Governed AI for Timorese institutions,
built for the fund, the Timor Sea, the coffee cooperative and the district office

The Petroleum Fund: a transfer rule, an audit and the fiscal record of the state

The Petroleum Fund holds the country's petroleum receipts, and the law that governs it turns those receipts into an annual, bounded, published transfer to the state budget rather than a flow of money into the treasury. The estimated sustainable income benchmark frames how much may be withdrawn, transfers are approved by the National Parliament as part of the budget, and the fund reports regularly, is audited by an independent external auditor and is scrutinised by the Câmara de Contas, by the Anti-Corruption Commission where public money is at issue, and by anyone who reads the published accounts. Because the fund is the dominant source of state revenue, this is not portfolio reporting. It is the fiscal record of the country, and a state whose budget rests on a published, audited fund is the clearest possible case that the record is the institution.

Receipt reconciliation against operator payments, valuation and return attribution across the portfolio, estimated sustainable income computation, transfer proposals, budget execution reporting and extractive-revenue reconciliation are all increasingly AI-assisted, and every one of them is a claim someone will test. The platform validates the input before the model runs — the right source series, the right period, the right entity, redaction where a document should not be in the prompt at all — validates what comes back against the fund's own rules and published methodology, and writes one immutable ledger row for every call: actor, action, inputs, outputs, model version and verdict. Where a figure would enter a report to Parliament or an audited statement, it escalates to a named person before it goes anywhere. A number in the fiscal record that cannot be traced to its source, its method and its moment is not a number a legislature, an auditor or a citizen can rely on.

Greater Sunrise: auditable arrangements across a settled boundary

The Greater Sunrise fields lie in the Timor Sea, and the maritime boundary that runs through the area was settled with Australia by a treaty signed in 2018, following the first compulsory conciliation conducted under the UN Convention on the Law of the Sea. The treaty establishes a special regime for the fields, with joint arrangements and revenue-sharing terms, and Timor-Leste's participation runs through the Autoridade Nacional do Petróleo e Minerais as regulator and Timor Gap, E.P. as the national oil company. Development options remain a matter for the parties; what is not in question is that any development produces records two sovereign jurisdictions, several commercial participants and their auditors all have to be able to read.

Reserve and production accounting, cost recovery, metering and allocation, tax and revenue computation, environmental monitoring and decommissioning liabilities are exactly the categories that get contested years later, and the Bayu-Undan field's passage from production into end of field life and decommissioning is the reminder that the obligations outlive the operator. Every AI-assisted step across that evidence base runs through the governed chokepoint: validation before the call, validation of the output against the regime's own rules, and an immutable row for each one. Role-scoped access lets the regulator, the national oil company, the operators, the counterpart administration and independent auditors each see exactly what their mandate permits and no more. When a figure is disputed across a boundary — and on a multi-party arrangement it will be — the answer is a record both sides can read rather than two assertions in a room.

Coffee: traceability from the plot through the cooperative to the exporter

Coffee is the principal non-petroleum export and the cash income of a large number of rural households. It is overwhelmingly smallholder-grown, largely in the mountainous centre and west around Ermera, Aileu, Ainaro and Liquiçá, and it reaches international buyers through cooperatives, processors and exporters. The premium it earns rests on claims — organic certification, single-origin and washed-lot identity, cooperative membership, harvest year — and every one of those claims is a statement about where a specific lot came from and what happened to it, made to a buyer and a certification body who will audit it.

Producer registers, plot records, delivery receipts, wet-mill and dry-mill lot identity, cupping scores, inspection findings, certification scope and chain-of-custody documents have to hold together from the plot to the container. Where AI assists in reconciling deliveries, detecting volume anomalies that would indicate an unsupported claim, drafting certification submissions or producing traceability reports, the platform validates the input before the model runs, validates the output against the cooperative's and the certifier's rules, escalates to a person before any claim is attached to a lot, and writes an immutable row for every call. Producer data is personal data: minimization at capture and role-scoped access apply to a smallholder register exactly as they apply to a bank's customer file.

Banco Central de Timor-Leste, dollarization and correspondent banking

The Banco Central de Timor-Leste supervises banks, payments and money transfer operators in an economy that uses the US dollar, with locally issued centavo coins for small denominations. Dollarization changes the evidentiary problem rather than removing it: there is no exchange-rate reconciliation to perform, but every dollar relationship depends on correspondent banks in other jurisdictions whose own supervisors expect anti-money-laundering, sanctions and know-your-customer evidence in a form they recognise. Remittances from the diaspora, donor and programme funds, petroleum-sector payments and government disbursements all move through those channels.

