SAIE (Sovereign AI Ecosystem) is three software layers that form one AI workspace: TWIN:DESK — everyday work with documents, knowledge and assistants, PROXY:AI — control, security and costs, CDF — the deployment and compliance methodology. In one place you know who is working, on which data, with which model — and what it costs
For organisations that must know where their data goes — because a regulator, a contract clause or a risk assessment requires it: banks, public authorities, energy, hospitals, telecommunications and defence. Our industry offer describes 19 deployment paths. If you are looking for a simple website chatbot, there are cheaper solutions — we will gladly point you to them
You get a complete platform from day one, without stabilising open-source components and without moving your data to a hyperscaler. You decide where your data is located, local and cloud models can be changed without restriction, and the software code and training stay with the client. The CDF methodology guides you step by step to regulatory compliance. The full comparison across 13 categories is on the SAIE page
We launch the environment within 2 weeks. The length of the full deployment depends on its scope: a Proof of Value on one process usually takes 4–8 weeks, and a full programme follows the stages of the CDF methodology
There are three starting points: a demonstration, a Proof of Value on your data or configuring an offer in the Offer builder. If you are mainly interested in how to deploy AI in your organisation, we start with the Initial assessment (CDF-Eval) — a one- or two-day diagnosis at your premises
Yes. TWIN:DESK, PROXY:AI and the CDF methodology are in use at LW Bogdanka (Enea Group) — the case study is publicly available
Two service lines: CDF methodology consulting (from the Initial assessment through stages F0–F6 to an independent audit) and six WDR operational documents that remain in the organisation after the project. You can order the full programme, selected stages or ongoing CogOps support
All features in the “All SAIE capabilities” catalogue (128 features in 13 categories) are available today. Planned changes appear only in the Roadmap — 110 items across five quarters
Yes. Custom features are part of our offer, and you can submit your own requirement in the Roadmap
Wherever you decide. SaaS — in the service provider's data centre in Poland or the EU, On-Premises — in your organisation's server room, Air-Gap — in infrastructure cut off from the public network, with local models only. Every deployment is a separate, fully isolated environment
Only to the extent you define. Model selection is decided by your organisation's policy in PROXY:AI, not by the user. Documents marked confidential are blocked for cloud models, the AI Firewall masks personal data before it leaves the network, and the EU-only switch restricts processing to the EU
All traffic to AI models passes through one point — PROXY:AI. Employees get an environment in TWIN:DESK that is better than public chatbots, and the organisation can see who is using which tool and with which data
The AI Act and the Polish Act on Artificial Intelligence Systems, GDPR, DORA, NIS2 and the Polish National Cybersecurity System Act, the National Interoperability Framework (KRI) and the Cyber Resilience Act. The CDF methodology selects requirements for your organisation's profile, and the platform continuously collects evidence for auditors
Seven standards in one integrated management system: ISO 9001, ISO 14001, ISO 22301, ISO/IEC 27001, 27017, 27018 and 42001 — all certified by Bureau Veritas. ISO/IEC 42001 is the first such certificate issued by Bureau Veritas in Poland, and the audit ended with no nonconformities
Yes. The platform integrates with DLP and SIEM solutions, lets you build your own data classifiers and apply industry extensions
No. The software code and training stay with the client, and the model is changed in PROXY:AI settings without rewriting applications — you can choose from more than 100 cloud and local models
We deliver SAIE as Docker container applications that can be deployed on Kubernetes, with a relational database (e.g. PostgreSQL) and a vector database as the RAG engine. The platform runs on-premises or in the client's private cloud, including offline with local models
TWIN:DESK includes a Prompt Assistant that helps formulate instructions in line with the CRISPE-CDF prompt engineering standard
A document can be marked confidential immediately. The system then permanently blocks its use in conversations with external cloud AI models
No. It is a multimodal AI workspace supporting voice commands, attachment analysis and “computer mode”, where AI agents perform tasks on the user's behalf
It reveals features progressively: beginners see a simple chat, while experts have full access to a terminal and workflow automation
EZD RP and EZD PUW, e-Doręczenia, KSeF 2.0 and ePUAP authentication
It is an everyday workspace that builds institutional memory: it securely handles internal documents and knowledge bases (RAG) and includes tools for automating tasks and processes
A question goes to up to five selected models in parallel. The platform collects and compares their responses, then prepares one final answer — with greater confidence in the result
