GDPR
Less content sent outside. The legal basis and the scope remain.
Compliance
A server in the building helps. It does not settle compliance by itself.
A local model limits how much content is sent to an outside provider. GDPR, the national cybersecurity act and the AI Act still depend on who you are and what the system does. What follows is a general description, not a legal opinion.
KSC / NIS2
Not every company is an essential or important entity.
AI Act
Your own server room does not switch the regulation off.
This is a general description, not legal advice. Duties depend on the organisation’s role and on the current text of the law.
GDPR in this kind of deployment
When the prompt and the documents do not go to a model API outside the organisation, one route for sending content to a party in another country drops away. That is a real difference from pasting letters into a public chat.
The rest stays: a legal basis, data minimisation, retention, people’s rights, and a data-protection impact assessment when the processing calls for one. An embedding and a question log can be personal data, even if “it is only a vector”.
If maintenance gives us access to that data, a processing agreement is needed for the specific scope. We do not assume one from this page.
NIS2 and the Polish KSC act
Directive (EU) 2022/2555 is implemented in Poland by the amendment to the National Cybersecurity System act of 23 January 2026 (Journal of Laws 2026, item 252). Duties apply to essential and important entities, not automatically to every company that installs a server.
The Ministry of Digital Affairs published transitional dates, including a self-registration window and a later period for security measures and the S46 system. When signing the act, the President also referred it for subsequent review by the Constitutional Tribunal. The current text, and whether an organisation is in scope at all, has to be checked against an official source or with your own lawyer.
On the engineering side, local AI sits in the same basket as the rest of the systems: admin accounts, backups, patching, logs, network segmentation. We do not issue “NIS2 compliant” certificates.
The AI Act, without a calendar on a slide
Regulation (EU) 2024/1689 classifies systems by risk and by role: model provider, system provider, deployer. Running weights on your own server does not place the organisation “outside the act”.
Some duties already apply, and the dates of later stages have been clarified over time. We do not copy a calendar here, because it is easy to print a date that is stale the next quarter. Judging a specific assistant needs its purpose, not the phrase “we have a GPU”.
We help with engineering that should exist anyway: telling the user that a program is replying, limiting data in the prompt, separating environments, and keeping a trace of who changed the index. That is not an audit of the act and not a substitute for counsel.
Questions
Does a local model mean GDPR compliance?
It means a narrower path for content, not automatic compliance. You still need a basis, a data scope, access control and a decision on how long logs and the index remain. Service access adds a processing agreement.
Does NIS2 apply to every company that wants local AI?
No. Scope follows sector, size and role under the national cybersecurity act, not the mere fact of having a model. We do not decide that on this page.
Can the AI Act be avoided by keeping the model on your own server?
No. Where it is installed does not replace classification of the system or the duties of the organisation that deploys or provides it. The text on this page is not legal advice.