industries · Public sector
Public-sector AI on European infrastructure, on-premise if needed, with zero logs: citizen data never travels to a foreign hyperscaler. Sovereignty by default, co-official languages included.
compliance
Every regulatory demand mapped to a platform capability that ships built in, with nothing to configure.
ENS
Royal Decree 311/2022 · basic / medium / high categories
RequiresSecurity measures scaled by category, with external certification every two years for medium and high systems.
HelmcodeAn auditable EU stack with documented data flows and an on-premise option that fits the category your system requires.
GDPR
Regulation (EU) 2016/679
RequiresCitizen data demands minimization, confidentiality and control over transfers.
HelmcodeZero logs by architecture and EU-only inference; on-premise for the most sensitive registries.
Sovereignty
EU-owned and operated infrastructure
RequiresCitizen data cannot realistically sit on hyperscalers subject to the US Cloud Act.
HelmcodeOpen weights run on European infrastructure or on-premise, outside the reach of foreign jurisdiction.
This page is an informational overview, not legal advice. For your obligations and the risk classification of each system, consult qualified legal counsel. AI Act Guide →
what the ENS actually says
The ENS governs any information system serving a Spanish public administration, and it reaches the suppliers too. Reading it closely pays off in both directions: parts of it are stricter than people expect, and one thing everybody attributes to it is not in there.
01
Conformity travels down the chain
Article 2.3 brings private entities serving an administration inside the ENS, requires contracts to demand conformity of the information systems, and extends that to the supplier’s own supply chain as the risk analysis calls for it. Your inference provider falls within the scope of the rule.
02
Media and alta get audited
Only básica systems may declare their own conformity. Article 38 sends media and alta through certification by audit, which means somebody reads how the whole system works, inference layer included. A component you cannot describe turns into a finding.
03
On-premise is a foreseen category
Article 30.4 says the technical instructions or the CCN-STIC guides will set the conditions for local-mode implementations of products and services originally provided in the cloud, and how those are evaluated and audited. Running it in your own datacentre is a contemplated route with its own rules.
04
What the ENS does not say
It does not require the system to run in Spain or in the EU: there is no general territoriality clause. Sovereignty is a decision you take and justify in procurement and in policy, because the ENS does not impose it. If a vendor puts it to you as an ENS requirement, ask them for the article.
CCN · Centro Criptológico Nacional (CNI) Royal Decree 311/2022 of 3 May, on the National Security Framework: Articles 2.3, 30.4 and 38. The framework is completed by the technical security instructions and the CCN-STIC guides, which the CCN issues per technology, among them CCN-STIC 884D on the secure configuration of AI services for category alta, updated in July 2024. read the report →
the day to day
Behind every use case there is a morning of work in a registry, a secretariat or a finance department. This is the route a case file takes and what an open model does at each stage. Everything that follows produces drafts and proposals: the decision and the signature stay with the civil servant.
An application comes in through the electronic register. The model classifies the type of procedure, extracts the applicant, the subject and the references, and proposes the department it should go to. The civil servant confirms in seconds what used to be typed by hand. It is the most repetitive task in the building and the cheapest one to automate.
The case officer asks the regulation instead of searching it: what hours the terrace bylaw sets, what deposit the one on occupying public highway asks for. Answers with the article cited, over the bylaws, the planning rules and the regulations of that same body. For reports that need precedent, the synthesis arrives with every claim referenced.
From three facts (a water cut, the street, the hours) come the formal public notice, the note for the website and the short alert for social media or WhatsApp, in an institutional register and in plain language. In territories with a co-official language, all of it comes out in both, in the same pass.
Before a resolution goes up on the notice board or the transparency portal, or a file is shared with another administration, personal data is redacted systematically. The raw version does not leave the perimeter.
The audio from plenaries, governing boards and contracting committees is transcribed, and the model structures a draft of the minutes with the interventions and the agreements. The secretary reviews instead of transcribing. That is hours per session, and they are usually the hours of the busiest person in the building.
The first stage, classifying what arrives at the registry, is the textbook process with volume and stable criteria: the natural candidate to become a small, specialized model running on your own infrastructure.
use cases
The cases with the most traction in the sector, each with its own page in detail.
A starting point per task type. The full guide maps 80 cases to the open model for each one.
We are distilling and quantizing these open models into small, tightly specialised versions, trained for one task rather than for all of them. A model like that runs on less hardware, answers faster and fits where the big one does not, your own datacenter included. If you have a process with volume and stable criteria, that is the conversation we want to have with you.
A process with volume and stable criteria can become a small, specialized model with the weights in your name, running on far less hardware. model_specialization →
// faq
What the sector's technical, compliance and business teams ask.
The ENS (Royal Decree 311/2022) scales security measures by category (basic, medium, high), with external certification every two years for medium and high. An auditable EU stack with documented data flows, and an on-premise option, is built to fit the category your system needs; the formal certification of each system is carried out by your organisation with an accredited entity.
Not unless you allow it. The default is EU-only inference with zero logs; on-premise runs the same models and API inside your own datacenter, so citizen data never leaves your perimeter.
Yes. Qwen 3.6 is the strongest open model for Spanish and handles co-official languages well, run privately at volume, without sending public content to a foreign API.
Because citizen data processed on infrastructure subject to the US Cloud Act sits outside European sovereignty. Open weights run on EU infrastructure or on-premise keep the data and the jurisdiction European.
The API is OpenAI-compatible: change the base URL and the key and existing SDKs and tools keep working unchanged.
No. Models classify, extract, draft and propose; a person signs the resolution. Automated administrative action does exist as a legal figure, with its regime in Article 41 of Ley 40/2015: it requires designating the body responsible for specifying, supervising and auditing the system, and answering for it when the decision is challenged. A model called over an API does not meet that regime on its own. What we propose to public administration is automatic drafts, human decisions and a trail of who validated what.
The flat rate gives the finance department what it needs to process: a price that is certain and can be budgeted. A pilot fits in a minor services contract, up to 15,000 euros before VAT and one year maximum (Article 118 of Ley 9/2017, the public procurement act), with no need to estimate token consumption in advance. To move into production, the usual routes are a tender or aggregated purchasing through provincial councils and central purchasing bodies, where a fixed cost is easier to justify in the budget report than a variable invoice.
// get started
Skip the AI infra work. Deploy your first private inference endpoint today.
Flat rate. EU data. OpenAI API compatible.
// cookies
We only use strictly necessary cookies to run the site. No analytics, no advertising, ever — see our Cookie Policy.
// preferences