The virtual accounting unit Twin:Coin hides complex token price lists and makes it easier to report and limit team costs
It can work proactively: using email, task management and calendar integrations to prepare daily plans or meeting summaries
Instead of inventing an answer, TWIN:DESK records the gap in the Knowledge Gap Register. Managers get a concrete indication of which procedures and instructions need updating
Yes. Dedicated workspaces provide their own avatar, system-prompt guidelines and assigned tools, such as a code interpreter for the IT department
A personal AI agent that learns how a user works and uses their knowledge, documents and activity history. It helps automate repetitive tasks and prepare recommendations — within the oversight boundaries set by the organisation
It enables use of the user's personal knowledge sources: local folders, Outlook email, Microsoft Teams and calendars. AI works with them locally, without copying sensitive data into a central RAG knowledge base
ChatGPT Enterprise and Microsoft 365 Copilot run in the vendor’s cloud. TWIN:DESK can run as SaaS, on-premises or air-gapped, answers from your organisation’s documents with source citations, matches the model to the confidentiality of the task — including several models at once in the Model Council — and integrates with Polish systems such as EZD RP and KSeF 2.0
Yes. TWIN:DESK connects to EZD RP and EZD PUW through its integration layer, and documents from SharePoint and Microsoft 365 can serve as a knowledge source for assistants — with user permissions preserved
The price depends on the number of users, the deployment option (SaaS, on-premises or air-gapped) and the scope of integrations. Model usage is accounted for in Twin:Coin, with limits for teams. The Offer Builder prepares an initial quote
It is the central control layer — one router for different AI models. It addresses shadow AI and protects the organisation against sensitive data leaks and uncontrolled costs
FinOps and Anti-DoW mechanisms set tenant and user limits, including protection against denial-of-wallet attacks
PROXY:AI supports human-in-the-loop oversight: a critical process pauses until the appropriate person authorises it
The immutable WORM audit log records the complete operational history: model, configuration, invocation cost and data needed to reconstruct the decision
The MCP Gateway lets agents use only explicitly assigned tools, such as Jira, and records an audit trail of their actions
Yes. Model responses are scanned again for sensitive data and dangerous instructions
Yes. The dry-run panel allows ABAC rules to be tested on simulated traffic before production deployment
Yes. The AI Firewall analyses data in under 50 milliseconds and neutralises items such as Polish national ID and tax numbers and email addresses before they leave the organisation's network
Semantic caching serves repeated questions with similar meanings from the cache, without querying an expensive model again
Real-time guardrails filter requests and block attacks such as prompt injection and jailbreaks
Zero-Code Switch: change the primary model in PROXY:AI settings without rewriting business application code
It does not admit requests blindly. For every request, it evaluates who is asking, from which environment, using which data and at what risk — then allows, restricts or blocks the operation
Azure API Management and Cloudflare AI Gateway are gateways tied to a single vendor’s platform, and LiteLLM is open-source routing software that the organisation extends and maintains itself. PROXY:AI runs in the cloud, on-premises and air-gapped, and beyond routing it adds an AI firewall with data masking in 12 languages, ABAC evaluation, an MCP gateway for agents, a WORM register with evidence packs and budgets
Yes. PROXY:AI supports local models, including Bielik and PLLuM, alongside cloud models. A policy decides which model is used — for example, requests containing confidential data go only to a local model
No. The Adaptive Configuration Engine (ACE) selects legal requirements and controls for the organisation's profile — differently for a bank and a public authority
It is a proprietary deployment framework combining legal requirements, such as the AI Act, with technical practice. Compliance is built in before solution development starts, not afterwards
Ten stages — from discovery (F0) to ongoing operations (F6). The seven main stages F0–F6 are complemented by F0.K (knowledge audit), F0.L (legacy systems assessment) and F1.5 (compliance). The whole path is preceded by the Initial assessment (CDF-Eval) and concluded by an independent audit (CDF-AUD)
An indicator in the AI Quality Dashboard that continuously checks whether the knowledge used by a production model is up to date
The platform uses a local AI Advisor model, so the documents it analyses never leave the organisation's infrastructure
No. The methodology is deployed once, and the platform generates evidence and artefacts for different regulations. New rules may require updates to controls or templates, but not a new deployment
Yes. It provides ready-to-use registers and operational evidence for AI system management and auditing against the standard
It supports a model SBOM (Software Bill of Materials) and ready-made reporting of compliance with CRA requirements
