Book a 15-minute call
Learn
Blog and guidesToolsDev PlaygroundTemplatesFAQRegulation
Hardware Developers
For business
Local AI consultingEU AI Act: guide and templatesAI in your businessGrantsPublic sector
About
AboutPress
Contact Español
For public administrations

Sovereign AI, inside your network

A node with open-weight models that runs on your premises and can work with no internet connection. We design it so your team can assess it against ENS, GDPR and the EU AI Act.

Book a 15-minute call What a pilot looks like

In short

  • Data and models stay in your data centre. The node needs no route to the internet to work.
  • We start with a single-case pilot, measured on your tasks. It is quoted by scope, before we start.
  • The ENS category, the impact assessments and the final decision belong to your body. We supply the technical documentation.

The frame, in three laws

What each one says about an AI system in a public body, with the article and a link to the official text (checked 2026-10-06).

National Security Framework (ENS)

Royal Decree 311/2022 of 3 May

  • It applies to the whole public sector and to the companies that provide it with services or solutions (Art. 2).
  • Each system has a BASIC, MEDIUM or HIGH category (Art. 40 and Annex I). Your body sets it, not the supplier.
  • Conformity is shown by a certification body or a self-assessment, depending on the category (Art. 38).

GDPR

Regulation (EU) 2016/679

  • If the node processes personal data, your body remains the controller.
  • If we access the system, we sign a processor agreement (Art. 28).
  • When the processing requires it, the impact assessment (Art. 35) comes first. We give you the technical description it needs.

EU AI Act

Regulation (EU) 2024/1689

  • A public body using an AI system is a "deployer": its obligations are in Art. 26.
  • Bodies governed by public law carry out a fundamental rights impact assessment before deploying certain high-risk systems (Art. 27).
  • Staff using the system need AI literacy (Art. 4). In Spain, AESIA supervises (Royal Decree 729/2023).

The AI Act application dates, as amended by the Digital Omnibus, are in our AI Act guide. The official Spanish guidance is published by AESIA.

How an isolated node works

Isolated (air-gapped) means the node has no route to the internet. The desktops on your network talk to it; it talks to nobody outside.

Architecture of a sovereign AI node Inside your network: Desktops, Records, Intranet connected to an edge node on your premises that runs the language model, vision and speech on its GPU. Outside the network, the cloud: the link to it is cut at the perimeter, 0 data out. Your network Your users and systems Desktops Records Intranet Edge node on your premises Language model Vision Speech GPU models loaded Cloud 0 data out

What goes in and what comes out

  • Models come in once, on controlled media, and are checked against their SHA-256 hash before loading.
  • Updates follow the same path. Nothing downloads itself.
  • Prompts, documents and usage logs stay on the node. You decide how long they are kept.
  • If remote support is needed, it goes through the channel your body authorises and is closed afterwards.

The layers of the node

All the software is open and documented. Your security officer can review each layer against the ENS measures that apply to the system’s category.

It is the same stack we run every day on our two NVIDIA DGX Sparks. What we publish as measured came from there: how we test.

Layers of an isolated AI node Top to bottom: application, open-weight models, inference runtime, system and logs, hardware. All inside a perimeter with no route to the internet. No route out Application Internal chat, search over yourdocuments, drafts Open-weight models Weights copied once and checkedagainst their hash Inference runtime Ollama or vLLM, no outbound calls System and logs Encrypted disk, logs that stayin-house Hardware A GPU server in your data centre

What a pilot looks like

Four steps. You know what happens in each one before it does.

  1. A 15-minute call

    You tell us the service and the problem. We tell you whether a local node makes sense, or not.

  2. One case, in writing

    A single use case, with test or anonymised data and success criteria you can measure.

  3. An isolated pilot

    The node runs on your premises with no route to the internet. We measure quality, latency and memory on your tasks.

  4. Report and decision

    Measured results and the technical documentation for ENS, GDPR and the AI Act. You decide to continue, change course or stop.

What we deliver

  • The node installed and running the agreed case.
  • A table of what we measured: model, hardware, latency, memory and date.
  • The technical description for your risk analysis, your impact assessment and your record of processing.
  • Training for the people who will use it (Art. 4 of the AI Act).

When not to do this

  • If the case needs the largest model on the market. An open model on one server gets a lot right, not everything.
  • If nobody in your body will own the node after the pilot.
  • If a cloud service already certified at the ENS category you need solves the case. Sometimes that is the right call, and we will say so.

How it is procured

Your contracting authority decides how to procure, based on the subject and the estimated value. These are the routes in Spain’s Public Sector Contracts Act (Ley 9/2017) that usually fit a pilot (checked 2026-10-06):

  • Minor contract (Art. 118). Article 118.1 sets the limit: an estimated value below 15,000 euros for services or supplies. It requires a report from the contracting authority justifying the need.
  • Simplified open procedure (Art. 159) or another procedure in Art. 131, when the pilot or the later roll-out goes above that limit.

If you plan a tender, mind Art. 70: if we help you prepare the technical specifications, the contracting authority must make sure that does not distort competition. We raise it at the start so your file stays clean.

Each pilot is quoted by scope, in writing and before we start. We do not publish rates.

Model technical specification: sovereign AI node (draft, in Spanish)

A template to adapt: ENS category, GDPR Art. 28 processor terms, the AI Act deployer duties, isolation, acceptance tests and handover. Each requirement cites its law. Using it does not tie you to any supplier.

Download the template (Markdown)

Let’s talk for 15 minutes

Tell us the service and the problem. We tell you whether a local node makes sense for your body, or not.

Book a 15-minute call

Sources (checked 2026-10-06)

This page explains the frame; it is not legal advice. Written by Jacobo González Jaspe, J4SGON S.L., Valencia.