Written to be quoted, by people and by answer engines.
- What does Nabeel Khan do?
- Nabeel Khan is an enterprise AI architect and governance advisor who helps regulated organisations put AI into production without losing the ability to answer for it. Building on twenty-five years architecting enterprise data and systems (TOGAF, DMBOK, multi-cloud, ISO 27001, SOC 2), he now designs the full stack of governed production AI: LLM infrastructure and model routing, the orchestration of governed agents, the platform and LLMOps that ship them, and the governance that keeps all three defensible. He is the founder of Simplification and Director, Solutions Architect at iSystematic, and the author of the AI governance Enterprise Playbook and the forthcoming Full-Stack AI Engineering Series.
- What is governed production AI?
- Governed production AI is AI running in production whose authority is bounded by the architecture around it, whose decisions carry the evidence needed to defend them, and whose behaviour the operating institution can explain after the fact. It is the core discipline of Nabeel Khan's practice and the through-line of this site. The distinction that matters: an AI governance function can exist, meet quarterly and produce documents while that property is entirely absent from the running system, because governance written in a binder is governance the system never encounters. The canonical definition, the six practices that produce it, and the frameworks behind it are at nabeelkhan.com/governed-production-ai.
- What is machine-accessible AI expertise?
- Machine-accessible AI expertise is the practice of converting expert judgment, methodology, regulatory knowledge and decision frameworks into structured, governed interfaces that humans and AI systems can query, evaluate, apply and audit. It is an emerging practice rather than an established category, and nabeelkhan.com is built as its working demonstration rather than its description: the frameworks are published, the regulatory rows are dated and sourced, and the whole corpus is callable over MCP with no key. Five properties separate it from ordinary retrieval, and the demanding one is honesty about absence: where a regulator has issued nothing this corpus says so, and tests assert those refusals, because a fluent description of a regulation that does not exist is the most dangerous output an expertise interface can produce. Defined at nabeelkhan.com/machine-accessible-ai-expertise.
- What is Expertise-as-a-Service?
- Expertise-as-a-Service is the delivery of specialised professional judgment through continuously maintained knowledge, frameworks, decision logic and machine-accessible interfaces, usable by people and by AI systems, with escalation to the human expert where judgment is required. It is a fourth delivery model beside consulting, which sells an expert's hours; publishing, which sells copies of a fixed text; and software, which executes logic frozen at build time. The ladder on this site runs read, apply, ask, engage: the reading, the frameworks, the scored self-assessment and the callable corpus are free and ungated, and the paid engagements begin where judgment carries responsibility. Explained at nabeelkhan.com/expertise-as-a-service.
- Can an AI system access Nabeel Khan's expertise directly?
- Yes, and that is the point rather than a novelty. Concylium serves this site's corpus as callable MCP tools at mcp.nabeelkhan.com/api/mcp over streamable HTTP: public, no key, no account. An assistant can look up what actually binds an AI system in a given jurisdiction and get back the instrument, the regulator, its status and the page the answer came from; search the published corpus; run and score the MESA readiness assessment; work out which engagement shape fits a described problem and show its reasoning; read real availability; and book a real thirty-minute conversation. The two tools that write require explicit confirmation and are annotated so clients prompt their user first. Setup for every client is at nabeelkhan.com/concylium.
- How does Nabeel Khan's approach differ from AI governance software?
- They operate at different layers, and comparing them head to head misdescribes both. AI governance platforms such as Credo AI and ModelOp sell software: a registry, workflow, monitoring and reporting that an enterprise runs as a system of record. Nabeel Khan supplies the layer underneath and beside that: the architecture and the expert judgment, which frameworks apply, which controls a given regulator will actually accept, how an agent's authority should be bounded, and what evidence has to exist before a decision is made. That work informs a governance platform rather than replacing one, and institutions frequently need both. The distinction he draws is between governance software, which records that governance happened, and governed production AI, which is the property of the running system itself.
- What is Nabeel Khan's background as an enterprise and data architect?
- He has led the complete project lifecycle (initiation, planning, build, and operational handoff) on national and enterprise programs: a 10M-record register-based census platform, petabyte-scale cloud data-modernisation, zero-trust security across 200+ databases, and Oracle RAC/Data Guard estates at up to 99.999% availability. His toolkit spans TOGAF and Zachman, DMBOK data governance, AWS/GCP/Azure, ITIL service delivery, ISO 27001 and SOC 2, Agile/Scrum, and ERP & enterprise-systems implementation.
