Notes on sovereign enterprise AI.
Sovereignty, compliance, self-hosting and the quality loop — written by the team building RAGSuite. Proof over hype.
The exit question: what it actually takes to leave a cloud AI vendor
59% of German companies say the biggest barrier to switching cloud provider isn't price or features — it's getting the data out. So the most important thing to test about a vendor is the one nobody tests.
Read →AI you're actually allowed to use: a guide for regulated and works-council teams
Most enterprise AI projects in Germany don't fail on technology — they stall in a meeting with the works council. Five things to require of any vendor, and the parallel conversation with your data protection officer.
Read →What is RAG? A no-jargon guide for business leaders
RAG means AI that answers from your documents instead of from whatever it absorbed in training — and shows you which document each part of the answer came from. What it does, what it doesn't, and what you need to try it.
Read →Nearly nine in ten German companies can't verify their vendor's "sovereign" cloud
87% say international providers' sovereign offerings don't show enough about how data is processed and who can access it. That's a proof problem, not a vendor problem — and about ten questions fix it.
Read →Sovereign AI in plain English — what it actually means for your business
Sovereign AI comes down to three questions about your own system: where the data physically sits, who could compel someone to hand it over, and whether you can prove both. A jargon-free guide for the person who signs.
Read →The Article 50 guidelines are final — what an AI disclosure actually has to look like
Since 2 August 2026, software that talks to people has to say it is software. The Commission's final Article 50 guidelines set out who owes the disclosure, what fails it, and where the provider/deployer line falls when you self-host.
Read →Sovereign AI has two layers — and most vendors only sell you one
A sovereign model is not the same as a sovereign system. Sovereignty lives at two layers — the model and infrastructure, and the application that reads your data. Where each vendor sits, and how to get both.
Read →The Cyber Resilience Act and your AI platform
Self-hosted software is in scope of the EU Cyber Resilience Act; cloud-only AI tools generally aren't. Why that's an advantage — and how RAGSuite is built to it.
Read →What is sovereign enterprise AI? A working definition
Sovereign enterprise AI means controlling the data, the model, the runtime and the audit trail — not just the hosting region. A precise working definition.
Read →Data residency vs. data sovereignty for enterprise AI
Data residency is where your data sits; sovereignty is who controls it and who can be compelled to disclose it. Why the distinction decides your AI stack.
Read →EU AI Act, DORA and NIS2: the 2026 obligation stack
The EU AI Act, DORA and NIS2 all shape enterprise AI in 2026 — and converge on one demand: documented, auditable control. How the obligation stack fits.
Read →EU AI Act readiness: what actually changed in 2026
The Digital Omnibus moved the headline high-risk dates — but the case for sovereign, self-hosted AI didn't move with them. Here's the honest timeline.
Read →Self-hosting enterprise AI: architecture and operations
What it takes to self-host a RAG platform: the reference architecture — PostgreSQL, Redis, a vector store, optional local models — and the operations.
Read →The real total cost of self-hosted RAG vs. metered cloud
Hosted RAG stacks a per-seat fee on top of per-token metering — and both climb as you roll out. Self-hosting trades a transparent per-seat licence and your own compute against it. How to compare honestly.
Read →How citation-backed RAG works (and why it earns trust)
How retrieval-augmented generation grounds answers in your own documents and shows its sources — the pipeline, why citations build trust, and the limits.
Read →AI Search, AI Assistant & AI Connectors: the RAGSuite triad
How RAGSuite's three parts fit: AI Search for citation-backed answers, an AI Assistant for grounded chat, and AI Connectors to bring your knowledge in.
Read →The US CLOUD Act and your AI vendor: what DACH buyers should ask
The US CLOUD Act lets US authorities compel US-based providers to disclose data — wherever it's stored, including EU regions. What DACH buyers should ask.
Read →No phone-home: how to verify an AI platform isn't calling out
"No phone-home" is a claim you can test, not just trust. How to verify a self-hosted AI platform makes no outbound connections — at the network layer.
Read →DSGVO by design for RAG: Articles 5, 25 and 32 in practice
How a self-hosted RAG platform maps to DSGVO Articles 5, 25 and 32 — data protection by design in practice, and where the work still sits with you.
Read →Why self-host your RAG platform
Hosted RAG is fast to start and someone else's to run. For a regulated enterprise, the trade you're really making is control. Here's the case for keeping it.
Read →Do you need a DPIA for your RAG deployment? A decision guide
A DPIA is required when processing is likely to result in a high risk to individuals. A practical guide to deciding whether your RAG deployment needs one.
Read →AI and the Betriebsrat: getting works-council sign-off
In German companies a works council has a real say over AI tools. Why sovereign, self-hosted AI is easier to get past the Betriebsrat — and how to prepare.
Read →Air-gapped AI: running RAGSuite offline with local models
An air-gapped deployment has no path to the outside world. How a RAG platform runs fully offline — local models, offline licensing, no phone-home.
Read →Choosing an LLM for regulated RAG: hosted vs. local
OpenAI, Anthropic, Mistral, Gemini or local Ollama: the right model for regulated RAG depends on data, quality and cost. A framework for deciding per project.
Read →The quality loop: how to measure and improve enterprise RAG
Grounding cuts hallucinations, but quality is measured, not assumed. The quality loop — feedback, Compare Models and deep query tracing — is how you do it.
Read →Self-hosted vs. hosted RAG: a sovereignty-first comparison
Hosted RAG starts fastest; self-hosted RAG keeps control. A side-by-side across data, cost, compliance and operations — and when each one wins.
Read →Introducing RAGSuite: the sovereign enterprise AI platform
RAGSuite is a self-hosted, citation-backed AI platform: AI Search, AI Assistant and AI Connectors across your documents and apps. Open core, DSGVO by design.
Read →No posts in this category yet.