Trustworthy AI. From day one.
We build AI that can be reviewed, controlled and owned. Here we describe where your data is, who makes the decisions and how we relate to laws such as the AI Act and GDPR.
Last reviewed October 2026. This is guidance, not legal advice.
Your data. Where it is and who can reach it.
The first thing a CEO usually asks is where the information goes. The answer should be simple and written into the agreement.
- Hosted in Sweden or with you
We host in our own environment in Linköping or in your existing environment. You choose.
- Data does not leave the EU without an agreement
If a service outside the EU is needed we describe it. It is only used once you have approved it in writing.
- The models are not trained on your data
We choose AI providers that do not train their models on what you send in and write it into the agreement.
- As little data as possible to the model
The agent only gets what it needs for the task. Personal data that is not needed is removed before anything is sent.
- Everything the agents do is logged
Which data was read, which proposal was made and who approved it. You own the log.
Agents propose. People decide.
In everything that affects customers, money or people, a person makes the decision. The agents do the groundwork so that the decision is faster and better informed.
Reads the case, gathers material and writes a proposal with sources.
Reviews the proposal, changes it if needed and approves or rejects it.
Every decision is saved with material and name, so that it can be followed afterwards.
Security in every delivery. This is what we do.
No promises of zero risk. Instead, routines that run every time, automatically, before anything reaches production.
- Security review of all code
Against OWASP ASVS 5.0 and the OWASP Top 10. Findings of high severity stop the delivery.
- Code review before every merge
No change goes into the main branch without review and approval.
- Vulnerability scanning that stops the build
Containers are scanned with Trivy and dependencies with pnpm audit. Critical findings stop the build automatically.
- Secrets never in the code
Keys and passwords live in the environment where the solution runs, never in the source code or in chats.
- Least privilege
Both people and agents only get the access the task requires.
- Backup and monitoring
Nightly backups and monitoring with alerts when something deviates.
The AI Act, explained simply.
The EU AI Act applies in stages and the requirements depend on how much risk the solution involves. Most AI solutions in an ordinary company end up in the two lowest levels.
- Level 1Minimal risk
For example sorting cases or summaries for internal use. No special requirements beyond good practice.
- Level 2Transparency requirements
Chatbots and AI-generated content. The user should know that it is an AI and the content should be labelled.
- Level 3High risk
For example recruitment, education, credit and critical infrastructure. Requires risk management, documentation and human oversight.
- Level 4Prohibited
For example social scoring and manipulation that exploits vulnerabilities. May not be used at all.
- February 2025
Prohibited uses and requirements for AI literacy among staff.
- August 2025
Rules for general-purpose AI models.
- Today
Transparency requirements, for example saying when you are talking to an AI.
- 2 December 2027
Stand-alone high-risk systems.
Postponed July 2026 - 2 August 2028
AI in products that already have EU product rules.
Postponed July 2026
We classify every solution already in the pre-study and document which level it ends up at and why. You get the material in writing, so that you can show it to the board, the auditor or the supervisory authority.
The high-risk rules were postponed by the EU decision on the Digital Omnibus in July 2026.
GDPR and data protection
AI does not change the rules for personal data. That means the same questions need answers before anything is built.
- Legal basis
We start from why the data is processed and whether the use of AI fits within that.
- Data processing agreement
With us and with the providers that process data on your behalf.
- Data minimisation
Only the data that is needed, for as short a time as it is needed.
- Right to erasure
The solution is built so that a person can be erased from both data and logs.
- Impact assessment
When the processing may involve high risk we carry out a DPIA together with you.
Then there are requirements for risk management, incident reporting and security in the supply chain. We help you meet the requirements in what we build, with documentation that fits into your own security work.
You own what we build.
The source code lives in your repository from day one. You can take over, change provider or develop it yourselves.
All data and all logs belong to you. We only use them for the assignment.
Instructions, agent workflows and specs are part of the delivery, documented and handed over.
No lock-in. Documentation and handover are part of every assignment.
Not sure what applies to you?
Tell us what you want to use AI for. We go through which rules affect you and how the solution can be built safely.
Last reviewed October 2026. This is guidance, not legal advice. Contact a lawyer for assessments in an individual case.