There is a firm “scale or stop” decision gate at the end of a pilot. Projects without a production prospect end before they consume the budget
Yes. The automated AIMS evidence pack continuously prepares artefacts for auditors, including the AI System Register and data protection impact assessments (DPIAs)
With three-tier Cognitive SLA indicators that assess decision quality, hallucination levels and knowledge freshness — not just server availability
With the Initial assessment (CDF-Eval) — a one- or two-day diagnosis at the client's premises involving more than 100 employees. The result is a recommendation: deploy, deploy under conditions or do not deploy — before you spend any money on the project
Yes, if you need one. We can use your template or provide ours — mutual, without exclusivity clauses or restrictions on your contacts with other providers. Many initial conversations take place without an NDA: we discuss architecture, regulations and our approach, rather than your data. When we move on to documents, processes or access to environments, an NDA is a requirement — on our side too
Yes — this is one of the deployment patterns SAIE was designed for. Language models, the knowledge base, logs and agent orchestration run in your server room or an isolated network; model updates and patches are brought in on physical media under an agreed procedure. We use open models, including Polish models, so there is no dependency on an external API or telemetry sent to a provider. We use this approach in classified environments, defence and critical infrastructure — whether you need it depends on data classification and regulatory requirements, not trends
Yes, and we treat it as a substantive project stage, not a formality. We respond to RFIs and RFPs, participate in technical and competitive dialogues, and map contracting authorities’ requirements to SAIE capabilities and obligations under the AI Act and the Polish Act on Artificial Intelligence Systems — so that the procurement specification can be drafted without the risk of invalidation. If you represent a contracting authority, we help formulate technology-neutral criteria for sovereignty, security and business continuity. We know the Ministry of Digital Affairs’ model clauses for AI procurement and structure our responses accordingly
Usually 4–8 weeks, covering one jointly selected process and using your data — not demonstration data. We start by defining measurable success criteria (handling time, accuracy, the percentage of answers requiring correction) and finish by measuring them. You receive a report comparing results with the criteria, an assessment of risks and regulatory requirements for production deployment, an estimate of operating costs and a recommendation: scale up, change the scope or stop. “Stop” is an equally valid result — it saves a budget that would otherwise go towards production without evidence of benefits
Yes — Polish open models are our starting point, not an optional extra. We run the entire Bielik family locally (SpeakLeash and ACK Cyfronet AGH; 1.5B, 4.5B and 11B, Apache 2.0 licence), PLLuM models from the HIVE AI consortium led by NASK (PLLuM-12B and Llama-PLLuM 8B and 70B, including versions permitted for commercial use), and, where clients require them, Qra (OPI PIB and Gdańsk University of Technology) and Trurl (Voicelab). We also support international open models (Llama, Mistral, Qwen, Gemma) and, where data classification permits, commercial models accessed through APIs. We select models for the task and security requirements — different models for classifying correspondence, talking to employees or analysing documents — and test them on your data, not rankings. SAIE architecture lets you replace a model without rebuilding the rest of the system, so the decision is not permanent
Yes. We deliver open and dedicated training — from two-hour management workshops (“what the AI Act and the Polish Act on AI Systems mean for our organisation”) to programmes for teams using AI every day: safe use of tools, assessing whether deployment is justified using the Ministry of Digital Affairs’ Guide, and preparing an AI policy. Our materials draw on applicable regulations and what you will actually encounter in your institution or company, rather than examples from abroad. Dedicated training is delivered at your premises or remotely, with the option to procure it under Polish public procurement law
Use the contact form and select the “Demonstration” topic. The meeting takes place in MS Teams
We deliver software and services to a business / enterprise standard with full support, and tailor the scope of service to your needs. For organisations that want to maintain AI quality on an ongoing basis, we offer CogOps ongoing support: a monthly AI quality report, a compliance review and an up-to-date agent register
Yes — the software code and training stay with the client, which ensures continuity without vendor lock-in. The form and scope of the handover are agreed in the contract
You complete the form on the page: requester details, institution name and the selected courses with dates and number of participants. After submitting, you receive a copy of the registration and a proforma invoice (for paid training) at the e-mail address provided. Three days before the first day of training we send participants the link to the course