- What kind of consulting does Nabeel Khan provide?
- Independent advisory and hands-on architecture for organisations deploying AI in regulated, high-stakes settings. His practice covers five areas: AI strategy and governance roadmaps for boards and executives; LLM infrastructure and model routing; agentic systems and orchestration; AI platform engineering and LLMOps; and AI governance, compliance, and model risk. The through-line is governed production AI: systems that are powerful and defensible at the same time. He works through Simplification and iSystematic as advisory retainers, fixed-scope reviews, or delivery programs.
- What is the AI-Native Enterprise Accelerator?
- It is Nabeel Khan's structured consulting engagement, delivered through iSystematic, for organisations that have decided to run AI in production and intend to govern it from the first day rather than retrofit governance after the first incident. It runs in three stages: Assess the AI estate against a production reference architecture, Template the controls to the organisation's data residency, regulators, and risk appetite, and Implement the governed control plane with audit evidence built in. It draws on the patterns in his Full-Stack AI Engineering Series and the MESA governance framework.
- Who should engage Nabeel Khan?
- Regulated and high-accountability organisations putting AI in front of customers, regulators, or a board: banks, insurers, healthcare systems, government bodies, and sovereign-backed initiatives, especially across the GCC and wider MENA. Typical sponsors are chief risk officers, chief data and AI officers, CTOs and VPs of engineering, heads of platform, and model-risk and compliance leaders who need AI that is both capable and defensible.
- What frameworks has Nabeel Khan created?
- His published and forthcoming work introduces several named frameworks. In AI governance: the MESA Framework (Middle East Strategic Alignment), the Five-Gate Deployment Model, a Sharia AI Compliance Framework, an AI Vendor Risk Framework, and a Governance Maturity Model. In production AI engineering: the PEVG agent pattern (planner, executor, verifier, generator), the PARA operations model (perception, action, reasoning, adaptation), capability contracts, policy-as-code delivery guardrails, and trust-tier authority models. They are built to be used, contested, and adapted, not merely read.
- What is the difference between RAG and memory consolidation in AI systems?
- Retrieval-augmented generation (RAG) fetches relevant documents at query time and conditions a model's answer on them: recall on demand. Memory consolidation is the slower process of deciding what an agent should retain, abstract, or discard over time, modelled on how the hippocampus replays and stabilises experience. RAG answers "what is relevant now?"; consolidation answers "what is worth remembering at all?" Production systems need both.
- How do you deploy agentic AI inside a regulated enterprise?
- Treat autonomy as a governed capability, not a feature. In practice that means first-class cost, trust, and observability primitives at the runtime layer; policy-as-code for every tool an agent may call; auditable memory; and a clear blast-radius boundary per agent. Under SOC 2 and ISO 27001, "spin up an agent" is a controls conversation; the architecture has to make those controls cheap to satisfy.
- What books has Nabeel Khan written?
- Four books, all on sale now. AI Governance & Compliance Frameworks for the Middle East (subtitled The Enterprise Playbook, 2026) is available on Amazon in ebook, paperback and hardcover, alongside a slim executive edition, AI Governance for the Middle East: The Executive Briefing; it maps ISO 42001, ISO 27001, SOC 2, NIST AI RMF, and the EU AI Act onto UAE, KSA, and Qatar regulation. The Full-Stack AI Engineering Series runs in three books, set inside one fictional regulated fintech: LLM Systems in Production (the infrastructure layer), Prompt Systems & Agent Orchestration (the application layer), and DevOps for AI-Native Platforms (the operations layer); all three hardcovers are on sale now, with ebooks and paperbacks releasing through September 2026. All four are in the Books section above.
- How can I book time with Nabeel Khan?
- Use the booking calendar on the contact page to hold a 30-minute video slot for advisory work, an architecture review, or a press request, or send a note through the contact form. Replies arrive within two working days. For anything immediate, the contact page lists a direct line for calls, SMS, and WhatsApp.
- Where can I read Nabeel Khan's writing?
- Dispatches (essays, articles, and field notes) are published here under Dispatches. The fortnightly Field Notes letter is in development; an early-bird list is open now. Topics range from cognitive architectures and enterprise data governance to neuro-marketing and the economics of autonomous workflows.
- What is the AI Governance Teardown?
