Sovereign AI for regulated industries: compliance meets innovation

2026-01-10

SAVANT-AI is a research project in the inLABs programme. The capabilities described are research goals, not an available product. Project status: inLABs

Regulated sectors — finance, energy, defense, medicine, administration — need AI the most, yet they have the smallest margin for error and the heaviest legal burdens. For such environments we run the SAVANT-AI research project — its goal is a sovereign Enterprise Cognitive System: full-scale generative AI, controlled by the organisation and running on its infrastructure.


Why classic “AI in the cloud” is not enough for regulators

In regulated sectors, data is not just a resource – it is subject to strict supervision: banking, medical, energy, defense, and administrative. Sending full business context and sensitive data to public AI services generates three main types of risks:

• The risk of disclosure of professional or trade secrets (customer data, patient data, contracts, strategies) outside the controlled perimeter.
• Lack of full transparency as to what data, and in what mode, the external model used by the organization was trained.
• Dependence on suppliers’ terms and policies, which can be changed unilaterally, without customer influence – difficult to accept from a compliance and audit perspective.

Regulators are increasingly expecting not only data protection, but also the ability to reproduce the decision-making process and control the impact of AI on the outcome of decisions. The classic “send a prompt to the cloud, receive a response” approach simply does not provide this.

SAVANT-AI: the concept of sovereign on-premises AI

The SAVANT-AI project aims to resolve this conflict through sovereignty principles:

• The project assumes an on-premises appliance of the NVIDIA HGX B300 class installed in the organisation’s server room or data centre.

• All cognitive processes — models, agents, contextual memory, knowledge repositories — are to run inside the customer’s infrastructure, on its hardware, and within its security domain.

• SAVANT-AI is meant to allow operation in network isolation mode (air-gap, Deep Sovereignty), with no permanent connections to external public services.

This allows the organization to clearly state: “Our AI operates here, within our perimeter, on our data, and is subject to our policies, not someone else’s SaaS regulations.”

Cognitive Governance Gateway: filters not only data, but also intentions

At the heart of combining generative AI with audit and regulatory requirements, the SAVANT-AI project places the Cognitive Governance Gateway. It is meant to go beyond

• It is meant to analyse the content and intent of the query in natural language, the data classes to which the response relates, and the context of the session (user role, location, risk level).
• On this basis, to decide whether a given knowledge synthesis can be performed at all, to what extent, and in what form (e.g., only aggregates, without individual data).
• For example, it could enforce policies such as “data marked as Top Secret is never used in contexts outside the appliance” or “patient medical information can only be combined with specific classes of administrative data.”

This way compliance and regulatory policies are meant to be embedded directly in the cognitive layer – they are not just a document or an overlay, but part of the decision-making mechanism.

Multidimensional authorization models compliant with regulations

The SAVANT-AI project assumes a multidimensional access model matrix – much richer than the classic RBAC found in typical systems.

• RBAC – roles reflecting the structure of the organization (e.g., attending physician, credit officer, SOC analyst, compliance lawyer).
• ABAC – attributes such as location, time of day, device type, authentication level, project membership.
• MAC / classification – strict labels such as Public / Internal / Confidential / Top Secret, which, regardless of role, can block access to selected data classes.
• PBAC, RAdAC, “break-the-glass” modes – risk-based policies (e.g., in case of suspicious activity, the system narrows the response range, enforces MFA, switches to limited exposure mode).

All of this is meant to be logged and auditable so that it can be demonstrated to auditors and regulators that access to knowledge generated by ECS is subject to at least as strong controls as access to the source systems themselves.

Audit Trail and Objective Truth

Three questions are key for regulators: what did the AI take into account to reach its conclusion, who had access to it, and can it be reproduced? The SAVANT-AI project aims to answer them directly:

• Every answer, number, report, or recommendation is meant to have a trace to specific records in transaction systems, documents, and logs — ECS is not to “guess” but to synthesise facts
• The reasoning process is to be logged: what models and agents were used, what data was retrieved, what governance policies were applied along the way.
• Mechanisms of deterministic fact verification (Factual Grounding) and expert supervision (human-in-the-loop expert clusters) are meant to allow control over the quality and reliability of responses.

This is meant to create Objective Truth — a single, auditable point of reference, rather than multiple local interpretations.

Reducing the risk of AI hallucinations and errors

In regulated industries, AI errors can mean not only financial loss, but also legal violations or health and safety risks. That is why the SAVANT-AI project assumes that the system:

• bases its responses on data from source systems and knowledge repositories (RAG 2.0), rather than generating “probable” responses without factual basis,
• uses specialized “objective truth” modules that verify data consistency and completeness,
• introduces a human-in-the-loop model in critical decision areas: expert teams verify and approve response patterns, and ECS learns from their corrections.

In this way the risk of hallucinations is meant to be minimised and, where it cannot be eliminated, openly flagged and controlled.

How it looks from the perspective of management and regulators

For the board of a sectoral organisation (bank, energy system operator, medical group, public institution), the goals of the SAVANT-AI project mean:

• the ability to use generative AI on a full scale – for analysis, synthesis, and recommendations – without compromising security, audit, and regulatory requirements,
• a controllable, local ECS platform that can become a common “brain” for multiple organizational units and countries,
• protection of strategic know-how from being “dissolved” in public models.

For regulators and auditors:

• a clear perimeter of data and computation — ECS is to run in the customer’s infrastructure, not “somewhere in the cloud”,

• the ability to check how a specific AI recommendation was made and what data was taken into account,
• proof that the organization not only uses AI, but has real technical and process control over it.

Understood in this way, sovereign SAVANT-AI is therefore not an obstacle to the implementation of regulations – on the contrary, it becomes a tool that allows the ambitions of cognitive transformation to be reconciled with the letter of the law and the expectations of supervision.