A decade of automationsin regulated work.
XY Space builds and runs AI systems inside operations where a wrong answer is a compliance event. Healthcare, insurance, legal operations, and the regulated end of professional services, which between them are where both principals spent the ten years before anyone was calling any of it AI.
The people who scope itare the people who build it.
Cho Yin Yong
Principal, engineering and governance
A University of Toronto lecturer, the youngest his department has promoted, still teaching Engineering Large Software Systems. Co-author of two AI patents, with nine years of regulated engineering leadership scaling a company from its third employee to eighty. He is the one in the room when your security and architecture people want to take the design apart.
Mahmoud Halat
Principal, delivery and measurement
A Master of Health Informatics graduate and employee two at Verto Health through to a team of eighty, on the platform behind roughly a quarter of Canada's daily COVID vaccinations. Holder of a patent in data ingestion and harmonization, a guest lecturer at Toronto, and winner of the $100k Lovable Shipped 2025 grand prize against 5,800 builders.
Nothing here dependson remembering to do it.
The method is written down
The engagement lifecycle, the measurement discipline, the people track, and how candidates get found are all documented rather than improvised. Any operator on our side reads the same thing before they touch your work.
Every stage has a go or kill gate
Nothing proceeds on enthusiasm. A baseline gets signed before a build starts, a slice runs on your real data before a scope gets fixed, and a job runs under full review before it earns any autonomy.
The paperwork exists before you ask
Data flow, access tiers, residency, sub-processors, DPA, revocation path, and a hash-chained audit trail you can export. Your procurement team gets a pack rather than a promise to write one.
We stay on the work
The people who scoped it are the people who build it and the people who answer the phone in month nine. That is a seniority commitment, and it is one the large firms cannot make because their economics depend on juniors doing the delivery.
North Stack
In the United Kingdom we partner with North Stack to bring auditable, human-in-the-loop AI to FCA-regulated insurance operations. They know the regulatory ground, we build the systems, and the client deals with one accountable engagement rather than two suppliers pointing at each other.
University of Toronto
Both principals teach there, one as a lecturer in the engineering faculty and one as a guest lecturer. It keeps the practice honest about what is actually new versus what is being marketed as new, which matters when you are the one deciding what to put in front of a regulator.
Book a discovery call.Leave with a plan you can act on.
Start with your people or with the work. One job at a time, on probation, measured in hours and money. Everything we build stays yours.