The Trust Passport
Scope, product and version, intended use, method, framework editions, evidence coverage, key risks, reviewed controls, open gaps, the named reviewer, limitations, assessment and review dates, and a document checksum.
Service · AI vendor assurance
Answer the AI due-diligence question once, with evidence a Gulf buyer can check
Hospitals, banks and government entities across the Gulf now send every AI supplier a questionnaire. The AI Trust Passport turns your scattered governance evidence into one human-reviewed pack, mapped to the instruments your buyers work to, that you can share under your control and reuse from one buyer to the next.
Who it is for
AI vendors selling into regulated Gulf buyers. Abu Dhabi's Responsible AI Standard applies to AI that a healthcare entity buys from a third party, not only what it builds. Licensed banks answer to their central bank's AI guidance. DIFC firms that deploy AI answer to Regulation 10. Each of those buyers passes the question down the contract to you, usually as a long questionnaire with a short deadline.
Most suppliers answer it from scratch every time, from documents written for another market, and the answers drift. The passport gives you one reviewed set of answers, each tied to the evidence behind it, so the next questionnaire takes days rather than weeks.
Buyers assessing an AI supplier can commission a passport too, with the supplier's agreement.
What you receive
Four documents, in English, with Arabic summaries where your buyer needs them.
Evidence register
Every item you provided, with its owner, document date, source, classification, review status and the controls it supports. The part your own team keeps using.
Remediation plan
Each gap with its impact, owner, priority and target date. Written so your team or your chosen supplier can act on it. We do not bid for that work.
Customer-sharing version
A redacted copy for a named buyer, with confidential attachments and personal information removed. We record who it was prepared for and why. Nothing is published.
What we assess
Ten control domains, scoped to your product. Not every control applies to every product, and we say which do not and why.
- A. AI inventory, purpose, intended use and ownership
- B. Governance, accountability and risk acceptance
- C. Training and inference data governance, and privacy
- D. Identity, access, secrets and infrastructure security
- E. Model evaluation, robustness, bias and performance
- F. Human oversight, explainability and transparency
- G. Third-party models, dependencies and supply chain
- H. Logging, monitoring, incident response and reporting
- I. Change control, drift, retraining and lifecycle
- J. Business continuity, resilience and decommissioning
Mapped to the instruments your buyers use
Selectively and with the edition named, so a buyer can see exactly what was and was not checked. We map to standards; we do not reproduce their text.
The instruments Gulf buyers pass down to suppliers
DoH RAI V1DIFC Reg. 10SDAIA AI RMFQCB AI GuidelineUAE and Saudi PDPL
Chosen by where your buyers are and what they are licensed for. In Abu Dhabi health, for example, the Responsible AI Standard expects AI compute and storage, including disaster recovery, to sit in the UAE, with support access from inside the country, and production data kept out of model training.
Who decidesYour buyer and its regulator. The passport shows them the evidence; it does not make the decision for them.
The standards that span them
ISO/IEC 42001ISO/IEC 27001:2022NIST AI RMF 1.0OWASP Top 10 for LLM Applications
No Gulf regulator mandates ISO/IEC 42001, and we will not say otherwise. It is used here as the neutral layer that lets one set of evidence answer several Gulf frameworks at once.
Who certifiesOnly an accredited certification body can certify you to an ISO standard. We are not one.
EU AI Act, where your output reaches Europe
Reg. (EU) 2024/1689
Included only if it applies, with the obligations and dates checked at the time of assessment. Not every AI product is high-risk, and we will not treat yours as if it were.
Who decidesApplicability is a legal question. We flag it; your counsel confirms it.
How each control is graded
Every control carries one of seven statuses: not assessed, evidence requested, vendor asserted, evidence provided, reviewed, adequate for scope, reviewed, gap, or not applicable, with the reason. Evidence you provided is never upgraded to “reviewed” until a named consultant has reviewed it and recorded why.
You get coverage (how many in-scope controls have reviewed evidence) and findings, reported separately. We do not give a single trust score, because one number hides exactly what a buyer needs to see.
How it works
Typically four to five weeks from receiving your evidence.
Scope
Product, version, intended use, the buyers you sell to and the instruments that follow from them. Agreed in writing before any work starts.
Week 1
Evidence
A structured questionnaire by domain. You provide documents through a secure channel agreed at scoping, and each item is logged with its owner, date and version.
Weeks 1–3
Review
A named consultant reviews every claim against its evidence, with short interviews with your product, engineering and security leads.
Weeks 3–4
Passport
The passport, evidence register, remediation plan and sharing version, taken through with your leadership in a remediation workshop.
Week 5
What it costs
One fixed fee, agreed in writing after the scoping call and paid in advance in two instalments: half before we start, half before the review stage.
AI Trust Passport: Starter
One AI productCore controls in six domainsOne review session
For early-stage AI companies facing their first enterprise questionnaire. Covers the core controls in domains A, B, C, D, F and H, with the passport, evidence register and remediation plan. If you move to the full passport within six months, the Starter fee is credited against it.
From AED 9,500≈ USD 2,587. Excludes VAT and other taxes.
AI Trust Passport: Full
One AI product and versionAll ten domainsInterviewsRemediation workshopSharing version
Includes 30 days of follow-up questions by email after delivery. The final fee depends on the number of controls in scope and the buyers' instruments, and is fixed before you commit.
From AED 17,500≈ USD 4,765. Excludes VAT and other taxes, applied as the law requires.
Further products, versions or buyer questionnaires
A second product, a material new version, or help answering a specific buyer's questionnaire from the passport.
AED 3,500 per consultant day≈ USD 953. Agreed and paid in advance. No minimum commitment.
Re-assessment before the review date
Focused on what has changed since the last passport, so it is usually smaller than the first.
Quoted at the timeFixed before you commit, on the same terms.
What the passport is not
It is not a certificate, a conformity assessment, a regulatory approval, a penetration test, a legal opinion or a guarantee that a product is safe. Where a Gulf instrument requires a formal conformity assessment, such as for high-risk AI under Abu Dhabi's Responsible AI Standard, that stays with the body the instrument names, and we say so in the passport.
The firewall
We never give an independent opinion on work we helped build. If we have written or helped write your AI governance documents, including through our health-tech supplier readiness service, we will not issue a Trust Passport on that product. And we do not sell the remediation the passport identifies.
Questions
Is the AI Trust Passport a certificate?
No. It is a dated, human-reviewed assessment of the evidence you provided, against a stated scope and named framework editions. It is not a certification, a conformity assessment, a regulatory approval or a penetration test, and it never describes a product as certified, approved, compliant or verified.
Who sees the passport?
You do. Nothing is published by us. You receive a full version and a redacted customer-sharing version, and we record which buyer each shared copy was prepared for and why.
How long does a passport stay current?
Each passport carries its assessment date and a review date, normally twelve months later. A material change to the product, its model provider or where it is hosted brings the review date forward.
Do you need our source code or customer data?
No. We assess governance evidence: policies, records, test results, architecture, contracts and logs. Please do not send personal data, patient data or customer content. Where evidence can only be seen on your systems, we review it in place.
Can a buyer commission a passport on a supplier?
Yes, with the supplier's agreement. The buyer and the supplier both see the scope before we start, and the findings are shared with both.
Do you use AI to produce the passport?
AI tools may summarise documents and suggest where evidence fits, under consultant review. They never decide a status, they are not trained on your content, and every statement in the passport traces to a piece of evidence or is marked unsubstantiated.
Start with a scoping call
Tell us the product, who you sell it to, and the questionnaire you are answering now. Twenty minutes is usually enough to fix the scope and the fee.