We turn what a government entity knows about its own technology into an asset that entity owns - so that understanding stops leaving, whether the contract ends or the people who hold it move on.

When a system is built, somebody comes to understand it completely: why it was designed that way, what depends on what, which failure means what, which shortcut was taken and why. That understanding leaves with the contractor, or with the engineer who takes another job.

The next change re-buys it. A new supplier spends the first weeks working out how the system behaves. That work is real and it is not overcharging, but the entity has already paid for it, often several times. It never appears as a line item, because it arrives inside a day rate. That is why this cost is invisible rather than small.

We call it a System Brain. It holds the intent behind each system, the reasoning that produced it, what depends on what, and the record of every failure and every fix.

It holds understanding, not telemetry. A digital twin mirrors infrastructure in order to forecast its condition. A cognitive twin mirrors what the organisation has learned about that infrastructure.

It grades its own knowledge. For every part of the estate it states whether what it holds is verified against source, inferred from documentation of uncertain freshness, or an acknowledged gap. A search over documents cannot tell you that, and a supplier will not.

It stays current by construction. No change to the estate without a design ticket raised with the System Brain, enforced at the merge and deploy gates you already operate. A change that appears without one is treated the way you treat a bypassed code review: as an incident, not as drift to be reconciled later.

An engineer opens a session, describes a problem in their own words, and the System Brain investigates the live systems, designs the change, and carries it out, strictly inside the authority that person already holds. The person at the keyboard drives, decides and closes.

Two things change in the first month. The queue in front of the one person who understands how something works disappears. And onboarding a new engineer becomes a session rather than a year.

Nothing autonomous touches production, at any authority tier. Work exceeding an operator's tier stops and waits for someone who holds it.

We build and modernise using frontier AI models under human authority, through a method we call Governed Intent Compilation. Intent is framed, attacked from assigned adversarial positions, decomposed, distilled into executable runbooks, built under supervision, and accepted against evidence, with every transformation recorded.

Design intent, decision records, rejected alternatives, runbooks and verification records are emitted by the pipeline rather than written up later. They are also, item for item, what the Kingdom's assessment instruments ask entities to produce.

An entity that produces evidence continuously produces it once and submits it four times. An entity that assembles evidence when a cycle opens does that work four times a year.

The same artefacts are admissible to all four:

• Emerging Technologies Adoption Readiness Index
• Qiyas
• DXMI
• Nadia

That is the difference between buying a capability and buying a platform. Applications are unlocked rather than installed.

Legacy modernisation designed against what is actually there rather than what the documentation says. Cloud migration with the discovery work retained instead of re-bought. Contractor transition where the incoming supplier starts from the record instead of from interviews. Assessment and audit evidence ready before the submission window opens. Measurably better staff, with the gap between assisted and unassisted work reported as a number rather than asserted. Program-scale change, with the blast radius stated before approval rather than discovered after it.

Today each of these is bought as a separate project, and each one begins by paying somebody to work out how the systems behave.

No organisation with long-standing processes leaps onto a new platform, and we never ask one to. The platform arrives through a bounded, paid engagement, time-boxed and priced fixed or capped, in which every performance claim we have made is scored against your own historical records before handover, and every deliverable is your property as it is produced.

What transfers is all of it: the underlying store, the map of what connects to what, the secrets vault, the encryption keys, the audit archive, and a record of how the estate works complete enough for your own engineers to work from. We call the arrangement custody.

Which leaves one question worth asking, and we have written the arrangement so that you can fail us on it: can your own people run this without us?

The measured gap. Your engineers resolve a sample of real work unassisted, before handover and again at six, twelve and twenty-four months. If the gap widens, we are failing at the thing we were bought for, and the correction is priced into the standing arrangement rather than sold back as a remedy.

An annual witnessed cold-start test. Cold because nothing of ours is present. Your own staff run live work end to end on a clean environment, using exported material alone.

A demonstrated export in open formats, performed rather than documented in a clause. And a right to buy out: after a stated period, purchase the operating model outright, end the standing fee, and run it internally.

You are not told you could leave. You practise leaving, on a date, with the result in your evidence pack.

Claude, GPT, Grok and Gemini all run outside any entity's perimeter, which puts every security committee in front of the same three options: refuse them and accept a weaker system, use them and accept exposure, or wait while the mandate clock runs. We take none of the three as posed.

What leaves the perimeter is a faithful blueprint of the estate, its structure and the relationships between its parts, never its code, with every real name and address permanently swapped for a fake one, through a single audited exit and no other. Because the mapping is one-to-one and consistent, the structure the model needs in order to reason survives intact. The substitution table never leaves your premises; its keys are held non-extractably in your own hardware security module, and no human role reads the mappings.

The crossing contains no judgment, not a model's and not a person's. Identical inputs produce identical outputs and identical audit records. No human, however senior, approves a crossing. There is no fast path and no emergency override, because the senior person who can wave something through is the failure mode the design exists to remove. Bulk access is architecturally impossible rather than administratively forbidden.

