Sovereign AI
Sovereign AI for Italian and European organisations in regulated sectors
Sovereign AI does not just mean “everything on-premise”. It means the organisation keeps control of three things: the jurisdiction its data is subject to; the operational governance of the system — who can change the model, the filters and the terms, and with how much notice; and the replaceability of its components, which is what makes the first two enforceable rather than merely contractual. Under the Italian and European regulatory framework of 2025-2026 this is not a technology preference: it is the condition for being able to demonstrate what the rules require.
The EU AI Act (in force since August 2024, with obligations phasing in up to 2028), the GDPR, the NIS2 Directive and Law 132/2025 — Italy's first comprehensive national AI law — together create a framework in which organisations in healthcare, pharmaceuticals, finance and public administration must demonstrate effective control over their AI systems: where the data resides, how it is processed, who has access, and how model outputs are governed.
For mid-market organisations in Italy, that is a specific challenge. Large enterprises can invest in in-house teams and proprietary infrastructure. Start-ups can accept the cloud risk. The mid-market — hospitals, pharmacy chains, regional pharmaceutical companies, utilities — needs a platform that is enterprise-grade yet affordable, sovereign yet manageable.
Nexus MDS Core is the platform built specifically for that segment. 27 containerised services — local LLM inference, RAG pipelines, Zero-Trust authentication, a workflow engine, an audit of every model call — on Docker, on-premise or on sovereign EU infrastructure, moving to Kubernetes when scale calls for it. Generation runs on a local model or on a replaceable EU endpoint. Designed for healthcare and pharma, built around the requirements of the AI Act, with GDPR controls mapped and data resident in the EU.
Dynamics Consulting works with mid-market organisations in Italy on sovereign AI. Unlike generalist system integrators, our focus is on-premise AI infrastructure for regulated sectors. Every project is led directly by the founder, Corrado Patierno, who has more than 25 years of experience in enterprise systems.
Three models, not one
On its own, “sovereign” has become a marketing term. This is the taxonomy used throughout this site, and the first thing a project has to decide is which of the three it actually needs — and what it gives up in each case.
- Fully local AI
- Indexing, retrieval, identity, audit and generation all run on the organisation's own infrastructure. Maximum sovereignty, maximum hardware cost, model choice limited to what can be hosted.
- Hybrid sovereign AI
- Data, retrieval, reconciliation, identity and audit stay local; only final generation calls an external inference endpoint, under policy and replaceable without redesigning the system. It is the model in production at Federfarma Lombarda.
- Private EU inference
- Inference on private or EU-resident infrastructure, with residency, retention and access terms defined explicitly. Suitable when the constraint is jurisdiction rather than physical custody of the hardware.
One consequence is worth stating plainly: the honest description of a hybrid system is not “everything on-premise”, nor “the data never leaves the perimeter” — the retrieved context does leave, and that is exactly why personal data must not enter the index. The long version of this distinction is in private AI vs sovereign AI.
Frequently asked questions
Does sovereign AI have to mean everything on-premise?
No. It means control over jurisdiction, operational governance and the replaceability of components. A system in which data, retrieval, identity and audit stay local, and only the final generation step goes through a replaceable external endpoint, is sovereign in the sense that matters — provided that boundary is declared and personal data does not cross it.
What hardware do you need to get started?
Less than you might think, if the use case is document-centred. The system in production at Federfarma Lombarda runs its local model, privacy filter and embeddings on a single 8 GB GPU; the same architecture, unchanged, runs on 48 GB cards when final generation also has to come in-house. Sizing is decided after the retrieval design, not before.
Does Dynamics Consulting certify the system’s compliance?
No, and nobody can: conformity is established through the procedures the regulation itself provides for. What we deliver is a signed document on what is in place, what is missing and in what order to close the gap — together with the architecture that carries those controls.
Where is the best place to start?
With an exposure assessment: understanding where your supplier’s responsibility stops and yours begins, before choosing the platform. It is a fixed-scope, fixed-price engagement with a signed deliverable.
Further reading
- Nexus MDS Core — the platform, service by service.
- AI governance and compliance advisory — the regulatory framing of the system, and an architecture that carries the obligations.
- On-premise AI for healthcare — the healthcare vertical.
- Law 132/2025 and AI in healthcare — what Italy's AI law changes, in practice.
- Compliance-Epistemic Project Framework (CEPF) — the catalogue of regulatory overlaps that the governance side runs on.
Where does your supplier’s liability stop, and yours begin?
The revised European product liability directive includes software among products, and applies to products placed on the market or put into service from 9 December 2026. The exposure assessment establishes, for your organisation, where the boundary sits.
Exposure assessment →