Business Requirements Document¶
HumanityAI'd Patrol Sight — v1.0 · July 2026
Confidential — HumanityAI'd
Download
1. Executive summary¶
HumanityAI'd has built and deployed Patrol Sight: an on-premises face-recognition system that puts identification into a patrol officer's line of sight through AR glasses, returning a labelled match in about 68 milliseconds against a watchlist of nearly 94,000 people — with every byte of biometric data staying inside the customer's network. This BRD defines the business case, stakeholders and requirements for taking Patrol Sight to Middle East government and private-security buyers, beginning with the UAE.
The commercial logic is narrow and strong. GCC buyers already operate facial recognition at scale — Dubai Police's Oyoon programme, Saudi Arabia's Sawaher platform for Hajj, and the Qatar 2022 stadium deployment all predate us. We are not asking them to adopt a new capability; we are extending one they trust from fixed cameras to the officers on foot, in the only architecture their own data-protection law comfortably permits.
2. Business opportunity¶
- The buyers are already convinced of the category. Dubai Police launched AI surveillance with facial recognition in 2018 and credited AI cameras with 319 arrests in the first year; Saudi Arabia's SDAIA and Ministry of Interior run Sawaher across 5,000+ cameras and 80 locations for Hajj; Qatar 2022 ran facial recognition across 15,000+ stadium cameras from a single command centre.
- Data-residency law now favours on-premises decisively. Saudi PDPL has been fully enforceable since September 2024 with in-Kingdom processing as the default; UAE PDPL classes biometric data as sensitive personal data with restricted cross-border transfer. Cloud face recognition is structurally disadvantaged.
- The wearable seam is open. Fixed-camera recognition is saturated with incumbents (NEC, IDEMIA, and the Chinese majors). Patrol-worn recognition has exactly one dated regional precedent — a 2019 UAE pilot of 50 smart glasses by a Dubai integrator — which proved the concept and left no current champion.
- A US$100B+ events pipeline creates hard deadlines. Expo 2030 Riyadh and the FIFA World Cup 2034 (15 stadiums, five host cities) procure security technology years ahead of opening; Hajj recurs annually as the world's largest crowd-security operation.
- Supply-chain and sourcing sensitivities cut our way. The largest surveillance vendors (Hikvision, Dahua, SenseTime, Yitu — together roughly a third of the global market) sit on the US Entity List, complicating their use on internationally exposed projects; the strongest Western challengers in wearable-adjacent recognition are Israeli-origin, a procurement complication in parts of the GCC. A neutral vendor with an on-premises architecture has a clean story.
- AR hardware finally supports all-shift wear. Sub-80-gram AR glasses make this operationally viable in a way the tethered 2018-era police glasses never were.
3. Business objectives¶
| # | Objective | Measure (12 months) |
|---|---|---|
| O-1 | Land 2 paid pilots with GCC security buyers (one government, one private estate/event) | Signed pilot agreements |
| O-2 | Convert ≥ 1 pilot into an annual licence | ARR ≥ USD 300k |
| O-3 | Establish a referenceable deployment with a named authority | Reference approved (public or private) |
| O-4 | Build the local channel required to bid at all | 2 signed integrator/reseller partners; ICV certification in the UAE; Etimad-registered partner in KSA |
| O-5 | Close the two commercial blockers | Model licensing resolved; Phase 0–1 security hardening complete |
4. Stakeholders¶
| Stakeholder | Interest |
|---|---|
| Police / security force leadership | Operational outcome, officer safety, being first with a visible capability |
| Control-room / operations command | Integration with existing command-and-control, alert quality, fleet visibility |
| Watchlist / investigations unit | Enrolment control, provenance, audit defensibility |
| IT & information security authority | Data residency, network posture, credential management, supply-chain provenance |
| Data-protection / legal function | Lawful basis, retention, human-in-the-loop, DPIA support |
| Procurement | ICV score, Etimad/SIRA compliance, TCO, local support presence |
| Private-estate security (malls, districts, stadiums) | Cost per covered officer, incident reduction, insurer posture |
| HumanityAI'd | Licence + hardware + support revenue; reference accounts; regional channel |
5. Business requirements¶
- B-1 The solution shall run entirely on customer premises with no mandatory internet egress, and shall be operable fully air-gapped.
- B-2 The customer shall own and control the watchlist outright; no HumanityAI'd-supplied, scraped or third-party face database is included, and none is required.
- B-3 Every match shall be presented to a human for verification; the system shall not take or authorise enforcement action automatically.