Sanctions and AML screening, customer risk scoring, transaction monitoring, credit models and supervisory returns run through one governed chokepoint that produces evidence a domestic supervisor, a correspondent bank and a donor's auditor each accept without a translation exercise afterwards. Screening is enforced rather than advisory: a hit blocks the call, an override escalates to a named person, and the override decision is itself written to the ledger with its reason. Where a model output would affect an individual's access to an account, a transfer or credit, a person decides and the record shows who. Produce the evidence once, and let it be read many times.

Civil registration, identity records and a health system being built

Public administration in Timor-Leste is being built in the same decades in which it is being used. Civil registration and identity records, electoral rolls, payroll, procurement, tax and customs files, land and property records and the patient records of a health system anchored on the national hospital in Dili and the referral hospitals of the districts are all in active construction and active use at once. That is exactly the moment at which governance is cheapest to build in and most expensive to retrofit, and comprehensive data protection legislation being under discussion rather than in force does not reduce the obligation — the Constitution protects personal data, and donors and international partners impose their own standards on top.

Wherever AI assists in deduplicating a register, matching identity records, classifying a case, triaging a clinical query or drafting a determination, the platform enforces minimization and role-scoped access at the point of capture, validates outputs against the institution's own rules before they reach a decision-maker, and escalates to a person wherever the answer would change an individual's entitlement, identity record or care. Content-logging modes store a verifiable fingerprint instead of the content itself where the content should not be retained, certified deletion produces a tamper-evident certificate when a dataset must genuinely be gone, and every access is recorded — who looked, when and under what authority. A registration or identity programme that can show how each decision was reached is defensible to the citizen it describes. One that cannot is a liability from the first time it is questioned.

Portuguese, Tetum and audit records more than one institution can read

Portuguese and Tetum are the official languages of law, administration and audit; Indonesian and English are working languages under the Constitution; and membership of the CPLP connects Timor-Leste's institutional and legal vocabulary to Portugal, Brazil, Angola, Mozambique, Cape Verde and Guinea-Bissau. ASEAN membership, taken up in 2025, brings a regulatory alignment — customs procedures, standards, statistical reporting and financial-sector rules — that is still being worked through. The practical consequence is that the same underlying record is read in different languages by different institutions, and a translation produced after the fact is not the same thing as a record that was captured properly in the first place.

Policies are defined once and enforced identically whatever language the interface is in, so a rule written in Portuguese and a rule read in Tetum are the same rule rather than two documents that drift apart. Audit entries carry the language of the interaction, the model version and the verdict, so an auditor in Dili, a partner institution in Lisbon or Maputo and a regional counterpart read the same event rather than three summaries of it. Machine translation itself is a governed step: the input is validated before the call, the output is validated against terminology the institution controls, and anything that would carry legal or fiscal effect escalates to a person. Language coverage here is infrastructure, not presentation.

On-premise deployment inside Timorese institutions

Enforcement, inference and audit logging run inside the institution's own environment — a ministry in Dili, the central bank, a hospital, a cooperative's processing site, a district administration. Data does not leave the perimeter in order to be processed, which is the only version of data residency that actually holds.

Air-gapped operation as a supported configuration

For fund accounting, supervisory returns, civil registration data or petroleum revenue records, deploy with no outbound path at all. The platform does not phone home for telemetry, licence checks or model routing, so an air gap is a supported configuration rather than a degraded one.

Offline-capable enforcement across the districts and Oecusse

Governance does not pause when connectivity does. In Oecusse, on Ataúro, at a coffee washing station in Ermera, at a border post at Batugade or Salele, or at a health post in Lautém, validation still executes and the ledger still writes, and records created while disconnected reconcile cleanly when the link returns.

Jurisdictional residency for cross-boundary and multi-party reporting

Timor Sea arrangements, correspondent banking, certification audits and CPLP and ASEAN reporting each touch more than one legal regime. Deploy so that data governed by one jurisdiction's rules stays where those rules require, with jurisdiction-specific policy enforced at the same chokepoint rather than in separate systems that drift apart.