AI projects rarely fail on the model, but on three questions: where is the data, who may access what, and which rules apply? "Sovereign AI" at sector7 does not mean excluding public models — but placing each model in the right spot: public cloud models where they are superior (research, drafts, ideas), self-hosted models on our servers in Germany where your data demands it (execution on sensitive content). Plan in the public cloud, implement locally — steered, auditable, and compliant with both GDPR and the EU AI Act. The basis is our own infrastructure — our own server park, our own IP address space, operation in Germany — and our security practice from day-to-day business.
AI governance & EU AI Act
The entry point is rarely a model, but clarity about obligations and risks. Since August 2026 the transparency and GPAI obligations of the EU AI Act apply, with the requirements for high-risk applications following by the end of 2027. We classify what your AI use actually triggers — and anchor it in your existing compliance structure, instead of placing a second set of rules alongside it.
- Readiness and use-case assessment: which initiatives hold up and which do not yet — before investing.
- Risk classification under the EU AI Act, transparency and documentation obligations, clear responsibilities.
- Data protection and data hygiene: permissions and shares are cleaned up before an AI makes your data searchable.
- Connection to ISO 27001 and NIS-2, where these frameworks already apply at your company.
This line ties directly to our existing work on AI readiness & governance. The basis is project practice, not theory — our references include the development of a company-wide AI strategy for a municipal energy utility (KRITIS).
Secured private language models & managed RAG
The centerpiece: AI that works on your own data, without it leaving your house. We set up private knowledge bases and retrieval-augmented generation (RAG) — language models answer questions based on your documents, contracts, and knowledge holdings. This runs on self-hosted, open models in our server park in Germany; we connect public models only where the task allows it and you approve it.
The difference lies in the safeguarding. Poorly built RAG systems hand out content to users who should never see it — the most common and most expensive weakness of such projects. We build them the way we secure infrastructure: with clean permissions, access control down to the document level, logging, and a separation that withstands an audit.
- Private knowledge base and RAG on your documents — access-controlled, logged, auditable.
- Self-hosted open models in our German server park; no US models as a default.
- Connection of your systems — file storage, knowledge databases, business applications — via clearly defined, reversible interfaces.
- Clear data sovereignty: your content stays with you; no training of third-party models with your data.
AI setup & integration – public and local models in the right mix
Between "plan in the public cloud" and "implement locally" stands the steering. We set up a common access point across public and self-hosted models that routes requests according to your rules: sensitive content to the local model, uncritical tasks to the most capable suitable one — with cost and token transparency, caching of recurring requests, and traceable logs. This keeps the choice of model a decision rather than a coincidence, and a provider switch does not become a rebuild.
- One access point across multiple models, public and local — routing according to your specifications.
- Cost and token control: steering to the suitable model, budgets, and evaluation.
- Integration into your workflows and tools — built with the same agentic methods that we use ourselves.
Operation and enablement
Managed AI operations
An AI environment is not a project with an end date, but an operation: models are updated, cost and answer quality are observed, access is reviewed. On request, we take over this ongoing operation from our datacenter. We are currently building binding SLA models for this — scope and commitments we agree with you concretely in each case, rather than promising them before they hold up.
Enablement & training
The biggest hurdle is rarely the technology, but the knowledge in the team. We guide your employees on tools, limits, and sensible uses — so that a set-up AI also becomes a used one.
Our focus – and where we bring in partners
Our strength is the application: consulting, secured setup, and operation of AI on your data — on infrastructure that we own ourselves and operate in Germany. Training our own base models is deliberately not part of that; we rely on proven open and public models and bring them into use securely and appropriately. And where very large compute capacity is needed, we bring sovereign partners on board — so that you pay for results, not for unused hardware.
If you are still considering where AI really holds up in your company: at the start is a conversation, not a model. We sort the initiatives together with you — open-ended — and implement what brings benefit.
Self-checkCheck your AI readiness in ten questions