- B-4 The solution shall produce a complete audit trail (who searched, who matched, on which device, when) exportable for regulatory or judicial review.
- B-5 Watchlist owners shall be able to enrol, categorise and activate a person across the whole deployed fleet in under 2 minutes, unaided.
- B-6 The solution shall be deployable and recoverable by customer IT using documented single-command tooling, including unattended recovery after reboot.
- B-7 Officers shall require no more than a one-hour induction to use the glasses on shift.
- B-8 The offering shall be priced as licence + hardware + services, structured for government procurement cycles with a CAPEX-heavy option.
- B-9 The offering shall be bid-ready in each target market: ICV certification for Abu Dhabi/federal UAE tenders, a SIRA-compliant posture for Dubai private security, and an Etimad-registered local partner for Saudi government tenders.
- B-10 Recognition performance shall be measured in the customer's own environment during the pilot, and the contracted figures shall be those measured — not the reference figures.
6. Revenue model¶
| Stream | Structure | Indicative pricing |
|---|---|---|
| Software licence | Annual, per site, tiered by enrolled population and device count | USD 150k–400k / yr |
| Hardware | AR glasses fleet, on-prem GPU server, charging/provisioning station | USD 900–1,300 / glasses unit + USD 18k–30k server |
| Implementation | Site and RF survey, install, watchlist onboarding, operator and officer training | USD 50k–120k one-off |
| Support & operations | SLA tiers; optional managed enrolment and threshold-tuning service | 18–25% of licence / yr |
| Integration services | Command-and-control / VMS integration, custom alert routing | Quoted per engagement |
Pricing sits deliberately above our commercial AR products and below fixed-camera safe-city programmes: this is a mission-critical security system with a measured latency SLA, but it augments rather than replaces existing infrastructure.
7. Constraints & assumptions¶
- Model licensing must be resolved before the first paid deployment. The recognition weights derive from a research-licensed lineage; a commercial licence or replacement weights are a precondition of revenue, with vendor lead time outside our control.
- Security hardening Phase 0–1 must complete before any government deployment (credential rotation, per-device tokens, network-surface reduction, encrypted glasses transport). Roughly 4–5 engineer-weeks.
- Customer provides a dedicated 5 GHz wireless network along patrol routes with power-save disabled, plus power and rack space for one GPU server per site.
- One GPU server serves one site; the concurrent-device ceiling per GPU class is measured during the pilot rather than asserted now.
- Glasses fleet lead time 6–8 weeks; vendor SDK is isolated so the product is portable across Android-based AR platforms.
- Customer holds the lawful basis for each watchlist entry and the retention policy; we supply the controls and the audit evidence, not the legal authority.
- In Saudi Arabia, government sales require a local partner and Etimad registration; in Abu Dhabi, ICV certification materially affects tender scoring.
8. Risks¶
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Model licensing unresolved when a deal closes | Medium | High | Start the licence conversation now; qualify replacement weights in parallel; disclose the item in diligence rather than let a buyer find it |
| Long, clearance-gated government procurement | High | Medium | Pilot-first motion; private-estate and event buyers as faster parallel track; local partner from day one |
| Regulatory or reputational pushback on facial recognition | Medium | High | Lead with governance: customer-owned watchlist, no scraped data, human verification mandatory, full audit trail, DPIA support. Never pitch covert or autonomous use |
| Incumbent bundles wearable recognition into an existing safe-city contract | Medium | High | Move while the seam is open; win a named reference fast; emphasise the measured latency and on-prem depth an add-on cannot match |
| Accuracy underperforms in the customer's real conditions | Medium | High | Publish the recognition envelope honestly (5 m reliable, 6–7 m max); measure in the pilot; contract on measured figures |
| Officer acceptance / comfort over a full shift | Medium | Medium | Comfort survey in pilot; category-only display option; spare units; short-session rotation |
| Single-vendor glasses dependency | Medium | Low | SDK isolation already proven across platforms |
| Fleet breakage/loss | Medium | Low | 10% spare ratio and an insurance line in contract |
9. Proof point¶
A live 34-service production deployment runs today on a single RTX 4060 Ti: 93,728 enrolled persons, glasses-to-label recognition measured at ~68 ms typical with 0% packet loss, 14–20 effective recognition fps, and a FAISS search P95 of 8.5 ms across nearly 2,000 real searches. The same stack, deployment tooling and operator console a customer receives — including the incidents it has already survived and the fixes documented in the Technical Due-Diligence Report.