Any person from the institution may submit a registration from a business e-mail address. For paid orders, please pay the proforma invoice you receive before the training date — this is a condition of participation
For September and October dates, the first 5 people from one institution attend each course free of charge. The only condition: the requester subscribes to the allclouds.pl newsletter (one consent per registration, not every participant). Consent can be withdrawn at any time, including after the training. The newsletter contains information about upcoming dates, new materials and changes in regulations on AI in public administration — with no advertising of third-party products
Places from the sixth onwards are charged according to the November and December 2026 price list. For a group of 6–10 people the rate is PLN 170 net per paid place. Example: 8 people on one course in September cost 5 × PLN 0 + 3 × PLN 170 = PLN 510 net. The total number of people from one institution in a group may not exceed 18
Yes. The limit of 5 free participants applies to each course separately, so one institution can train up to 40 person-courses free of charge, including the same person on several courses. The only limit is the number of places in a group — registrations are accepted in order of submission
After submitting the form you receive a confirmation of your registration at the e-mail address provided. For paid orders, the same e-mail includes a proforma invoice to be paid before the training. Three days before the first day of training we send participants the link to the course
Yes, free of charge. A participant can be replaced by another person from the same institution up to the start of the training. Moving to another date from the calendar is possible up to 5 business days before the training, provided there are free places on the new date. Just send an e-mail to office@allclouds.pl
Cancellation is possible up to 5 business days before the first day of training; after that we offer a change to another date or another participant instead of charging a fee
Yes — the form lets you add any number of items, each with its own date and number of participants (e.g. 01 Foundations for 5 people in September and 03 Security for 3 people in October). The price is calculated automatically, and everything goes onto one confirmation and, for paid orders, one invoice
It is best to prepare such an order by selecting the courses one by one in the registration form. This lets you choose convenient dates for each course
We issue a proforma invoice after receiving the registration. After receiving payment we issue a VAT invoice. On request, we split the VAT invoice by organisational unit
We show net and gross prices on the page. Training financed entirely from public funds (Article 43(1)(29)(c) of the VAT Act) or at least 70% from public funds (§ 3(1)(14) of the Minister of Finance Regulation of 20 December 2013) is VAT exempt — in that case the gross price equals the net price. In practice, an institution financing training from its own budget selects the 100% option. The declaration template you receive with the order confirmation includes both options. If this applies to you, please complete, sign and return the declaration to office@allclouds.pl
Yes. A team of 6–10 people on the complete path pays PLN 1,280 − 15% = PLN 1,088 net per person; a team of 11–18 people pays PLN 1,280 − 25% = PLN 960 net. Discounts are calculated from the number of people from one institution on a given course, not from the total number of people in the order
Whatever you need to carry out the procurement in line with your institution's procedures, for example: an offer, the training programme with a schedule, an order template, a template declaration of public funding, a GDPR information notice and — on request — company information (KRS, NIP, ISO 9001, ISO 14001, ISO 22301, ISO/IEC 27001, 27017, 27018 and 42001 certificates)
Yes. We usually deliver training under an order or contract from the institution below the threshold of the Polish Public Procurement Act (PLN 170,000 net from 1 January 2026) — in line with your procurement rules. We accept the institution's contract templates after review; we also have our own one-page template
Sessions take place online in MS Teams. A browser and the link we send before the training are enough; no accounts or software installation are needed. For exercises we use AI tools available in the browser. If your institution's security policy blocks certain services, please let us know when registering — we will choose an option that works on your network
Three 80-minute blocks on consecutive business days (always 10:00–11:20) are a deliberate choice: employees are not away from work for a whole day, and between blocks they have time to apply the material to their own tasks and come back with questions. The blocks form one whole and end with a shared document, so we do not sell individual days. If a participant misses a block, they can make it up on the next date of the same course at no extra cost