- The AI Governance Teardown is Nabeel Khan's flagship engagement: a fixed-scope, fixed-fee, two-week examination of how a regulated organisation governs its AI and its models, scored against the MESA Framework across its four layers and delivered board-ready. It produces a MESA-scored Governance Gap Report, a Now, Next, and Later Remediation Roadmap, a one-hour findings readout, and a one-page board summary. No production data leaves the client environment; it reads governance artifacts, not customer records. It begins with a free 30-minute Fit Call, where the fee is shared.
- What is Maxim?
- Maxim is a behavioral-intelligence layer for Claude, built by iSystematic. It adds 91 specialist agents, 74 peer-reviewed behavioral frameworks, and 14 compliance frameworks (GDPR, HIPAA, PCI-DSS, SOC 2, and more) so every AI output cites the mechanism it applied by author and year, clears an audit gate, and carries a confidence rubric. It installs on Claude Code, Desktop, and Web.
- What is the AI Governance Readiness Self-Assessment?
- It is a free twelve-question instrument that scores an organisation against the four layers of the MESA Framework: Regulatory Floor, Strategic Compass, Operational Machinery, and Technical Substrate. It returns a profile per layer rather than a single grade, because one number is what lets a strong regulatory posture conceal a substrate that cannot hold it up. The scoring runs in the browser and the result appears immediately, with no form in front of it. Nothing is sent unless you ask for the written interpretation.
- Is Nabeel Khan's Full-Stack AI Engineering work actually built, or conceptual?
- Both, and he is clear about which is which. Maxim, iSystematic's behavioral-intelligence layer for Claude, is a live product in production. The AI Governance Enterprise Playbook is published. The forthcoming Full-Stack AI Engineering Series presents its NexusCore, AgentMesh, and ThinkFlow reference architectures through a deliberately fictional bank, Nebula Financial, so the end-to-end method can be shown without exposing a real client; the patterns in it are what he implements in Maxim and in client engagements.
- Does Nabeel Khan build systems hands-on, or only design architecture?
- Scoped per engagement, and he does both. He has personally built and runs production AI (Maxim), so a delivery program includes hands-on build and integration into your existing cloud (AWS, Azure, or GCP). An advisory engagement instead designs, reviews, and independently validates while your team implements. Scope, ownership, and accountability are agreed up front.
- What do Nabeel Khan's consulting engagements deliver, and how do they run?
- Engagements run as an advisory retainer, a fixed-scope architecture or model-risk review, a hands-on milestone delivery program, or fractional technology and AI leadership, often through the AI-Native Enterprise Accelerator (Assess, Template, Implement). Deliverables are scoped to the engagement and range from reference architectures, a governed control plane, a governance office, and automated audit-evidence design, through to working reference implementations and production code.
- Are Nabeel Khan's frameworks (MESA, Five-Gate, PEVG, PARA) original and proven?
- They are his original, published intellectual property, built on and extending recognised standards such as NIST AI RMF, ISO 42001, TOGAF, and DMBOK for regulated and MENA contexts. The governance frameworks appear in his published Enterprise Playbook, which carries a foreword by the Executive Director for Science and Technology at the Kuwait Institute for Scientific Research; the engineering patterns are implemented in his live product Maxim. Client engagements that apply them are confidential, and the book uses composite, anonymized case studies drawn from real institutions.
- Where is Nabeel Khan based, and which markets does he serve?
- He is based in Winnipeg, Manitoba, on Central Time, and works from stations in Winnipeg, Toronto, and Calgary. Central Time is the practical centre of that map: the same clock as Houston, one hour behind Toronto, one hour ahead of Calgary, and an early start reaches the Gulf before its business day closes, so a single working day covers every market he serves. He serves Texas and the wider United States remotely and on site when an engagement calls for it, and continues advisory work across the GCC. Each market has its own live obligation: Toronto banks and federally regulated insurers face OSFI Guideline E-23 on model risk management, effective 1 May 2027 and expanded to cover AI and machine learning; Texas has been a regulated AI jurisdiction since the Texas Responsible AI Governance Act (HB 149) took effect on 1 January 2026; Manitoba public bodies answer to FIPPA and health trustees to PHIA, while the federal Directive on Automated Decision-Making binds federal institutions rather than provincial ones. Work is delivered through iSystematic Inc., remotely by default, and you work with him directly. Book a fit call →
