Resource / Whitepaper
AIIX Reference Architecture.
Full architectural overview, deployment patterns, governance models. PDF · 38 pages.
Q2 2026Get the doc →
Advise
Governance your auditors accept.
Tiers, gates, packs, and disclosure — built into the system from the first design decision, every control traceable and evidenced, ready for audit.
What it isAn engagement that makes AI governance designed-in and citable — not a binder assembled the week before audit.
01
The problem.
Retrofit
Governance bolted on late
Controls added after the build are the ones that fail audit. Governance has to be a design input, not a remediation.
Assertion
“Trust us” compliance
Claims without citations don’t survive a regulator. Every control needs a clause, a permalink, and evidence.
Blind spots
Audit once a year
Twelve-month findings miss the drift that happened in month two. Conformance has to be continuous.
02
How it works.
Every agent gets an envelope.
Risk tiers (RT0–RT4) and autonomy levels (A0–A4) bind what each system may do — higher stakes, tighter leash, enforced before it acts.
- A registry identity for every production agent
- Risk tier and autonomy level, enforced at runtime
- One kill-switch over the whole fleet
No claim passes without evidence.
Gates G0–G5 with entry/exit criteria bound to roles, every control pointing at a numbered clause with a stable permalink.
- G0–G5 gates with evidence bound to owners
- Controls cited to the Normative Register
- A tamper-evident, offline-verifiable ledger
Conformance, computed live.
A live Conformance Score from the work itself — drift is an alert, not an annual finding. Mode A runtime attestation, or the honest annual bridge.
- Live Conformance Score with a full lifecycle: Green · Watch · At-Risk · Suspended · Withdrawn
- Drift surfaced as an alert, not a surprise
- Incident register designed in — computed impact and risk, corrective actions carried into each review
- An ISO/IEC 42001 exceedance crosswalk, published
Every major framework. One governed spine.
AIIX-SPEC 5.5.1:2026 maps to the regulatory frameworks your jurisdictions require — OECD AI Principles, EU AI Act, UAE AI Strategy, Saudi Vision 2030, and the GCC data-residency mandates.
- OECD AI Principles: all seven mapped by clause
- EU AI Act: risk classification to RT tiers, bilingual disclosure ready
- UAE AI Strategy + PDPL, Saudi Vision 2030 / NDMO: jurisdiction packs compiled
- Vendor AI conformance: V0–V3 vendor schema, buyer-facing trust pack (Doc 6)
03
What you get.
Risk & autonomy model
RT0–RT4 and A0–A4 mapped to your estate.
Gate catalog
G0–G5 entry/exit criteria bound to roles.
Jurisdiction packs
Residency, transfer rules, breach clocks as data — 20 industry profiles.
Disclosure pack
Bilingual model cards, evaluation records, decision ledgers.
Incident response pack
P0–P5 severity classification, breach notification clocks, containment playbooks.
Vendor conformance framework
V0–V3 vendor AI schema + a buyer-facing trust pack, fully evidenced.
04
Lanes, claims & the living certificate — v5.5.1.
Four governance lanes
Foundation, Foundation Public, Standard and Extended Assurance — the depth of appraisal scales to your scope and the public claim you make, while the caps, floors and evidence rules never bend.
Three public claim states
Foundation Verified, Active and Optimised — what you may say in public is a normative state, verifiable at binnovy.com/aiix/verify, with a full lifecycle: Green, Watch, At-Risk, Suspended, Withdrawn.
The 90-day conditional path
A bounded, named gap need not block an otherwise-ready organisation: the certificate issues with a public Conditions-Open qualifier, due within 90 days — overdue moves At-Risk, unresolved Suspended.
A living certificate
Between appraisals a heartbeat keeps it honest — quarterly for Foundation Public and Standard, monthly for Extended Assurance and Optimised — and the incident register carries open items into each review until closure evidence is accepted.
Independent appraisal with separation of duties — the assessor is never the delivery team.
Cited, not asserted
”Every control we ship points at a numbered clause with a stable permalink. Governance you can cite is governance you can verify — even offline.”
5.5.1
the standard
05
Objections, handled.
Yes. The evidence ledger is hash-chained and signed at write — independently verifiable offline, including in air-gapped attestation.
You do. You own the data and the keys; we operate the governed spine on the cloud you choose.
We publish an ISO/IEC 42001 exceedance crosswalk. ISO proves you have a management system; Binnovy proves your intelligence runs — continuously, on your soil.
It can be (Mode B, the honest annual bridge) — but Mode A computes conformance continuously from the work itself, so drift is an alert, not a finding twelve months late.
AIIX-SPEC 5.5.1:2026 is cross-walked to OECD AI Principles (all seven), EU AI Act (risk tiers → RT tiers), UAE AI Strategy and PDPL, Saudi Vision 2030 / NDMO requirements, and GCC data-residency mandates. Each jurisdiction pack compiles the strictest applicable rule into the engagement.
We ship a Vendor AI Conformance framework (V0–V3 schema) — rating vendors from V0 (no governance claim) through V3 (independently verified, framework-aligned). Buyers receive a trust pack citable by clause.
Yes — bilingual (EN/AR) disclosure is a standard deliverable. Disclosure is per-model-card and per-decision-class, generated from your governed registry entries.
06
Pairs with.
Plan it
Scope your engagement in 30 seconds.
Tell us your estate and we’ll suggest the track, the cadence, and where designed-in governance starts.
Your scale
Where it runs
What matters most
Recommended track
Standard
90-day governed value cycles
We’d run AI Governance on the Standard track, deployed to managed / sovereign cloud, optimised for audit-ready governance from day one.
Make every control traceable.
Tell us your estate and jurisdiction. We’ll come back with a scoped governance review and a path to designed-in compliance.
- Scoped proposal — what we’d do, in what sequence, against which gates.
- Working session — 60 minutes with a senior architect on one real decision.
- Procurement & security pack for legal and risk review. Request the pack →
Let’s scope it.
Thanks — a senior architect will come back within one business day. Want it in motion now?
Send via email