A group has 8 to 18 people — small enough for the instructor to work with every participant, large enough to share experience between institutions. If fewer than 8 people are registered 3 business days before the date, we offer the nearest other date or — for registrations from one institution — a closed session. We never cancel a course without offering an alternative
We do not record sessions. Participants discuss examples from their own institutions freely, which requires certainty that the conversation stays within the group. Instead of a recording, participants receive materials, templates and a summary of each block
Yes, groups on open dates are mixed — deliberately, because sharing experience between institutions is one of the most highly rated parts of the training. The instructor makes sure protected information is not discussed; exercises use anonymised examples or examples we prepare. If you prefer a group made up only of your own institution, please order a closed course
Each participant receives: course materials in PDF, templates of the documents developed during the workshop (e.g. task map, checklist, tool register, pilot charter) and a named certificate of attendance listing the programme
Exercises use browser-based tools, our products and various large language models, including the Polish models PLLuM and Bielik. The institution does not need to buy any licences — we provide access to the exercise environment for the duration of the training
No. Exercises use examples we prepare or anonymised materials, and one of the first things we teach is what must not be entered into AI tools. The allclouds exercise environment runs on infrastructure in Poland, and the company holds ISO/IEC 27001, 27017, 27018 and ISO/IEC 42001 (AI management system) certificates. Registration data is processed solely to deliver the training
Each course ends with a concrete working document that participants complete during the workshop for their own institution — e.g. a task map and checklist (01), a source catalogue (02), draft rules for using AI (03), a pilot charter (04). The documents follow the structure of the Ministry of Digital Affairs' guide and are prepared so that they can become an annex to an internal order, procedure or pilot request. The institution receives them in an editable format and may modify them freely; they require no licence or reference to allclouds
Article 4 of the AI Act requires deployers of AI systems to ensure a sufficient level of AI literacy among their staff, taking into account the context of their work. The training programme covers the three competences indicated in the Ministry of Digital Affairs' guide: understanding the limitations of AI, critical evaluation of results and formulating instructions. Documentation consists of a named certificate listing the programme, the training programme and the document developed during the workshop. We are not a law firm — the final assessment of whether the scope is sufficient for a specific role is made by the institution, but we prepare the materials to make that assessment easier
The training is delivered by people who have designed and implemented AI solutions in institutions from regulated sectors and co-created the CDF methodology and the ISO/IEC 42001-certified AI management system
Yes. We deliver closed courses online on a date agreed with the institution (group of 8–18 people). In the closed version, exercises are based on your institution's processes and documents (after anonymisation), and the resulting document refers directly to your structure. Pricing is individual — please write to us through the form, marking “closed course”
On open dates the programme is fixed, but we choose examples to match the group (municipalities, districts, regional offices, central administration) and ask about the type of institution in the form. Course 06 has a separate variant for regional and central offices (internal assistant), and course 08 is designed for groups from several institutions. Full tailoring (your own processes, your own documents) is available in closed courses
Yes, at three levels: 30 days of e-mail consultation included in the price, paid implementation consultations (e.g. a review of a draft internal order or pilot charter with the instructor) and a pilot following the CDF methodology in the SAIE environment for institutions that want to test the solution on their own documents. Attending the training does not oblige you to take any of these options — the documents you develop belong entirely to you
Only if the office has approved them: it has a contract with the provider, knows where the data goes and has trained its staff. A public chatbot on a private account does not meet these conditions, and the office is responsible for the data entered. It is safer to give civil servants a tool that runs in the office’s infrastructure or in a controlled cloud in Poland or the EU
Personal data may go only to tools covered by a data processing agreement and control over data location. PROXY:AI masks personal data before a query reaches the model and records every query in a log. TWIN:DESK can run entirely in the office’s infrastructure
The civil servant who used it, and the office as the deployer of the AI system. That is why every TWIN:DESK answer includes a citation from the source, and the AI use policy sets out who checks the output before a letter is sent
