ES Technical meeting
Menu
WP — Technical whitepaper
46 pages EN August 11, 2026

Security, governance and sovereignty in the age of AI

What the European framework requires, why it requires it, and what to consider before deploying AI in your organisation

46 pages
7 sections
EN language
PDF format
Authorship
Toni Pérez Co-founder · Engineer
Eudald Arranz Tresserra Co-founder · Engineer
Cristian Corredor López Co-founder · Engineer
EXECUTIVE SUMMARY

The central idea, before the detail.

Six European regulations apply to an enterprise AI deployment, and most of them ask for the same things in different words. This manual reduces them to four common questions and explains what each one requires, of whom and from when. It covers the four layers of data sovereignty. A shared reference for executives, business, technology and legal teams.

WHAT YOU WILL FIND INSIDE

7 sections · 46 pages of technical detail.

  1. 0 How to use this manual Who it is for, the minimum route for each profile, and what it is not: neither legal advice nor a certification checklist. page 3
  2. 1 What changes with AI Why an agent breaks the assumptions of security designed for people, why it is worth solving now, and who the company answers to. page 4
  3. 2 The European regulatory framework GDPR, the EU AI Act, DORA, NIS2, ENS and the Data Act reduced to four common questions, and what ISO standards and SOC 2 are and are not for. page 12
  4. 3 Sovereignty and what it implies The four layers of sovereignty (data, operation, jurisdiction and technology), what a provider can guarantee, and how to estimate exit cost. page 22
  5. 4 Governing an AI deployment The four decisions before a deployment (inventory, determine the role, classify the risk and assess the impact) and the management of providers, components and models. page 28
  6. 5 Recommended architecture The difference between filters and access controls, the four dimensions authorization must evaluate, and what must be recorded on every access. page 32
  7. 6 Getting started: sovereign, accountable and secure The difference between claiming, complying and proving, four maturity levels, and a plan for the first 90 days. page 38
  8. 7 Appendices Glossary, EU AI Act application calendar, questionnaire for assessing an AI provider, and sources. page 41

Frequently asked questions

Which European regulations affect an AI deployment in a company?
Six main ones. GDPR and the EU AI Act apply to every company. DORA applies to the financial sector and its technology providers, NIS2 to essential and important sectors, and ENS to the Spanish public sector and those who serve it. The Data Act regulates, among other things, switching providers. ISO standards and SOC 2 are voluntary standards, not laws.
What are the four questions common to all those regulations?
Whose data it is and what it can be used for; who answers for what; what happens when the system fails; and whether you can prove it tomorrow. The manual recommends organizing the work by capability (access logging, inventory, providers, incidents and continuity) rather than opening one project per regulation.
What changes in security when the one querying the data is an AI agent?
Three things: volume (it reads in seconds what a person reads in an afternoon), separation (it crosses systems that used to be compartmentalized) and predictability (it decides for itself which steps to take). The problem is not in the model, but at the moment the data leaves where it lives. That is why the control that keeps working is governance of the data itself.
Is the EU AI Act a "GDPR for AI"?
No. GDPR protects personal data. The EU AI Act follows product-safety logic: it classifies systems by the harm they can cause (unacceptable, high, transparency and minimal risk) and applies even when no personal data is involved. Obligations depend on the role: provider or deployer. Both regulations apply at the same time.
What does the EU AI Act require of a company using AI without high-risk systems?
Three obligations: not engaging in prohibited practices, such as recognizing the emotions of employees or candidates; ensuring AI literacy among its staff; and meeting transparency duties, that is, informing people when they interact with an AI system and marking synthetic content. It is also wise to document the role and risk classification of each system.
Is hosting data in Europe enough to make it sovereign?
No. Sovereignty has four layers: where the data resides, who has technical access, which law the provider and its parent company answer to, and what it would cost to leave. Legal obligations follow the company, not the server: the CLOUD Act obliges providers subject to US jurisdiction to hand over data under their control, wherever it is stored.
What is the difference between a guardrail and an access control?
A guardrail is a filter or an instruction: it acts on language, once the data has already reached the model. An access control is a decision point in the data's path: if the request is not authorized, the data is not delivered. To be solid it must deny by default, not serve data if it fails, and be the only path to the data.
What should authorization evaluate for an AI agent?
Four dimensions: identity (who is asking, including the person on whose behalf the agent acts), purpose (what for), entity (about whom) and field (which attribute). Purpose is what makes it possible to apply GDPR's purpose limitation, and it requires designing bounded agents, each with its declared purpose.
Where should a company start governing AI?
The manual proposes 90 days. Days 1 to 30: inventory the AI systems, determine the role and classify the risk of each. Days 31 to 60: fix what is already enforceable and review the most critical providers. Days 61 to 90: build traceability of data access and approve a first deployment through the full process.
What does the manual include, and who is it for?
It is 46 pages in six parts and four appendices: glossary, EU AI Act calendar, a questionnaire for assessing an AI provider, and sources. It is aimed at executives and business, legal and compliance, technology and security teams, with no prior knowledge required. It is not legal advice or a certification checklist.

A detailed guide to understanding the European framework

We ask for minimal context. We process it in accordance with the GDPR.

Controller: OPENDOME, S.L. · Purpose: to handle your request and get the document to you; if you authorise it, to contact you and send you content. Legal basis: performance of your request and, for later sends, your consent. Retention: until you ask for erasure or withdraw your consent. Rights of access, rectification, erasure, restriction, portability and objection in the privacy policy. The form is processed on our own infrastructure hosted in the European Union and sets no cookies.