01 Purpose and guiding commitment
Awaley Technologies Ltd ("Awaley", "we" or "our") provides cybersecurity, digital resilience and artificial intelligence governance services, and develops AI-enabled demonstrations and solutions for organisations operating in regulated and business-critical environments.
Our guiding principle is simple: AI acts. Humans remain in control. AI may assist, recommend and carry out authorised tasks within defined boundaries, but responsibility for consequential decisions remains with the relevant people and organisations. Human approval is applied where the risk, business rules or applicable law require it; routine, low-risk actions do not necessarily require individual approval.
This Policy sets out the principles governing Awaley-controlled AI development, demonstrations and deployments. In client environments, applicable law, contractual responsibilities and approved client policies also govern how each system operates.
02 Scope and product transparency
This Policy covers relevant AI features and activities across our website, demonstrations, technical research, product development and contracted client projects. It includes, where relevant, AI Control, the BANKIA, ASSURIA, TELIA and CIVIA agent families, REGULEX, the AI Regulatory Matrix and the AKILI learning experience.
An identified use case is not automatically a developed product. Awaley distinguishes concepts and identified use cases from demonstrators, pilots and production deployments. Public demonstrations may illustrate synthetic scenarios and example control decisions; they are not presented as connected to a customer production environment unless that connection is expressly established and authorised.
03 Accountability and responsibilities
Each client AI initiative requires clear accountability for its purpose, business outcomes, data, technical operation and residual risks. Responsibilities are assigned between Awaley, the client, technical suppliers and authorised human approvers through the applicable project documentation.
- Business sponsors remain accountable for the intended use, acceptable outcomes and business decisions.
- Technical owners are responsible for implementation, testing, operational support and remediation within their agreed scope.
- Authorised human reviewers decide or confirm actions designated for human approval and must have sufficient context to make a meaningful decision.
- Where personal data is involved, controller and processor responsibilities follow the applicable legislation and contractual arrangements.
No AI product transfers a regulated organisation’s legal or board-level responsibility to a software agent or its provider.
04 Use-case assessment and risk classification
Before moving an AI use case towards a client pilot or production deployment, we assess its stated purpose, expected business value, data sensitivity, intended users, model and tools, delegated autonomy, affected individuals, security exposure and regulatory context.
Enhanced scrutiny applies to use cases involving fraud intervention, AML and KYC, lending, insurance decisions, public services, sensitive personal information, transfers of regulated data or changes to critical infrastructure. Depending on the activity and applicable law, the assessment may require a privacy impact assessment, a security review, bias and reliability testing, additional approvals or restrictions on automation.
05 Lawful data use and confidentiality
AI-related data is handled according to its purpose and sensitivity. Personal data, confidential client material, financial records, government information and other protected data must not be treated as public training material.
- Use data for defined and authorised purposes, with appropriate legal grounds where personal data is processed.
- Limit access and collection to information reasonably needed for the task.
- Separate, where appropriate, development, testing and production data and environments.
- Apply safeguards appropriate to sensitivity, such as access restrictions, masking, de-identification or client-controlled infrastructure.
- Set retention and deletion requirements for inputs, outputs, prompts, logs and derived information according to the service and applicable obligations.
Awaley does not authorise the use of client confidential data to train general-purpose AI models without the client’s express documented authorisation and a valid legal basis where required. The specific data-use arrangements with third-party model providers are governed by the selected service, configuration and contract.
06 The Awaley AI Lifecycle
Our governance approach spans eight connected activities. Data protection, security, human accountability and proportionate evidence creation apply across the lifecycle rather than at one isolated stage.
- Discovery: identify, prioritise and assess use cases and data requirements.
- Build: design and develop AI solutions with defined purposes, dependencies and safeguards.
- Deploy: test, approve and introduce solutions into the appropriate environment.
- AI Control: define policy-based permissions, thresholds and human approval requirements.
- AI Security: assess agent-specific risks, attacks, dependencies and protective measures.
- Proof: retain relevant decisions, test results and other evidence appropriate to the system.
- Board Report: communicate material outcomes, incidents, exceptions and residual risks.
- Govern: reassess the system, its business value, obligations and risks as conditions change.
07 AI Control and meaningful human oversight
AI Control is the governance model through which an agent action can be allowed, held for human approval or denied according to defined policies. The exact technical enforcement depends on the solution and customer environment.
- ALLOW: a requested action meets its permissions, operating conditions and applicable risk thresholds.
- HUMAN APPROVAL: the action requires a decision by an authorised person before execution.
- DENY: the action is outside permitted scope or breaches an applicable policy or restriction.