With an inventory of tools, an AI use policy and training for civil servants. Then a pilot on one process, e.g. draft replies in EZD (electronic document management system)
By answering only from approved documents, with a source citation, and through human oversight of the decision. TWIN:DESK answers based on the organization’s documents with a citation, and PROXY:AI lets you route tasks to models proven in a given use case
By being able to swap the model without rebuilding the process. PROXY:AI provides a single gateway to more than 100 models, both cloud and local. Changing a model is a configuration change, not a new deployment
Like any ICT service provider supporting important functions: with a risk assessment, an exit plan and information on data location. The WORM log in PROXY:AI documents which models processed data and when
The doctor who makes the decision, and the facility as the deployer of the system. AI in SAIE prepares summaries and draft documents with a source citation, and a human always approves the decision
Yes. TWIN:DESK and PROXY:AI run on-premises, in the facility’s infrastructure, with local models
The director is responsible for the deployment decision and the policy, the DPO (data protection officer) for the legal bases for data processing, the CISO for security and compliance with the KSC Act, and the provider for system documentation and support. The CDF methodology includes templates for these roles and registers
Not unless the firm decides so. TWIN:DESK runs on-premises or in a cloud with data located in Poland or the EU, and PROXY:AI lets you allow only models that run locally or in the EU
No, if the firm uses local models or providers whose contracts exclude training on client data. PROXY:AI lets you allow only such models and masks personal data before a query is sent
The assessment is up to the firm. SAIE gives it the basis for one: control over data location, case-level permissions, a log of who processed documents and when, and documentation to demonstrate due diligence
The AI Act, the amended KSC Act (NIS2) and an internal AI policy linked to the information security management system. The CDF methodology guides you through the Initial Assessment, the classification of use cases and documents you can show an auditor
For critical infrastructure data — on-premises. At LW Bogdanka, TWIN:DESK runs entirely in the client’s infrastructure, with no data going outside, and the deployment took two months
Start with the documents people search for most often, e.g. operating and emergency procedures, and assign permissions by department. At LW Bogdanka, about 80% of the knowledge base consisted of scans, which TWIN:DESK processed for search with citations
Yes. Every query and answer goes to the WORM log in PROXY:AI, and TWIN:DESK answers include a source citation
Yes. Models run locally, code and configuration stay with the client, and the list of approved models and components is under the operator’s control
Yes. PROXY:AI with local models runs in air-gap mode, without an internet connection. We carry out deployments in classified environments together with integrators authorized for such work
Not with a ban, but with a safe tool, a policy and training. PROXY:AI routes traffic to approved models, masks data and records queries, and training teaches staff what must not be entered
By answering only from service documents, with a source citation, and by checking the output before use
For summaries, searching procedures, and drafting notes and reports — always with human verification. Not for autonomous decisions concerning individuals
This is decided by the definition in Article 3(1) of the AI Act: a system that infers from the input it receives how to generate outputs. The Initial Assessment in the CDF methodology classifies each use case and documents the rationale
In the institution’s infrastructure or in a chosen cloud in Poland or the EU. The WORM log in PROXY:AI shows who processed data, when and with which model
By separating roles: the language model searches and summarizes with citations, and calculations are performed by deterministic tools. Every result can be reproduced from the log
AI that serves as a safety component in the management of water supply is listed in Annex III to the AI Act. The Initial Assessment in the CDF methodology settles this for each use case
SAIE provides the documentation needed to assess the supplier: data location, a processing log, the manufacturer’s ISO/IEC 27001 and 42001 certificates and an exit plan
The AI policy becomes part of the ISMS: the same roles, asset register and review. Templates for the policy and registers are in the WDR documents
Through a single gateway: PROXY:AI replaces scattered API keys and provides team budgets and a WORM log of every query
TWIN:DESK and PROXY:AI run on the operator’s infrastructure and can serve customers as a service
A ready-to-use AI work environment with evidence of compliance — in the allclouds.pl partner program
The draft Annex 22 allows it in non-critical applications, under human oversight, and excludes it from quality-critical applications. Until the final text is published, working with documentation, summaries and search with citations is safe
