BQA and CirrusGo automate compliance checks with AI sovereignty on AWS

BQA plays an important role in shaping high-quality education and training systems in Bahrain. BQA’s mandate spans three core functions: reviewing education and training institutions, administering the national qualifications framework, and conducting national examinations. As part of its review function, BQA evaluates self-assessment reports, supporting evidence, and compliance documentation against BQA’s national standards. This involves handling sensitive institutional data that’s classified as regulated personal data under Bahrain’s PDPL. Historically, the self-evaluation process was time and resource intensive, with incomplete or inaccurate submissions and insufficient supporting evidence. Additionally, the growing volume of data made it difficult to check compliance and accuracy while maintaining efficiency.

BQA identified an opportunity to use AI to automate document analysis, provide near real-time (NRT) scoring, and accelerate the process. But any solution would need to comply with Bahrain’s PDPL, which governs how personal data is collected, processed, stored, and transferred across borders. However, the AI capabilities that BQA needed weren’t yet available in the AWS Middle East (Bahrain) Region. And any cross-border transfer of institutional data for processing would need to meet the PDPL’s strict requirements. BQA needed a solution that could deliver AI capabilities while maintaining control over data residency.

The AWS team connected BQA with CirrusGo to build an AI-powered solution for compliance-check automation. CirrusGo designed EduScribe AI around a sovereignty-first architecture on the secure cloud computing environment of AWS to enforce data residency at the infrastructure level. So the solution uses a split-architecture design. All identifiable institutional data, system-of-record databases, logs, and long-term storage remain exclusively in the Bahrain Region, while AI services run in another Region under PDPL-compliant transfer safeguards. This helps BQA use Regional AI capabilities without exporting institutional data. The solution uses Amazon Bedrock—a service for building generative AI applications and agents—and Amazon Bedrock Agents to automate multistep tasks by seamlessly connecting with BQA’s systems, APIs, and data sources. To build generative AI solutions, the team uses Claude by Anthropic in Amazon Bedrock for automated document evaluation, rule extraction, and validation.

To keep data within BQA’s AWS private network and account boundary, CirrusGo chose to run third-party large language models on Amazon Bedrock, which doesn’t share data externally or use it for training models. BQA stores the uploaded data in Amazon Simple Storage Service (Amazon S3)—an object storage service—in the Bahrain Region and accesses it privately only from the approved second Region, with no persistence outside Bahrain. Software engineering best practices require interoperability, which includes decoupling systems through layered abstraction. So CirrusGo created an abstraction layer to encapsulate the data classification logic by using Amazon API Gateway to create, maintain, and secure APIs and Amazon Elastic Container Service (Amazon ECS) to build, manage, and run containerized applications. This way, the same data governance code runs in both the Bahrain Region for core records and the other Region for AI processing.

Test suites validate that data transferred between the two Regions remains PDPL compliant. Ultimately, this supports interoperability across the two Regions while maintaining consistent data protection controls. To support continual compliance monitoring, CirrusGo implemented security and monitoring services for BQA. These include AWS Config to assess, audit, and evaluate configurations of resources, and AWS CloudTrail to track user activity and API usage. The team also uses AWS Security Hub to prioritize critical security issues, AWS WAF to protect web applications, and Amazon Bedrock Guardrails to provide configurable safeguards.

Now in production, EduScribe AI helps BQA to streamline quality assurance activities by using AI to support self-evaluation, evidence analysis, and compliance assessments while maintaining data sovereignty. “EduScribe AI provides feedback with over 98 percent accuracy, significantly enhancing the efficiency of the self-evaluation process,” says Thajba Al Jowder, IT director at BQA. BQA has cut the time reviewers spend on each application by 67 percent and shortened the complete self-evaluation cycle by 57 percent. NRT feedback helps educational institutions improve the accuracy and completeness of submissions, while automated compliance checks reduce errors and strengthen adherence to quality standards. AI-generated summaries and insights help reviewers assess submissions more efficiently, make informed decisions, and focus on continuous quality improvement across Bahrain’s education and training sectors.

Enforcing data sovereignty structurally, the solution keeps all identifiable institutional data, system-of-record databases, logs, and long-term storage in the Bahrain Region. BQA can now limit cross-border processing, assess it for risk, and keep it consistent with the PDPL’s cross-border transfer conditions and under the oversight of Bahrain’s data protection authority. Additionally, hosting the application backend by using Amazon API Gateway, BQA provides a secure, scalable, and maintainable interface for external access, enhancing system reliability and performance. “Developed by CirrusGo, EduScribe AI represents the next generation of education quality assurance, supporting continuous improvement through AI while maintaining sovereign data control using AWS,” says Al Jowder.

CirrusGo is an AWS Advanced Tier Services Partner that delivers cloud, data, and AI solutions across the Middle East.