Four absolutes. Source code never crosses, at any classification, with no policy option and no enablement path. No identifier belonging to a natural person enters the system at all. No training, no fine-tuning, no self-modification of any model. And no component of this platform is ever placed with a commercial cloud service provider, in or outside the Kingdom.

And the thing we say before you ask it. This is not a mechanism for lowering a classification. What lowers a classification is a determination made by your own Business Data Executive, not a transformation performed by a supplier. A provider who offers de-identification as a route around a transfer rule is offering you a future audit finding rather than a control.

The act is narrow and specific: information originating inside the entity, in derived and de-identified form, crosses transiently to a private processor, and the result returns. Two published instruments govern it, both issued by the National Data Management Office.

There is nothing to negotiate and nothing to invent. The transaction already has a defined form: a defined role for a private company, a defined route through your own Data Management Office, an instrument on the regulator's own template, and a signatory fixed by the classification of the material rather than by the value of the contract.

Five determinations are made along the way: the classification, the legitimate purpose, the pre-processing method, the permitted use, and the mechanism governing the third party. Every one of them is made inside your entity, by your own named officers. None is made by us. We specify a method and propose terms; we approve nothing.

The regulator itself names masking and anonymisation as permitted pre-processing methods, provided content is not affected. Because our substitution is deterministic and one-to-one, content preservation is machine-verifiable rather than asserted, which is why we are working inside the published rules rather than around them.

There is also a statutory ten-business-day assessment window attached to the route. It is a schedulable dependency and belongs in a project plan rather than being discovered mid-mobilisation.

Instruments relied on:

• NDMO Data Classification Policy
• NDMO Data Sharing Policy

Your contracts defend against being tied to a technology. Nothing at all defends against your operational knowledge accumulating inside a supplier's fine-tuned model.

Where that happens, the knowledge cannot leave without abandoning what the entity has learned about its own systems. No exit clause reaches it, because the asset is neither portable nor inspectable.

The model does not learn. The corpus learns, and the corpus is yours. No supplier accretes your knowledge, including us.

DGA Digital Government Policies:

• 8.2.9.1
• 8.2.3.1
• 11.2.6.10

Every clause below is from DGA's Digital Government Policies, and the numbering is the instrument's own, so each reference can be looked up and held against us.

Institutional knowledge stops leaving with the contract. 11.2.2.4 requires the results of all lifecycle stages to be documented and retained as a reference for continuous improvement.

Key-person risk removed, and the improvement measured rather than asserted. 9.2.4.1 to 9.2.4.4 require annual plans to build digital skills and procure technologies and knowledge assets. Knowledge asset is a named procurement category in the regulator's own vocabulary, which is what lets a finance function book the System Brain as an asset rather than expense it.

Freedom of movement between technologies and clouds, and reuse instead of rebuild, and proof as a by-product, and operations that become self-service across the estate.

Above all of it sits the designation of 2026 as the Year of Artificial Intelligence by the Council of Ministers, and SDAIA's draft AI-First Policy.

Clauses discharged:

• 11.2.2.4
• 9.2.4.1–9.2.4.4
• 8.2.3.1
• 11.2.2.6
• 11.2.6.8
• 11.2.6.10
• 11.2.3.3
• 11.2.4.4
• 11.2.6.5
• 11.2.2.7

Tutelex is a Saudi company in Riyadh. Three principals, seventy-nine years of combined senior experience, and the reason that matters is that the three conversations tend to arrive in the same meeting rather than in sequence.

Twenty-six years in enterprise technology and AI systems architecture, latterly lead architect on enterprise AI systems for national operators across energy, refining, water, healthcare and insurance, at document and transaction volumes in the millions, under in-Kingdom sovereignty constraints throughout.

Twenty-eight years of executive experience in corporate finance, strategic planning, governance and program management, on programs valued in the hundreds of millions of riyals.

Twenty-five years founding and structuring commercial enterprises, with more than twenty-five public sector investment contracts managed and executed, and direct working knowledge of the Kingdom's procurement and regulatory machinery.

Most firms hold one of those three at senior level. This team holds all three. And nothing above is asked on trust: every performance claim is scored against your own historical records before anything is handed over, and our own engineering practice runs on the same System Brain under the same custody discipline, so the annual cold-start test is something we do to ourselves before we ask you to do it to us.

Agents are unreliable, and demonstrations prove nothing. Agreed. Reliability rather than capability is the binding constraint, and a system that succeeds once will often fail on a re-run of the identical task. We report distributions across repeated runs, failures included, never a single successful run.

We have seen AI programs fail before. The documented causes are operational rather than technical: no measured baseline, no agreed success threshold, governance retrofitted at security review, classification deferred until the design is already built. Three of those are closed by construction here.

This creates a new dependency on you. The measured gap at six, twelve and twenty-four months, an annual cold-start test with nothing of ours present, an export performed rather than documented, and a right to buy us out.

De-identification is not declassification. We agree, and we said it first. The determination stays with your Business Data Executive.

We have heard AI productivity claims before. Baselines scored on your own historical records, agreed before any target is discussed. An improvement target cannot be claimed without a measured baseline, and in most entities no such baseline exists.