By defining its intended use, testing it on reference data and keeping a full trail: who processed data, when and with which model (the WORM log in PROXY:AI)
Through an inventory and a single gateway to models. Traffic routed through PROXY:AI shows who uses AI and for what
Tools without a data processing agreement and control over data location should not receive personal data, identification numbers, clients’ financial data or documents covered by professional secrecy. The AI use policy template includes a catalog of such data
The accounting firm, toward its client. AI prepares a proposal citing the relevant provision, and the accountant approves it
Based on the AI use policy template: approved tools, a data catalog, responsibility for the output and training
Only into approved tools, with a contract and control over data location, and only to the extent permitted by the contract with the client. In SAIE, each client’s data sits in a separate area with its own permissions
The consulting firm, toward its client. AI prepares material with a source citation, and the expert is responsible for the conclusion
Yes, if you decide so: on-premises or in a cloud with data located in Poland
Manufacturers, importers and distributors of products with digital elements placed on the EU market, including controllers and devices with software
Yes. Local models in SAIE are used within the company’s infrastructure, so code and documentation do not go to external services
With a list of products and components, a reporting procedure and access to documentation in one place. TWIN:DESK answers with citations from technical documentation, which shortens the time needed to establish which products a vulnerability affects
From 2 August 2026 (Article 50 of the AI Act). For systems placed on the market before that date, machine-readable marking is required by 2 December 2026
Text published to inform the public on matters of public interest does not need to be labeled if it has undergone editorial review and a person or newsroom holds responsibility for the publication (Article 50(4)). It is worth documenting this review
The entity that publishes the content, as the deployer of the AI system. It is worth setting out the scope in the contract with the agency
Only into a tool that runs in the university’s infrastructure or guarantees that the data is not stored or used for training. PROXY:AI lets you use local models, including Bielik and PLLuM
Through a university policy that sets out the disclosure of AI involvement in student work, grading rules and approved tools
A shared gateway to local and cloud models with budgets for faculties and units, and for administrative staff — an assistant that answers from internal regulations with a citation
With one process with a measurable loss, e.g. time spent searching for instructions or manual reporting. The Initial Assessment in the CDF methodology selects the use case and sets the criteria for the decision after the pilot
Documents are enough to start: instructions, standards, service reports. TWIN:DESK also processes scans
A human makes the decision. AI points to the source and proposes steps, and every action is recorded
From 30 December 2026 for large and medium-sized companies, and from 30 June 2027 for micro and small companies. You need geolocation data and documents from suppliers — TWIN:DESK organizes them and answers with citations
Most often data on emissions, the origin of raw materials and EUDR compliance. It is worth collecting it in one place from which you can quickly prepare a response for the customer
Document agents in TWIN:DESK read data from documents and prepare it for the system, and a human approves the result before it is saved
Through a single gateway to models with personal data masking (PROXY:AI) and permissions by branch
Wherever the outcome affects a customer or a driver: accepting a complaint, contractual penalties, carrier evaluation
TWIN:DESK answers advisors’ questions from technical documentation, bulletins and warranty terms with the source cited, and agents prepare warranty claims and complaint responses. A human decides whether to accept a warranty claim
The Commission for the Development and Security of Artificial Intelligence (KRiBSI). From 28 October 2026 it can carry out inspections, handle complaints and impose fines
Up to €35m or 7% of turnover for prohibited practices, up to €15m or 3% of turnover for other obligations and up to €7.5m or 1% of turnover for incorrect information. SMEs pay according to the lower of the two amounts
Yes. A public body that uses AI systems at work is a deployer under the AI Act — it must ensure staff AI literacy, transparency and, from 2.12.2027, the obligations for high-risk systems, including a fundamental rights impact assessment. The act sets no separate fine rules for public bodies — fines are imposed on any entity obliged to comply with the AI Act (Art. 104)
List the AI systems used in your organisation, check them against prohibited practices, adopt an AI use policy, train your staff and decide how you label AI-generated content
Yes — at work the deployer is the organisation, not the employee. That is why the tool should be in the inventory and covered by the policy and training. An employee’s statement that they use AI “at their own risk” transfers nothing
