regulation10.com

Trust and evidence

Proof, not promises

Everything on this page is verifiable. We list what we can substantiate today, and we date the facts we cite. We do not publish customer names, testimonials, metrics, or analyst placements that we do not hold.

Exec X AI Ltd operates this service under DIFC commercial licence 10474. You can search that licence on the DIFC public register. Khaled Shivji, Autonomous Systems Officer, writes what appears here and signs it

This is a new company and it has no published references. So nothing on this page asks you to take our word for anything. Each item below names a source, a date, or a mechanism you can check yourself

Registered DIFC entity

Exec X AI Ltd operates the platform under DIFC commercial licence number 10474. The entity is listed on the DIFC public register, which anyone can search to confirm the licence.

Verify: DIFC Public Register, licence 10474 (as of 2026-08-30)

Built to the EU AI Act operator obligations

regulation10.com implements the operator-facing obligations of the EU AI Act (Regulation (EU) 2024/1689): risk classification, prohibited-practice screening, impact assessment, transparency notices, and record keeping. The controls mapping is maintained in the product and available for review under NDA.

Verify: Regulation (EU) 2024/1689 (EU AI Act) (as of 2026-08-30)

ISO/IEC 42001 crosswalk (readiness, not certification)

The platform's AI management-system controls are mapped to ISO/IEC 42001:2023. This is a documented crosswalk and internal readiness assessment; it is not a certification, and no certification is claimed. The crosswalk is available for review under NDA.

Verify: ISO/IEC 42001:2023 (AI management systems) (as of 2026-08-30)

Tamper-evident, evidence-grade audit trail

Every regulated action is written to a hash-chained audit log with per-tenant chain heads and independently stored, signed checkpoints, so a later edit or truncation is detectable. The public assessment sandbox already produces an evidence register with a SHA-256 proof-of-record for each artefact it generates.

Verify: In-platform: audit-room evidence register and audit checkpoints (as of 2026-08-30)

How we stop our own claims drifting

Every external claim we make is registered with the surfaces it appears on and a probe that reads the running code. A probe that cannot establish a claim returns unknown, never true. A claim a probe refutes comes off the site. The registry is printed in full further down this page, with the verdict each probe returned on this request

Verify: On this page: the claims registry, generated from the registry module (as of 2026-08-30)

Governed AI, transparently disclosed

Every AI model call the platform makes runs through a guarded provider with guardrails, a canary check, and tenant-attributed audit rows. Each registered system gets a plain-language transparency notice generated by the deterministic engines. The AI-governance policy is published to customers.

Verify: In-platform: policy coverage, transparency notices, guarded model provider (as of 2026-08-30)

Customer references

We do not have published, named customer references yet. When a customer agrees to be named, their case study will appear here with their own consent. Until then we will not invent one, and we will not present a pilot or a pseudonymous logo as a reference.

If you would like to speak with the team about a reference call or a proof of concept, start with an assessment and we will follow up.

Residency, sub-processors and security

These are the answers to the three questions every buyer asks first. Each value is resolved from this deployment’s own configuration and from the published legal register, so what you read here is what this service actually does.

Data residency

Tenant data is resident at rest in the Azure Sweden Central region, inside the EU data boundary. AI inference runs on Azure OpenAI deployments provisioned in Sweden Central on the Data Zone Standard deployment type, which Microsoft documents as processing prompts and responses only within its EU data zone. That data zone follows the Azure EU data boundary and can include European Free Trade Association countries in addition to EU member states, so it is a zone rather than a single region, and we do not represent inference as executing in one region.

Tenant data at rest
Sweden Central (EU data boundary)
Azure region identifier
swedencentral
Transfer safeguard
EU standard contractual clauses (Article 46)
Transfer regime
Chapter V of the GDPR, Articles 44 to 49

Verify: Residency and international transfers

Sub-processors

Every sub-processor below is bound by a written agreement no less protective than our data processing addendum (Article 28 of the GDPR). The register is a disclosure of actual data flows: a vendor we do not send data to is not listed, and a new flow is published before it starts. Object to a change at privacy@regulation10.com.

Microsoft Azure
Hosting, compute, Cosmos DB, WORM blob storage, AI inference (Azure OpenAI), and the self-hosted site analytics we run ourselves
Stripe
Subscription billing and payment processing
Resend
Transactional and notification email delivery
Vercel
Marketing-site hosting and CDN

Transactional email on this deployment is delivered through Azure Communication Services Email, which falls under the Microsoft Azure entry above and adds no further third party.

