Governed AI for Armenian institutions,
built for the software firm, the mine, the bank and the ministry

The processor's problem: an audit record that satisfies somebody else's regulator

Armenia has an unusually large software and IT services sector relative to the size of its economy, working substantially for clients in North America and Europe -- product engineering, platform operations, data work, embedded and semiconductor design, and increasingly the building and running of AI features inside somebody else's product. The regulatory obligation in that arrangement usually sits with the customer. A European customer carries its own data protection duties; an American customer carries sectoral rules in health, finance or defence-adjacent supply; an acquirer carries diligence obligations to its own board and its own regulator. The Armenian provider is frequently the processor rather than the controller, and the contract, not the statute, is what transmits the duty.

That inverts what evidence is for. The provider is not primarily proving compliance to an Armenian inspector; it is producing the record its client will hand to a regulator, an external auditor, a security questionnaire or a buyer in diligence. KriftAI puts every AI-assisted step through one governed chokepoint: the input is validated before the model runs, against the client's own rules on what data may be sent and what must be redacted or refused; the output is validated against those rules before it reaches a developer, a ticket or a production system; an immutable ledger row is written for every call -- actor, action, inputs, outputs, model version, policy version and verdict; and anything the rules cannot settle escalates to a named person rather than proceeding. Per-client policy scoping keeps one customer's data and one customer's rules from touching another's, and the export from the ledger is a defensible artefact rather than a reconstruction assembled the week before an audit.

Copper, molybdenum and gold: production, environmental and revenue records

Mining is the other pillar of Armenian export, with copper and molybdenum from the south around Kajaran and Kapan in Syunik, copper in the north around Alaverdi and the Lori belt, and gold among the mined and processed metals. Every commercially significant fact about a mine is a claim that somebody outside it will eventually test: grade and assay results, concentrate tonnage and moisture, shipment weights, water discharge and air quality monitoring, tailings facility instrumentation, and the royalty, export and tax records that follow the metal out of the country.

Those records are read by the mining and environmental administrations, by offtakers and their independent assayers, by lenders and their technical advisers, and by downstream buyers applying their own supply chain due diligence. Where AI assists in reconciling assay series, classifying geological data, monitoring tailings and water quality instrumentation, forecasting throughput or drafting regulatory and environmental submissions, the platform validates the input before the model runs, validates what comes back against the operation's own rules, and writes one immutable row for every call. Role-scoped access lets the operator, the environmental regulator, the lender's adviser and the offtaker's auditor each see exactly what their mandate permits and no more. A measurement that cannot be traced to its sample, its instrument and its moment is not a measurement a lender or a regulator can rely on, and a monitoring obligation that outlives a licence needs records that outlive it too.

The Central Bank of Armenia, payments, and the diaspora corridors

The Central Bank of Armenia supervises the financial sector and has been active on payments and fintech regulation, which puts banks, payment service providers and newer entrants inside the same supervisory perimeter. Layered on top of that is a set of counterparties nobody in Yerevan supervises: correspondent banks abroad, card schemes, and the compliance functions of the institutions on the other side of every diaspora remittance and every inbound investment. A large global diaspora sustains investment and remittance flows into the country, and those corridors stay open only while the AML and sanctions-screening record on the Armenian side is one a foreign correspondent is willing to accept.

AML and sanctions screening, transaction monitoring, KYC and beneficial ownership work, credit and risk models and supervisory returns all run through one governed chokepoint, producing evidence in a form a domestic supervisor and a foreign correspondent each accept without a translation exercise afterwards. Screening is enforced rather than advisory: a hit blocks the call, an override escalates to a named person, and the override decision is itself written to the ledger with its reason and its author. Where a model contributes to a decision about an account, a payment or a customer relationship, the record shows which model version and which policy version produced the recommendation and who accepted it. Produce the evidence once at the point of the call, and let a supervisor, a correspondent and an internal auditor each read the same thing.

Personal data protection under Armenian law and Council of Europe instruments

Armenia has personal data protection legislation supervised by a data protection authority operating within the Ministry of Justice, and it is a party to Council of Europe data protection instruments. The framework establishes duties around lawful basis, purpose limitation, proportionality of processing, data subject rights and security of processing, and it applies to Armenian organizations in their own right -- not only when a foreign client asks about it. Whether a given arrangement satisfies another jurisdiction's requirements is a determination for the relevant authorities under that jurisdiction's own rules, and it should not be asserted by a technology supplier.

