Notes on sovereign enterprise AI.
Sovereignty, compliance, self-hosting and the quality loop — written by the team building RAGSuite. Proof over hype.
Sovereign AI in your pocket — now in the Community Edition
The RAGSuite mobile app is out of Beta and, from v1.1.0, included in the Community Edition. iOS and Android, signing in to your own self-hosted instance with your own account. What that changes, and the two questions it hands your IT team.
Read →Who does your AI vendor answer to? Three chains, and most buyers ask about one
Every AI vendor answers to somebody — a supervisory authority, an owner, and a government that can compel disclosure. Those are three separate chains of accountability, they can point in three different directions, and a procurement questionnaire that asks about one will tell you almost nothing about the other two.
Read →What “open core” actually means — day one, and day one thousand
Most open-core pages describe what you get when you sign. The more revealing question is what you still have after you stop paying. On this product that answer is a property of the Apache 2.0 licence rather than a promise from a vendor — and the commercial terms are published to the top of the ladder.
Read →Connecting your sources is the easy part. Deciding what to connect isn't.
SharePoint, Slack, Confluence, Google Drive and Notion now connect to RAGSuite in the open Community Edition, under Apache 2.0. Wiring one up takes minutes — which moves the hard part to where it always belonged: who is allowed to see what.
Read →Ten free tools, and how to check in thirty seconds that nothing you type into them leaves your browser
All ten tools on ragsuite.de compute in page JavaScript. Nothing you enter into one, and nothing it calculates, is sent anywhere. You do not have to take that on faith — here is how to verify it yourself in thirty seconds, and where the two boundaries of that claim honestly sit.
Read →The 11 September reporting duty — what the 24-hour form actually asks for
From 11 September 2026, makers of software sold in the EU must report actively exploited vulnerabilities and severe incidents — starting with an alert within 24 hours. The 24-hour form asks for far less than most teams assume, and the registration mechanics are where the real surprises are.
Read →Germany now has an AI supervisor — what the KI-MIG actually changes if you run AI yourself
Since 29 July 2026 the Bundesnetzagentur is the market-surveillance authority, national contact point and complaints office for the EU AI Regulation. Most coverage reports that as a handover. The ministry's own announcement says something more specific — and more useful.
Read →RAGSuite is now open source: the Community Edition is public
The RAGSuite Community Edition is public on GitHub under Apache 2.0, with an install CLI on npm. Three commands and it runs on your own infrastructure — no sales call, no trial gate, no phone-home.
Read →The exit question: what it actually takes to leave a cloud AI vendor
59% of German companies say the biggest barrier to switching cloud provider isn't price or features — it's getting the data out. So the most important thing to test about a vendor is the one nobody tests.
Read →AI you're actually allowed to use: a guide for regulated and works-council teams
Most enterprise AI projects in Germany don't fail on technology — they stall in a meeting with the works council. Five things to require of any vendor, and the parallel conversation with your data protection officer.
Read →What is RAG? A no-jargon guide for business leaders
RAG means AI that answers from your documents instead of from whatever it absorbed in training — and shows you which document each part of the answer came from. What it does, what it doesn't, and what you need to try it.
Read →Nearly nine in ten German companies can't verify their vendor's "sovereign" cloud
87% say international providers' sovereign offerings don't show enough about how data is processed and who can access it. That's a proof problem, not a vendor problem — and about ten questions fix it.
Read →Sovereign AI in plain English — what it actually means for your business
Sovereign AI comes down to three questions about your own system: where the data physically sits, who could compel someone to hand it over, and whether you can prove both. A jargon-free guide for the person who signs.
Read →The Article 50 guidelines are final — what an AI disclosure actually has to look like
Since 2 August 2026, software that talks to people has to say it is software. The Commission's final Article 50 guidelines set out who owes the disclosure, what fails it, and where the provider/deployer line falls when you self-host.
Read →Sovereign AI has two layers — and most vendors only sell you one
A sovereign model is not the same as a sovereign system. Sovereignty lives at two layers — the model and infrastructure, and the application that reads your data. Where each vendor sits, and how to get both.