Verify: The full sub-processor register

Security

We apply technical and organisational measures appropriate to the risk under Article 32 of the GDPR: encryption in transit and at rest, role-based access control, multi-factor authentication, and a sealed, tamper-evident audit trail.

Security duty
Article 32 of the GDPR
Breach notification
We notify you of a personal-data breach without undue delay and support your notification duties to your supervisory authority and to affected data subjects under Articles 33 and 34 of the GDPR.
Tenant data residency
Sweden Central (EU data boundary)
Certification
None claimed. The ISO/IEC 42001 mapping above is a documented crosswalk and internal readiness assessment, not a certification.

Verify: Security and your rights in the privacy policy

How we stop our own claims drifting

This page checked 25 claims when you loaded it. 3 came back true, 5 came back false, and 17 came back unknown. Every external claim we make is registered with the surfaces it appears on and a probe that reads the running code

A probe that cannot establish a claim returns unknown, never true. Some probes read a verification artefact in the repository, and this service does not install that reader. Those claims report unknown to you, which is the rule working rather than failing

This is what stops our marketing drifting away from our code. When a probe turns a claim false, the sentence comes off the site rather than being softened

true
The probe found the capability present
false
The probe found it absent. The sentence must not appear on any surface while this holds
unknown
The probe could not establish it. Unverified is never upgraded to true

  • Residency data at rest uae north

    False

    Statement under probe, not currently published: Customer evidence and artefacts are held at rest in the UAE, in Microsoft Azure UAE North.

    Probe: Environment posture. The probe reads the configuration that selects this deployment's posture. It proves the configuration, not the fact

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.1, apps/marketing/app/(marketing)/security/page.tsx, apps/web/lib/support-kb-content.ts

  • Residency inference may leave region

    Unknown

    Statement under probe, not currently published: Model inference may be processed in any Azure region, so no claim of in-country inference is made on the .ae service.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.2, apps/marketing/app/(marketing)/security/page.tsx, apps/marketing/app/(marketing)/legal/subprocessors/page.tsx

  • Residency secondary copy sweden central

    Unknown

    Statement under probe, not currently published: A secondary copy of tenant evidence is held in Sweden Central for resilience.

    Probe: Environment posture. The probe reads the configuration that selects this deployment's posture. It proves the configuration, not the fact

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md (withdrawn from §1.6, §6.1 and diagram D5)

  • Worm storage policy locked

    False

    Statement under probe, not currently published: Sealed records cannot be altered or deleted by anyone, including us.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.3, apps/marketing/app/(marketing)/legal/dpa/page.tsx, apps/marketing/lib/glossary.ts, apps/web/app/audit-room

  • Sealed tamper evident

    True

    Claim: Artefacts are sealed and tamper-evident: create-only writes that reject overwrite, a SHA-256 hash recorded on the document and printed in its footer, and an append-only hash-chained ledger.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.3, apps/marketing/app/(marketing)/transparency/page.tsx, apps/web/components/worm-retention-diagram.tsx

  • Artefact arabic

    False

    Statement under probe, not currently published: Regulation 10 artefacts are available in Arabic.

    Probe: Environment posture. The probe reads the configuration that selects this deployment's posture. It proves the configuration, not the fact

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.4, apps/web/lib/support-kb-content.ts, apps/marketing/app/(marketing)/platform/page.tsx

  • Acb read only transfer

    Unknown

    Statement under probe, not currently published: A completed evidence set can be transmitted to an Accredited Certification Body without that body receiving any write access.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §1.7 and §6.5, apps/web/lib/support-kb-content.ts

  • No automatic submission

    Unknown

    Statement under probe, not currently published: The platform will not submit, file or transmit anything automatically; transmission requires an explicit user action.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.6, apps/marketing/app/(marketing)/platform/page.tsx, apps/web/lib/support-kb-content.ts

  • Export open formats

    Unknown

    Statement under probe, not currently published: Exports are produced in open, machine-readable formats and are independently verifiable by a third party.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.5 and §7, apps/marketing/app/(marketing)/platform/page.tsx

  • Entra auth live

    False

    Statement under probe, not currently published: Enterprise sign-in through Microsoft Entra is live on the production service.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: apps/marketing/app/(marketing)/security/page.tsx, apps/web/lib/support-kb-content.ts

  • Corpus primary sourced

    True

    Claim: Regulatory guidance is grounded in DIFC primary sources with traceable citations, and is versioned so downstream artefacts are flagged when the source changes.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §3, apps/marketing/app/(marketing)/transparency/page.tsx

  • Reg10 enacted 2023

    Unknown

    Statement under probe, not currently published: Regulation 10 of the DIFC Data Protection Regulations was enacted in September 2023 and has been in force since 1 September 2023.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §2, packages/corpus/src/difc.json

  • Self application

    False

    Statement under probe, not currently published: Exec X AI Ltd holds its own Regulation 10 evidence in the platform and can produce its own register entry and transparency notice on request.

