See the factories
We advise, we train and we build with you.
Governance is the seatbelt, not the brake. Agree the controls once. Then ship at full speed.
06 · Start
Start with a half-day executive briefing.
We bring a factory thesis for your institution, the regulatory picture for the UAE and KSA, and a live factory demo. You leave with one decision: assess, or not.