Higher-impact deployments are designed with appropriate escalation, suspension, revocation and safe-stop arrangements. An approval step should record enough information to identify what was requested, which policy applied and who was authorised to decide, where those capabilities form part of the implementation.
08 AI security and resilience
Our security approach addresses risks particular to AI systems and agents, including prompt injection, indirect instructions in retrieved content, data disclosure, excessive permissions, unintended tool execution, model and connector vulnerabilities, unsafe outputs and misuse of integrations.
Depending on the deployment, safeguards may include least-privilege access, separation of agent reasoning from tool permissions, input and output validation, controlled integrations, secrets management, monitoring, abuse testing, response procedures and the ability to suspend a harmful action or agent.
No security measure can guarantee that all prompt injections, model errors or AI-related attacks will be detected or prevented. Technical claims about protections are made in relation to the controls deployed and tested for the relevant service.
09 Testing, deployment and change management
Before a client go-live, deployment readiness is assessed against the intended use and agreed risk profile. Evaluation may include functional performance, reliability, misuse scenarios, privacy, security, integration, operational continuity, human training and the ability to roll back or stop the service.
Material changes to models, prompts, tools, permissions, data sources or operating context may require further testing, approval or revised controls. A successful demonstration is not, by itself, evidence of production readiness.
10 Third-party AI services and international data flows
Cloud providers, model services and specialist technology partners are assessed as appropriate to the data, role and service. Relevant considerations include confidentiality, permitted data use, retention, international transfers, infrastructure location, subcontractors, access arrangements, supplier security and contract terms.
For regulated client workloads, applicable data residency, outsourcing, professional secrecy and cross-border transfer obligations are assessed by jurisdiction and sector. Use of a particular cloud platform or startup credit does not automatically establish suitability for restricted or regulated information.
11 Fairness, transparency and affected individuals
Awaley supports use-case-appropriate checks for reliability, bias, misleading outputs, explainability and potential harm. People using an AI-assisted service should not be deliberately misled into believing that an AI agent is a human where this would be material to their interaction.
Where AI may affect an individual’s financial situation, eligibility, employment, access to services or other significant interests, the client and Awaley establish any safeguards and rights-handling arrangements required by the laws and contracts that apply. AI-generated recommendations should be independently assessed when the impact warrants human judgement.
12 Evidence, assurance and reporting
Relevant project records can include a use-case description, data inventory, risk assessment, control mapping, approvals, evaluation results, change history, security findings, incident information and operational evidence. The evidence selected for clients, boards, auditors or regulators is proportionate to the purpose and subject to confidentiality restrictions.
A timestamped event log is not automatically a cryptographically signed, tamper-evident or independently replayable audit record. Awaley describes such features as implemented only when the relevant solution provides and supports them. Evidence availability does not by itself guarantee certification, legal compliance or approval by a supervisory authority.
13 Security incidents, misuse and complaints
Suspected AI misuse, unauthorised actions, data disclosure, significant errors and failures of defined controls should be reported promptly through the project’s operational or security contact. Each report is assessed and escalated according to its seriousness, applicable contractual commitments and legal duties.
Privacy incidents are also handled under the applicable Privacy & Data Protection Policy and the relevant legal and contractual notification arrangements.
14 Sector-specific and jurisdictional requirements
Awaley operates from the Dubai International Financial Centre and supports organisations across the Gulf and Africa. The DIFC Data Protection Law No. 5 of 2020, as amended, and the DIFC Data Protection Regulations, including Regulation 10 where personal data is processed through autonomous or semi-autonomous systems within its scope, are key references for relevant DIFC activities.
Separate laws and regulator requirements may apply to onshore UAE activities, ADGM, Saudi Arabia and other GCC jurisdictions. In West Africa, relevant requirements include national data protection laws, such as Côte d’Ivoire Law No. 2013-450, and applicable sector rules, alongside regional instruments such as the ECOWAS Supplementary Act on Personal Data Protection.
Awaley does not assume that a single control, certification, legal basis or international data transfer permission satisfies every regulator. Obligations and supporting evidence are assessed in the context of each entity, activity and applicable jurisdiction.
15 Learning experiences and minors
Public AI and cyber-awareness demonstrations are educational or illustrative, unless otherwise expressly stated. Where AKILI or another learning experience is intended for young participants, age-appropriate design, suitable content, privacy notices and any legally required parental or guardian authorisation apply.
Visitors should not submit live customer data, passwords, confidential documents or sensitive personal data through public demonstration interfaces.
16 Contact and policy updates
Awaley reviews this Policy when material developments in law, technology, business activities or services make an update appropriate. The current version is published on our website with its effective date.
Questions about AI data governance, personal data handling or the exercise of data protection rights may be sent to privacy@awaleytech.com.