Read →The Cyber Resilience Act and your AI platform
Self-hosted software is in scope of the EU Cyber Resilience Act; cloud-only AI tools generally aren't. Why that's an advantage — and how RAGSuite is built to it.
Read →What is sovereign enterprise AI? A working definition
Sovereign enterprise AI means controlling the data, the model, the runtime and the audit trail — not just the hosting region. A precise working definition.
Read →Data residency vs. data sovereignty for enterprise AI
Data residency is where your data sits; sovereignty is who controls it and who can be compelled to disclose it. Why the distinction decides your AI stack.
Read →EU AI Act, DORA and NIS2: the 2026 obligation stack
The EU AI Act, DORA and NIS2 all shape enterprise AI in 2026 — and converge on one demand: documented, auditable control. How the obligation stack fits.
Read →EU AI Act readiness: what actually changed in 2026
The Digital Omnibus moved the headline high-risk dates — but the case for sovereign, self-hosted AI didn't move with them. Here's the honest timeline.
Read →Self-hosting enterprise AI: architecture and operations
What it takes to self-host a RAG platform: the reference architecture — PostgreSQL, Redis, a vector store, optional local models — and the operations.
Read →The real total cost of self-hosted RAG vs. metered cloud
Hosted RAG stacks a per-seat fee on top of per-token metering — and both climb as you roll out. Self-hosting trades a transparent per-seat licence and your own compute against it. How to compare honestly.
Read →How citation-backed RAG works (and why it earns trust)
How retrieval-augmented generation grounds answers in your own documents and shows its sources — the pipeline, why citations build trust, and the limits.
Read →AI Search, AI Assistant & AI Connectors: the RAGSuite triad
How RAGSuite's three parts fit: AI Search for citation-backed answers, an AI Assistant for grounded chat, and AI Connectors to bring your knowledge in.
Read →The US CLOUD Act and your AI vendor: what DACH buyers should ask
The US CLOUD Act lets US authorities compel US-based providers to disclose data — wherever it's stored, including EU regions. What DACH buyers should ask.
Read →No phone-home: how to verify an AI platform isn't calling out
"No phone-home" is a claim you can test, not just trust. How to verify a self-hosted AI platform makes no outbound connections — at the network layer.
Read →DSGVO by design for RAG: Articles 5, 25 and 32 in practice
How a self-hosted RAG platform maps to DSGVO Articles 5, 25 and 32 — data protection by design in practice, and where the work still sits with you.
Read →Why self-host your RAG platform
Hosted RAG is fast to start and someone else's to run. For a regulated enterprise, the trade you're really making is control. Here's the case for keeping it.
Read →Do you need a DPIA for your RAG deployment? A decision guide
A DPIA is required when processing is likely to result in a high risk to individuals. A practical guide to deciding whether your RAG deployment needs one.
Read →AI and the Betriebsrat: getting works-council sign-off
In German companies a works council has a real say over AI tools. Why sovereign, self-hosted AI is easier to get past the Betriebsrat — and how to prepare.
Read →Air-gapped AI: running RAGSuite offline with local models
An air-gapped deployment has no path to the outside world. How a RAG platform runs fully offline — local models, offline licensing, no phone-home.
Read →Choosing an LLM for regulated RAG: hosted vs. local
OpenAI, Anthropic, Mistral, Gemini or local Ollama: the right model for regulated RAG depends on data, quality and cost. A framework for deciding per project.
Read →The quality loop: how to measure and improve enterprise RAG
Grounding cuts hallucinations, but quality is measured, not assumed. The quality loop — feedback, Compare Models and deep query tracing — is how you do it.
Read →Self-hosted vs. hosted RAG: a sovereignty-first comparison
Hosted RAG starts fastest; self-hosted RAG keeps control. A side-by-side across data, cost, compliance and operations — and when each one wins.
Read →Introducing RAGSuite: the sovereign enterprise AI platform
RAGSuite is a self-hosted, citation-backed AI platform: AI Search, AI Assistant and AI Connectors across your documents and apps. Open core, DSGVO by design.
Read →No posts in this category yet.