Explainer
AI and GDPR
Why data residency, auditability, and keeping inference inside your perimeter make sovereign AI the cleaner path to GDPR compliance.
By James Drayson
In short
GDPR-compliant AI keeps personal data inside the jurisdiction and perimeter where it is permitted to live, avoids cross-border transfers to third-party model providers, and preserves the auditability regulators expect, which is exactly what sovereign, on-prem AI is designed to do.
Where external APIs create GDPR friction
- Cross-border transfer: Sending prompts and documents to a model hosted in another region can trigger international data-transfer obligations.
- Loss of control: Once data leaves your perimeter, you depend on a third party's processing terms and sub-processors.
- Auditability gaps: Opaque hosted models make it harder to evidence exactly how personal data was processed.
How sovereign AI helps
- Data stays onshore: Training and inference run inside your perimeter and jurisdiction, so personal data doesn't leave.
- You hold the records: Owning the weights and training data gives you the traceability to answer data-subject and regulator requests.
- Documented deployments: Locai Labs is ISO 27001 certified and can provide security and DPA documentation for procurement.
What this looks like with Locai
Compliance is far easier to evidence when the machine, the model and the logs are all things you own, not things a vendor describes in a whitepaper.
Locai Labs builds Locai One, an on-prem AI appliance. It is one machine that arrives with everything already in it: the hardware, our open-weight Locai Juno models, and Locai OS, the operating system that serves the models and handles users, access and monitoring. You plug it into a mains socket and your network, and your team is working in about 15 minutes. No cloud account, no per-token bill, and nothing leaving the building.
The reason a data-centre-class model fits in a box on your floor is SPACE, our compression algorithm. Instead of asking how much of a model can be cut while keeping it broadly similar, SPACE asks what the model needs to be good at, preserves the subnetworks behind those capabilities and strips back the rest. The result is a smaller specialist rather than a shrunken generalist, tuned to the exact hardware it ships on.
Locai One starts at £29,950 for a team, and Locai One Pro at £49,950 for an organisation, bought once and owned outright. Both run air-cooled on standard mains power and work fully air-gapped. Any compatible open-weight model runs alongside Juno, and if you need a model trained on your own proprietary data we can post-train one and deploy it on the same machine.
Frequently asked questions
Does using AI automatically breach GDPR?
No, but how you deploy it matters. Sending personal data to an external model provider raises transfer and processing questions; keeping inference inside your perimeter with a model you own avoids most of them.
Is on-prem AI required for GDPR?
Not strictly, but on-prem, air-gapped, or sovereign-cloud deployment is the most direct way to guarantee residency and control of personal data.
Can Locai support our compliance process?
Yes. Locai Labs is ISO 27001 certified and can provide security documentation, technical architecture detail, and DPA support.
Book a sovereign AI briefing
A 30-minute session on owning your model: deployment options, the data path, and a clear cost range for your use case.