The GPUs have shipped. The people haven't.

The most imposing stands at Ai Everything Abu Dhabi did not belong to companies. They belonged to government: digital identity, justice, city services. Here the state is the main exhibitor and the main buyer. Around it, hardware and datacentre vendors, in force.

Compute is a procurement problem. You can buy it from American suppliers or from Chinese ones. Both were on the floor, and both are building in the region. Capacity is no longer the question.

The announcement of the day said the opposite of the hall. On stage, Mistral presented Large 4: trained from scratch in two months, on about 4,000 Nvidia GPUs and roughly 10 MW, in European datacentres. Open weights are due on 27 October. Two caveats: the benchmarks are Mistral's own, and the chips are still Nvidia, so frugal does not mean sovereign down to the silicon. Still, in a hall that counts capacity in datacentres, the headline was a model its makers call frugal to train. The scarce input was the team. I had written Mistral off too early.

Voice is the next interface, and its data has no settled home. Day two was about voice. After several conversations with voice AI vendors, my conviction is that the future of AI is spoken, and the tools are arriving now. What remains open is where the audio goes. Two routes are on the table. The first is local datacentres: ElevenLabs, for one, has kept inference and storage inside India for its enterprise customers since 2025. Nothing comparable came up for Africa in the conversations I had. The second is edge AI: run the model on the device, and the question of where the data travels largely disappears. Either way, this is an architecture decision, not a purchase.

We made that decision early in Modaka, Quatrain's edge-first knowledge engine. The voice provider is a pluggable component: change it without touching the rest. The target is to run fully local. Hey Brad, the voice assistant Brad builds for farmers, is built on those two requirements.

The middle layer is thin. Between the state that buys and the vendors that ship compute, there should be a layer of people who design systems meant to last ten years. Most startup stands were very early. My impression, and it is only that, is that many demos were generated rather than engineered. That is fine for a demo. It is not an answer to the questions that come next:

• Who signs the SBOM?
• Who reports an actively exploited vulnerability within 24 hours?
• Where do builds, artefacts, logs and voice recordings physically live?
• What happens the day you change cloud provider?

One more sign: hiring for government AI programmes is already being delegated to talent platforms. Demand for these people exceeds supply.

Why it matters now. Any Gulf maker of connected products selling into Europe falls under the EU Cyber Resilience Act. Reporting obligations have applied since 11 September 2026; full application comes in December 2027. At home, the same teams answer to the UAE Information Assurance Regulation or Saudi Arabia's NCA controls. The laws differ, but the engineering is the same: SBOM per build, vulnerability handling, secure-by-design, logging, incident runbooks, data residency. Build it once, map it to each framework.

What Quatrain does. We are hands-on systems architects. We help teams build platforms they control: cloud, data and AI architecture, and cyber compliance across the EU's CRA and NIS2 and their Gulf counterparts. We run what we recommend: a self-hosted forge and registries, Kubernetes in Europe, GitHub as a read-only showcase holding no secrets. I also run Brad, a hardware and AI company. Its product will be demonstrated at the Élysée Palace, the French president's residence, on 21–22 November, as part of the national Made in France exhibition.

We are taking on our first missions in the Gulf. If you ship connected products to Europe, or need a platform you can walk away from, let's talk.