NewRAGSuite Engine: the knowledge engine for your data, run in Germany.About RAGSuite Engine
Practical guidance on data protection, the EU AI Act, works councils, self-hosting and costs. Written by the people who roll out RAGSuite with customers, for those who decide, run and review.
Sovereign AI means you can answer three questions about your own system. Where is the data, who could compel someone to hand it over, and can you check both rather than being told? A jargon-free guide for the people who decide.
Start by role
A prompt injection smuggles instructions into what an AI reads: directly in the chat or hidden in a document. What's behind it, why AI on company data is especially exposed and which five measures Germany's BSI recommends.
59 per cent of companies in Germany name lock-in effects as a barrier to switching provider. The four kinds of dependency, what the EU Data Act has required since 2025, and how to test your exit in an afternoon.
An AI hallucination is a convincingly worded answer that isn't true. Why language models hallucinate, what answers from your own documents do against it, where their limits lie, and which six rules lower the risk in everyday work.
Since 11 September 2026, manufacturers must report exploited vulnerabilities within 24 hours, and from December 2027 all duties apply. Who the Cyber Resilience Act covers, how self-hosted software and cloud services differ, and what to check when you buy.
A RAG system lets AI answer from your own documents and shows the source for every claim. This guide explains without jargon how it works, what RAG can and can't do, and what you need for a first test.
Sovereign AI means you can answer three questions about your own system. Where is the data, who could compel someone to hand it over, and can you check both rather than being told? A jargon-free guide for the people who decide.
What AI costs depends on three things: how many people use it, how much they ask and which language model answers. A worked example in euros for RAGSuite Engine and your own server, the point where a local model pays off, and what belongs in a fair comparison.
The US CLOUD Act obliges providers under US law to hand over data, even from data centres in Frankfurt. The GDPR only allows that through an international agreement. What this conflict means for your AI, who your vendor answers to, and the three ways to run it.
A data protection impact assessment is mandatory when AI is likely to pose a high risk to people. With AI on your own data that's often the case, but not always. A guide with a self-test, the German regulators' view and a checklist for your DPIA.
If you introduce AI in a German company with a works council, you almost always need it on board. When it only has to be informed, when it must agree, what goes into the works agreement on AI, and how to lead with evidence, not reassurances.
This sovereign AI blog explains what companies need to know before they use AI on their own data: where the data sits and who can access it, what the GDPR, the EU AI Act and German works council law require, what running it on your own servers costs and how answers with sources come about. Every post starts with a short answer and ends with its sources, so you can check the claims.
The posts are written by the three people who roll out RAGSuite with customers. Jürgen Pietschmann (AI Consultant, RAGSuite Lead) writes about sovereignty, strategy and costs. Mihaela Angelova (Delivery & Onboarding) writes about installation, operations and connectors. Stefan Reinhardt (Public Sector & Compliance) writes about the GDPR, the EU AI Act, works councils and tenders.
Legal topics are general information, not legal advice. We review posts regularly and show the date of the last review.
Jürgen advises companies on introducing AI on their own infrastructure and leads RAGSuite at NITSAN. He writes about sovereignty, strategy and costs.
Mihaela takes customers from installation to their first production project. She writes about operations, connectors and the cost of running AI in your own data centre.
Stefan works with customers in public administration and regulated industries. He writes about the GDPR, the EU AI Act, works councils and tenders.
Occasional, with substance: new posts on sovereign AI, data protection and the EU AI Act. No spam, unsubscribe any time.
Reading is good, seeing is better: we’ll show you RAGSuite on a setup like yours.