Skip to content

Approach

The method is the product. The software comes after.

Most AI projects fail for reasons that have nothing to do with the model. We work in the opposite order.

  • 01

    Forty-five minutes, and we do not talk about AI

    We ask what your week looks like, which task makes you sigh, how long it takes, how often, and what happens when it goes wrong. Nothing is installed and nothing is signed. You leave with a written read on what is worth automating and what is not.

  • 02

    Your data, sorted into four categories

    Public, internal, personal, sensitive. One page, one hour, process by process. This is the step everyone skips and it is the one that decides everything after it: whether your project runs on a European service, on your own machines, or not at all.

  • 03

    One process, scoped to finish

    We take a single process and we write down what success looks like before we build anything. A scope that cannot be demonstrated in ten minutes is a scope we have not understood yet.

  • 04

    Handover, in writing, to someone who was not in the room

    Code and accounts in your name, documentation your team can act on, and a clear list of what we did not do. We would rather end an engagement cleanly than hold you by the infrastructure.

What companies actually lack

The file, not the server.

Running a model locally answers one question and leaves the rest untouched. It does not give you a legal basis, it does not set your retention periods, and it does not consult anyone. The file does.

  • The map of AI tools already in use — there is always undeclared usage, and it is always the first surprise.
  • The four-category data sort, process by process.
  • The processing register, which is required whatever your headcount.
  • Retention periods, including conversation histories and prompt logs. Almost no deployment does this.
  • The information notice for the people concerned.
  • The impact assessment where it is required, which in practice is whenever a generative assistant touches staff, patient or identifiable customer data.
  • The internal usage policy, and user training.
  • The works-council consultation dossier.

The sentence we repeat in every meeting and every quote: we implement to the rules and we document our choices. Your compliance stays yours and your counsel’s. We are not lawyers, and we will not pretend to be.

Choosing the technical route

Local is not a principle. It is one answer out of three.

Running everything on your own hardware sounds safest and is usually the most expensive way to be no more compliant. The data sort decides, not the fashion.

Hosted in the EU, under a processing agreement
The default. Company information, ordinary personal data.
On your own machines
Health data, legal files, trade secrets, or a sector rule that forbids the alternative. Hardening is quoted separately.
No AI at all
A plain rule does the job, or the data is too sensitive to touch. This is a real outcome, and we have recommended it.

Why pilots fail

Rarely the model.

Scope too wide on day one. No measurement before launch. No human review on a deliverable that commits the company. And test environments nobody decommissions — that last one exposed sixty-four million job applicants at a restaurant group in 2025, through a 2019 test account with the password “123456”.

Pilots run by an internal team with outside help succeed about three times as often as pilots carried by an IT department alone. That gap is the whole reason we work this way.

See what that buys you