The more critical AI becomes, the more privacy and security stand in the way. Most teams resolve that by quietly not using AI on their real data. We are building the other option. Residency enforced in code, personal data pseudonymized before egress, every request auditable.

Three things a DPO will ask about your AI stack, in this order: 1. Where does the data go 2. Who approved it going there 3. Show me, for this specific request, last Tuesday Most stacks answer the first. Almost none answer the third.

Someone at your company is about to be asked where your AI data goes. "A US API, probably" is not an answer. Being able to show it, per request, is. Most of the EU AI Act's obligations became applicable over the weekend. This morning is the first working day under them.

Plenty of teams will learn they run a high-risk AI system by reading Annex III, not by deciding to build one. Recruitment and candidate screening is on it. So is creditworthiness and worker management. If your product ranks applicants, that is no longer just a feature.

The EU AI Act question nobody prepares for is not "are we compliant". It is "can you show me". Those are different engineering problems. The first is a policy document. The second is a per-request record you either kept or did not.

"EU only" in most AI tools is a setting someone has to remember on every call. Nothing tells you when they forget. We made it fail closed instead. Nothing leaves the EU unless it was explicitly allowed, and the allowance is recorded against the request.

Most teams assume EU-sovereign AI means rebuilding on a different stack. It means changing a base URL. Your SDK, prompts, tool definitions and streaming code stay exactly as they are. What changes is where the request goes, and whether anything is allowed to leave the EU.

1/ Something a lot of AI vendors get wrong: pseudonymized data is still personal data under GDPR. Recital 26 is explicit about it.