Majlis Advisory · Regulated AI
We help banks, telcos, governments and other institutions in highly regulated industries across the GCC move AI from proof of concept to production. Each decision gets one owner. Each control becomes a test the regulator can run. The architecture takes the shape of your industry.
control: GOV-007
obligation: Human review of every
adverse credit decision
owner: Head of Retail Credit Risk
applies_to: agent/onboarding-assistant
rule: route_to_human if decline
evidence: tests/gov_007.feature
one gate for every model and agent
We draw in
Same request. One programme stalls; one ships.
The request
“Put an AI agent in front of retail customers by Q2.”
Chief Digital Officer, regulated bank · illustrative
AI as a project
Red · Stalled
AI as an operating model
Green · In production
Illustrative timeline. The weeks are examples, not a commitment.
Four services. Each one leaves you with work you keep.
Strategy · Wardley
We map your AI value chain, show which parts are already commodity, and set a roadmap your board can fund.
You keepWardley maps · build-or-buy research · roadmap
Operating model
Workflow-first design from your own SOPs, with Team Topologies, decision rights and human-in-the-loop rules in DMN.
| ID | Decision | Owner |
|---|---|---|
| D-01 | Model selection | CTO |
| D-02 | Human-review threshold | Head of Risk |
| D-03 | Release to customers | Product owner |
| D-04 | Retire a model | Model risk |
You keepTeam design · decision register · activation roadmap
Architecture
Target architecture on BIAN, TM Forum ODA or TOGAF, modelled in ArchiMate, with each decision recorded.
You keepArchiMate views · ADRs · reference-model maps
Governance-as-code
We turn CBUAE, TDRA, PDPL or EU AI Act obligations into owned, testable rules in Git, with a release gate for every model and agent.
$ make governance-check
✓ GOV-001 data lineage recorded
✓ GOV-004 model card is current
✓ GOV-007 human review on declines
✓ owner sign-off Head of Retail Credit Risk
→ release gate: PASS
You keepGovernance pack · traceability matrix · autonomy tiers
The drawings in the cards are illustrative examples.
The sector models give you the shape. AI is the open gap. We fill it.
BIAN, TM Forum ODA and GovStack describe how a bank, an operator and a government service work. None of them yet gives a full answer for how an AI agent is owned, tested and released inside that shape. We keep one method across the three sectors, draw your target state in your sector's own model, and add the AI layer with controls your regulator can test.
Cross-sector method
Sector reference model
The open gap
the sector models give the shape. AI is the gap we fill
How you get it
Banking
Telco
Government
Sources: GovStack 2.0.0 core specifications (March 2026); GovSpecs 2.0 strategy for 2025–2027.
Our angle
Every sector model is still learning AI. That is where we start.
One method across banking, telco and government. Your target state drawn in your sector's own model. An AI layer your board, your regulator and the people you serve can trust.
Five steps. At the end, your teams run the method.
Sit with the people who own the decision. Write down the real question.
→ stakeholder map
→ the decision question
Map the obligations, the current state and the value chain.
→ obligations map
→ Wardley map
Compare the options. Record the decision, its owner and its evidence.
→ ADRs
→ decision register
Pair with your teams on the first governed release.
→ ArchiMate views
→ governance pack
Your teams run the method. The Academy closes the gaps.
→ runbooks in ASD-STE100
→ activation roadmap
From isolated proofs of concept to one enterprise AI system.
We use Open Agile Architecture™, a standard of The Open Group. It joins intentional architecture, which sets the guardrails, with emergent design, which keeps the teams fast.
Pace-layered governance
Full lineage. Regulatory reporting models, PII filters.
Reviews and automated evaluations. RAG over internal knowledge, workflow agents.
Guardrails and maximum autonomy. Sandboxes and prototypes.
Governance intensity, illustrative. Pace layers after Gartner’s Pace-Layered Application Strategy.
A · Strategy and operating model
Map AI use cases to value streams. Shape AI product teams with the Inverse Conway Maneuver.
B · AI architectural runway
Vector stores, model registries, CI/CD for ML and observability. ADRs set the line between standards and freedom.
C · Pace-layered governance
Strict where the system is critical. Light where the work is an experiment.
D · Continuous refactoring
Production telemetry feeds the architecture backlog. Red-teaming becomes a sprint-level quality criterion.
Start with the one decision that blocks you.
One decision blocks a programme
A recommendation and a decision record, defended to your board.
You start or reset AI
The operating model, the target architecture and the roadmap.
You run AI in production
A seat on your architecture board and a review of each release.
Each leader at the table gets an answer to their own question.
CIO · CTO
Today: AI work splits into silos or stalls at a rigid architecture board.
CAIO · CDO
Today: proofs of concept fail on the way to production.
Product · Business
Today: AI takes months and misses the business metric.
CISO
Today: shadow AI and unvetted APIs leak IP and data.
Sit, listen, then decide.
Our leadership style
Inspired by the majlis: we sit together, we listen to every voice, then we decide.
Contact