Compliance & Regulatory Engineering

United Arab Emirates & Dubai Regulatory Engineering

GattAI is purpose-built to satisfy the rigorous legal, labor, and data protection frameworks governing organizations operating in the United Arab Emirates, with dedicated statutory compliance modules for both mainland UAE and Dubai financial free zones.

UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021)

Core platform controls reflect the UAE PDPL and its Executive Regulations. Enforces statutory Controller vs Processor allocations, lawful processing grounds for employment records, cross-border data transfer limitations (Articles 22 and 23), and mandatory Data Protection Impact Assessment (DPIA) gates.

Dubai International Financial Centre (DIFC Law No. 5/2020)

Full alignment with the DIFC Data Protection Law and Commissioner of Data Protection guidelines for employment data. Fully compatible with DIFC Employment Law (Law No. 2 of 2019) and DEWS (DIFC Employee Workplace Savings) scheme integration.

Abu Dhabi Global Market (ADGM Data Protection Regulations)

Engineered to meet ADGM Office of Data Protection standards for international financial institutions, asset managers, and professional service firms.

UAE Labour Law (Federal Decree-Law No. 33/2021) & MOHRE

The core HR and payroll module natively executes statutory rules mandated by the Ministry of Human Resources and Emiratisation (MOHRE), including standard working hours, mandatory leave entitlements, and probation limitations.

Automated Wages Protection System (WPS) SIF Module

Generates validated Salary Information Files (.SIF) strictly formatted to Central Bank of the UAE and MOHRE technical standards (Employer EID, Bank Routing Code, Employee Labor Card / Mol ID, Basic Salary, Allowances, Deduction Codes). Automated validation eliminates salary processing delays and labor inspection non-compliance.

Statutory End-of-Service Benefits (EOSB / Gratuity)

Computes exact statutory gratuity per Law No. 33/2021: 21 days’ basic wage per year for the first 5 years of service, and 30 days’ basic wage for each additional year, capped at 2 years’ compensation, with exact proration for fractional years and fixed-term contracts.

Alternative End-of-Service Benefits System

Full operational support for the voluntary alternative workplace savings scheme enacted under Cabinet Resolution No. 96 of 2023, automating fund contributions and employee investment reporting.

Involuntary Loss of Employment (ILOE) Compliance

Automated tracking and validation of mandatory unemployment insurance enrolment requirements across mainland and free-zone workforces.

Dubai Electronic Security Center (DESC) Standards

Platform architecture adheres to the Dubai Information Security Regulation (ISR) baseline and Cloud Security Standard for enterprise and government procurement in the Emirate of Dubai.

Designed to the EU AI Act (High-Risk Baseline)

Under the European Union Artificial Intelligence Act (Regulation (EU) 2024/1689), AI systems utilized in employment, recruitment, performance evaluation, and workforce management are classified as High-Risk (Annex III, Point 4). GattAI implements these rigorous compliance requirements as the global architectural baseline across all operating regions.

No Emotion or Sentiment Inference (Article 5)

GattAI strictly bans biometric emotion analysis, sentiment classification from facial/voice cues, and psychological profiling. The capability is fundamentally absent in our models and codebase, not merely switched off in configuration.

Enforced Human Oversight (Article 14)

No consequential HR outcome, whether candidate disqualification, performance score finalization, disciplinary action, or compensation change, can be executed autonomously. The system enforces an unskippable human approval gate with self-approval prohibited.

Transparency & Provenance (Article 13)

Every AI-generated draft or assessment carries indelibly linked provenance metadata (model identifier, confidence interval, input baseline, and known constraints). This provenance persists even after human reviewers edit the text.

High-Quality Data Governance (Article 10)

AI pipelines operate strictly on curated organizational competency rubrics, approved job specifications, and verifiable performance KPI cards, preventing statistical noise or irrelevant demographic variables from entering the decision path.