    Probe: Environment posture. The probe reads the configuration that selects this deployment's posture. It proves the configuration, not the fact

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §7

  • External facts verified

    Unknown

    Statement under probe, not currently published: The external regulatory facts asserted in the Commissioner brief (enforcement commencement, Schedule 2 fines, Regulation 11 status, the addressee) are verified against a primary source.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §2, §5, §8 and the cover block

  • Ledger tip witnessed

    Unknown

    Statement under probe, not currently published: The record is entered into an append-only hash-chained ledger, and the ledger tip is periodically signed and witnessed by a separate process.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.3

  • No edit or delete path

    Unknown

    Statement under probe, not currently published: The interface offers no path to edit, delete or backdate a sealed record.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.3, apps/web/app/audit-room

  • Human signoff before seal

    Unknown

    Statement under probe, not currently published: No artefact reaches a sealed state without a named human approving it.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.6

  • Runtime gateway enforcement

    Unknown

    Statement under probe, not currently published: The runtime gateway applies the firm's own policy to each call: allow, block, redact, or route to a human. Each decision is recorded.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §3

  • Model routing disclosed per call

    Unknown

    Statement under probe, not currently published: Model inference routing is disclosed to the customer, is recorded per call in the gateway decision record, and is configurable.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.2, docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md diagram briefs

  • Classification derived not asserted

    Unknown

    Statement under probe, not currently published: The classification is not asserted; it is derived, and the derivation shows which trigger fired and against which provision.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §3

  • Difc market statistics

    Unknown

    Statement under probe, not currently published: DIFC reported 10,018 active registered companies at the end of H1 2026, up 30 per cent year on year, with AI, FinTech and Innovation entities at 1,933, up 39 per cent.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md executive summary point 2, §5 and Annex B

  • Invented reg10 duties

    Unknown

    Statement under probe, not currently published: Regulation 10 imposes no Commissioner-notification duty and no filing deadline for a Substantial Change; the register duty at 10.2.2(g) is to provide on request.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §2 and §4, apps/web/lib/public-copy.ts, apps/marketing/lib/glossary.ts, apps/marketing/content/knowledge/substantial-change.md

  • Human in the loop arabic

    True

    Claim: Arabic legal artefacts are produced with a human in the loop: an AI drafting aid, then mandatory sign-off from a named legal reviewer before any Arabic artefact is issued, with provenance recorded.

    Probe: Behavioural. The probe calls the real code and watches what it does

    Surfaces: docs/regulator/DIFC-COMMISSIONER-BRIEF-DRAFT-v1.md §6.4, apps/web/lib/arabic-translation.ts

  • Claim registry published

    Unknown

    Statement under probe, not currently published: Every external claim we make is registered with the surfaces it appears on and a probe that reads the running code. A probe that cannot establish a claim returns unknown, never true.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: apps/web/app/trust/page.tsx, apps/web/components/trust/claims-registry.tsx, apps/web/lib/growth/evidence/trust-registry.ts, apps/web/app/page.tsx

  • Sentinel closed beta not enrollable

    Unknown

    Statement under probe, not currently published: Sentinel, real-time monitoring, is scoped to the Enterprise and Sovereign plans, is a closed beta, and is not open for enrolment. The platform side that receives and verifies signed telemetry is built; the sentinel that would run inside a customer's own cloud is not built, so no customer estate is monitored today.

    Probe: Evidence seam. The probe checks that a named verification artefact exists in the repository. It proves the check was written, not that it passed

    Surfaces: apps/web/app/sentinel/page.tsx, apps/web/app/demo/demo-panels.tsx, apps/web/lib/landing/home-sections.ts, apps/web/lib/landing/cloud-flow-model.ts, apps/web/lib/sentinel-flow-model.ts, apps/web/lib/seo/llms.ts, apps/web/lib/seo/json-ld.ts, apps/marketing/lib/llms.ts, apps/marketing/lib/json-ld.ts, apps/marketing/app/(marketing)/security/page.tsx, apps/marketing/app/(marketing)/platform/page.tsx

Get started

See the evidence-grade output for yourself

The public sandbox produces a real evidence register, with a SHA-256 proof-of-record for each artefact, from a system you describe. No signup, nothing stored.

Open the assessment sandbox