The AI Act does not name such a document, but it requires deployers to ensure, among other things, staff AI literacy (Art. 4) and transparency (Art. 50). ISO/IEC 42001 requires an AI policy. Whether it is called a policy or AI usage rules does not matter; what counts is the content and the tools behind it. Without written rules these obligations are hard to prove during an inspection
A ban with no company alternative usually moves usage to private phones and accounts, i.e. into shadow AI. It is more effective to approve a safe tool with data controls and logging
It should. Labour law does not cover them, but the AI Act, GDPR and ISO standards apply to the organisation in the same way, whatever the form of engagement. The rules are worth including in contracts
It depends on the tool and the contract with the provider. Tools without a data processing agreement and control over data location should not receive personal data, trade secrets, client data or information protected by law. The template includes a list to tailor
The management board or head of the organisation, after consulting the DPO, information security and — where one exists — employee representatives
The use of AI tools that the organisation has not approved and does not oversee, most often public chatbots on employees’ private accounts
It depends on the version and the contract. On a private account the organisation has no contract with the provider, no say over data retention and no access to chat history. A tool approved by the organisation, with a contract, data controls and logging, is safe
A block with no company alternative moves usage to private devices. It is more effective to approve a safe tool and route traffic through an AI gateway
Towards the client and the supervisory authority — the organisation: it is the data controller under GDPR and the deployer under the AI Act. An employee’s statement that they use AI “at their own risk” transfers nothing
With an inventory and a policy. Then a safe tool and training for staff — before a ban turns into a workaround
For letters and official matters PLLuM is trained deliberately (Monitor Polski, the Journal of Laws, transcripts) and already runs in mObywatel and city halls. For general tasks — summaries, classification, chat — Bielik under Apache 2.0 has no licence restrictions. Behind a gateway you can have both and choose per task
Bielik — yes, all versions under Apache 2.0. PLLuM — it depends on the variant: the new models from May 2026 are under licences allowing commercial use, the older “‑nc” variants are non-commercial only. The licence is checked on the model card and entered in the system register
Not always. Models up to 12 bn parameters run on one 24 GB card, Minitron 7B on a 6–8 GB card. Larger ones (PLLuM 70B) need a server with several cards — or a model at an operator in the EEA, available through the same gateway as local models
No. The deployer’s duties (register, literacy, prohibited practices, transparency) concern the use of the system, not its licence. An open model makes documentation easier — there is a model card and training data — but the register entry and the use policy are on the organisation’s side
In general multilingual tasks — usually yes, because it is smaller. In Polish official and legal language PLLuM and Bielik often answer more accurately than global models of the same class, and the data does not leave the organisation. In practice both approaches are combined behind one gateway
The AI Act does not certify assistants. The deployer’s duties — system register, literacy, content labelling, no prohibited practices — rest with the organisation regardless of the chosen service. The provider can help with documentation, but the organisation gathers the evidence
Processing takes place in the provider’s cloud, within the organisation’s tenant and under the provider’s contract terms (region, no training). For an organisation with an on-premises requirement, or one that cannot entrust data to an external processor, this criterion decides before the price does
No. Your own environment is a ready platform — a model gateway, an assistant on documents, a log — deployed in the organisation’s infrastructure or at an operator in the EEA. It differs from open source in service, contract and methodology; from provider services in that the data and processes stay in the organisation
Over the same horizon (3 years) and the same components: licences or models, infrastructure, maintenance, competences, deployment time and exit cost. The licence price per user is one of six elements
By the lack of a source. A language model answers fluently even when it has no data — hence non-existent articles of law and dates. An assistant working on the organisation’s documents (RAG) gives a citation and the place in the document; no source, no answer. The quiz in section 06 shows this on five pairs
Yes, if officials use AI tools — including private ones — with the office’s documents. As a deployer, the office is responsible for citizens’ data (GDPR) and for staff training (Art. 4 of the AI Act). The same template only needs adapting: the office’s document types, the approved tools and the person who approves the output
https://www.allclouds.pl/en/faq/