What a platform can do is make the duties enforceable at the point of the call instead of at the point of the policy document. Minimization is enforced at capture, so fields that are not needed for the purpose are not sent to a model at all. Role-scoped access limits what each person and each service can retrieve. Content-logging modes store a verifiable fingerprint rather than the content itself where the content is sensitive. Certified deletion produces a tamper-evident certificate when data must genuinely be gone, including from the audit path that would otherwise preserve it. Every access is recorded -- who looked, when, and under what authority -- and any output affecting an individual's rights or entitlements escalates to a person before it takes effect. The organization carries the obligation; better evidence is what makes carrying it tractable.

Two reference points at once: EAEU membership and the EU partnership agreement

Armenia is a member of the Eurasian Economic Union, which brings common customs and technical regulation arrangements with the other member states, and it also has a comprehensive and enhanced partnership agreement with the European Union covering trade, regulatory cooperation and standards alignment in a range of sectors. For an exporter, a processor or a bank, the practical consequence is that the same product, the same shipment or the same dataset can be described to two different regulatory audiences that do not share a vocabulary, a classification scheme or an evidentiary expectation.

That is a records problem before it is a policy problem. Conformity documentation, customs classification, certificates of origin, technical files, product declarations and data handling descriptions all have to be produced twice from one underlying reality without the two versions drifting apart. Where AI assists in classification, document drafting, translation or reconciliation across those regimes, the governed chokepoint applies to each step: input validated, output validated against the organization's own rules for the regime in question, escalation to a person wherever a classification carries duty, tariff or admissibility consequences, and one immutable row per call. Where a rule's status is evolving, or an alignment commitment has been agreed but not yet implemented in national law, the honest position is to say so and to keep the record of what was actually relied upon at the time a decision was made.

Monasteries, museums and the conservation record

Armenia's monastic and archaeological heritage includes sites inscribed on the UNESCO World Heritage List -- the monasteries of Haghpat and Sanahin in Lori, the monastery of Geghard and the Upper Azat Valley, and the cathedral and churches of Echmiatsin with the archaeological site of Zvartnots. Alongside them sit museum and manuscript collections, among them the Matenadaran in Yerevan, whose holdings are both a research resource and an object of conservation duty. Inscription and protection status bring obligations: condition monitoring, conservation intervention records, permitting for works in and around protected sites, and periodic reporting.

Digitisation and AI-assisted work on those collections -- optical character recognition and handwritten text recognition on manuscripts, condition assessment from imagery, cataloguing, translation and attribution -- produce claims that scholars, conservators and international bodies will test long after the project that generated them has ended. The platform records for every AI-assisted step which model and which parameters produced a transcription, a dating suggestion or a condition classification, keeps the machine-generated layer distinguishable from the curator's own assertion, and escalates to a person wherever a determination would enter the catalogue as fact. Conservation and permitting files carry the same treatment, so a decision taken on a protected site can be reconstructed exactly as it stood rather than argued about from memory.

On-premise deployment inside Armenian facilities

Enforcement, inference and audit logging run inside the organization's own environment -- a data centre in Yerevan, a development centre in Gyumri, a mine site office in Syunik, a bank's own infrastructure, a ministry's server room. Data does not leave the perimeter in order to be processed, which is the only version of data residency that actually holds when a client's auditor asks.

Air-gapped operation as a supported configuration

For a client's regulated workload, supervisory returns, personal data under Armenian law or a collection held in trust, deploy with no outbound path at all. The platform does not phone home for telemetry, licence checks or model routing, so an air gap is a supported configuration rather than a degraded one.

Offline-capable enforcement across mountainous terrain

Governance does not pause when connectivity does. At a mine site in Syunik, a monitoring station in the Lori mountains, a heritage site under conservation works or a field survey in Tavush, validation still executes and the ledger still writes, and records created while disconnected reconcile cleanly when the link returns.

Per-client and per-jurisdiction partitioning

A firm serving several overseas customers, or an exporter answering to both EAEU and EU reference points, needs one client's data and one regime's rules kept separate from another's. Deploy so that each partition enforces its own policy at the same chokepoint, with an audit export scoped to a single client or a single regime rather than to everything the platform has ever seen.