Wider GCC & Regional Statutory Modules (Saudi Arabia & Egypt)

Alongside our deep UAE and Dubai architecture, GattAI provides native regulatory calculation modules for major regional economies across the Middle East.

Kingdom of Saudi Arabia (KSA PDPL & Labor Law)

Engineered in full alignment with the Saudi Personal Data Protection Law (PDPL) and SDAIA regulatory guidelines. Core payroll modules compute General Organization for Social Insurance (GOSI) employee and employer contributions, generate compliant Wages Protection System (WPS / Mudad) SIF files, and map job structures to Qiwa standards.

Arab Republic of Egypt (Data Protection & Labor Statutes)

Aligned with Egyptian Data Protection Law No. 151/2020. The statutory calculation module supports Social Insurance Law No. 148/2019, progressive income tax brackets under Law No. 91/2005, and Unified Tax Procedures Law No. 206/2020.

DPIA as an Enforced Go-Live Gate

Conducting a formal Data Protection Impact Assessment (DPIA) is a mandatory architectural milestone in customer onboarding. An enterprise tenant cannot transition to production without an executed DPIA reviewing data flows and retention schedules.

Algorithmic Bias Monitoring & NYC LL144 Methodology

Where artificial intelligence assists in candidate selection or talent mobility, GattAI continuously computes the exact statistical distribution ratios that employment regulators and labor auditors evaluate, built directly into the analytics module rather than performed as an afterthought.

Impact-Ratio & Selection Analytics

Candidate screening and shortlisting pipelines continuously calculate selection rates and adverse impact ratios using the Four-Fifths (80%) Rule, aligning with NYC Local Law 144 (LL144) AEDT audit standards and US EEOC guidelines.

Demographic Blind Screening

Candidate CV parsing systematically suppresses protected characteristics, including gender, age, nationality, marital status, and photographs, during initial algorithmic evaluation, scoring applicants exclusively on validated competencies and relevant experience.

Exportable Auditor Package

All underlying distribution data, selection frequencies, scoring rubrics, and demographic impact ratios export on demand as a cryptographically signed Auditor Pack, enabling independent third-party bias auditors to inspect live empirical data.

Automated impact-ratio reporting empowers organizations with continuous visibility. Where specific jurisdictions mandate an annual independent bias audit by a licensed auditor, our exportable auditor pack is formatted specifically for immediate third-party review.

The Structured, Exportable AI Decision Log

Every AI inference invocation across all 8 modules generates a structured, immutable decision record. Retained for a minimum of 12 months (and configurable up to statutory 7-year audit requirements), this log enables immediate reconstruction of any historical HR action.

Complete Lineage Capture

Each log entry preserves the model name, exact prompt template version, tokenized input snapshot, raw generated output, token expense, timestamp, authenticated human approver, and any reviewer edits or override reasons.

Immediate Regulatory Audit Readiness

When labor regulators, internal audit teams, or employee representatives inquire into how an interview was evaluated or how a review was synthesized, compliance teams export a self-contained, tamper-evident audit report with a single click.

Flexible Data Residency & Provider Controls

Enterprises manage diverse multi-jurisdictional compliance requirements. GattAI provides flexible deployment configurations to ensure data remains strictly within approved borders.

UAE Sovereign In-Country Hosting Tier

Dedicated hosting options in cloud data centers located in Dubai and Abu Dhabi for enterprise and public-sector organizations requiring complete domestic residency.

KSA Sovereign Cloud Tier

Dedicated hosting options in Saudi Arabian cloud regions to ensure compliance with SDAIA in-kingdom data residency requirements.

EU Zero-Retention Routing

For multinational entities with European employees, inference traffic routes through EU-domiciled endpoints under binding Zero Data Retention (ZDR) guarantees.

Custom Model Provider Allowlists

Enterprises maintain complete administrative control over approved model providers. Any LLM provider not approved by customer security and legal policy is strictly blocked from the execution pipeline.