Sovereignty
Generative AI & GDPR
The GDPR (General Data Protection Regulation) governs every processing operation involving personal data. Generative AI inside a local authority often handles citizens' data, so compliance is not optional. A sovereign AI makes it easier from the design stage onwards.
Watch points
The GDPR watch points for an AI system
Legal basis & purpose
Every processing operation must rest on a legal basis (a public interest task for a local authority) and on a specified purpose. The AI assistant must have a documented scope of use.
Impact assessment (DPIA)
An innovative technology processing sensitive data on a large scale triggers the DPIA obligation (art. 35). To be carried out before going live, together with the DPO.
Right to erasure inside a RAG
In a RAG system, a document is split into vectorised fragments. Deleting the file is not enough: you need a procedure that also purges the vectors and the histories. A technical point that we industrialise.
Minimisation & retention
Process only what is necessary, and define retention periods. Our GPU instances are stateless ; minimisation and erasure must be verified for each layer, including logs and backups.
Processors (art. 28)
A clear contractual chain between the data controller, the provider and the hosting companies. EU hosting means no transfer outside the Union to be framed.
Diagram
Where your data lives inside a RAG
An indexed document is split and then vectorised into the database. Deleting the source file removes neither the vectors nor the histories: erasure (art. 17 GDPR) must purge the entire chain.
Benefits
How a sovereign AI helps
- Data hosted in the EU, under European law alone
- Minimisation by design (ephemeral model GPU server, deleted every evening)
- Documentation ready for the DPO and the DPIA
- Data pseudonymisation before sending to third-party APIs: experimental, in testing
Sources
Official sources
- Regulation (EU) 2016/679 (GDPR): full text on EUR-Lex (new window)
The official text of the general data protection regulation.
- CNIL: Artificial intelligence (new window)
Recommendations from the CNIL on AI and personal data (practical factsheets, generative AI).
- CNIL: The data protection impact assessment (DPIA) (new window)
When and how to carry out a DPIA (art. 35 GDPR).
Contact
Build compliance into your AI project
We supply the compliance documentation and support your DPO. See also the EU AI Act.
To validate
Data protection: scope and status
The pseudonymisation gateway for external APIs is experimental and in testing; it is not advertised as production-ready. The mapping table allows restoration: data remains personal and GDPR still applies. Test detection and re-identification on the actual corpus.
Responsibilities to validate
Documentation supports the controller and DPO for the actual processing. A public-interest task requires a legal basis in law and processing necessary for that task; it is not universal. A GDPR DPIA and an AI Act fundamental-rights impact assessment are distinct. Human oversight alone does not rule out high-risk classification.