Where your intelligence lives: the case for European AI

In June 2025, a French Senate inquiry into public procurement and digital sovereignty put a simple question to Anton Carniaux, then director of public and legal affairs at Microsoft France. Could he guarantee, under oath, that data belonging to French citizens would never be handed to the United States government without France’s agreement?

He answered honestly. He could not guarantee that. He added that it had never happened.

Both parts of that answer are worth taking seriously. The second part is reassuring. The first is a statement about law, not intent. Under the US CLOUD Act, American authorities can compel a US provider to produce data in its possession, custody or control, wherever that data is physically stored. A data centre in Dublin or Frankfurt changes where the data sits. It does not change whose courts can reach it.

This is not an essay against American technology. We use excellent American and Asian models, and we have learned from them. It is an essay about a question that every European enterprise adopting AI will eventually be asked by its board, its regulator or its customers: where does your intelligence actually live, and who answers for it?

We think that question deserves a careful answer. We also think we are one of the companies equipped to help you give one.

The gap is not access. It is confidence.

Europe does not lack access to AI. Any business with a credit card can call a frontier model this afternoon. Yet in 2025, only about one in five EU enterprises with ten or more employees used any AI technology at all, according to Eurostat. Ireland sat at the same level: the CSO reports that 20.2% of Irish enterprises used AI in some capacity, rising to 57.7% of large enterprises.

The more revealing figures concern the businesses that looked at AI and walked away. Among EU enterprises that considered AI but did not adopt it, around seven in ten cited a lack of relevant expertise. Roughly half cited uncertainty about the legal consequences, and roughly half cited concerns about breaching data protection and privacy. Those shares apply to a small group, around one in ten enterprises, so they should not be stretched. But they describe a recognisable pattern.

The obstacle is not the model. It is everything around it: knowing which task to give it, knowing what data it may touch, knowing where that data goes, and knowing how to show someone else that the system behaves as claimed.

That is the work we have spent the last three years doing for our own products. It is also the work most enterprises cannot easily hire for.

The rulebook is arriving, in stages

The legal picture is clearer than it was a year ago, but it is not finished.

The EU AI Act is in force. Its prohibitions and AI literacy obligations have applied since February 2025. In July 2026, the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force and moved the high-risk deadlines: obligations for stand-alone high-risk systems listed in Annex III now apply from 2 December 2027, and those for AI embedded in regulated products from 2 August 2028. The delay is a reprieve for planning. It is not a reason to stop.

Ireland has built its own machinery. The Regulation of Artificial Intelligence Act 2026 was signed into law in July and established the AI Office of Ireland, Oifig IS na hÉireann, as the national coordinating body for the AI Act. Irish organisations will deal with Irish regulators, under European law, in their own jurisdiction.

Transatlantic data transfers rest on firmer but still contested ground. The EU–US Data Privacy Framework was upheld by the EU General Court in September 2025. That ruling is under appeal to the Court of Justice in Case C-703/25 P. Its two predecessors, Safe Harbour in 2015 and Privacy Shield in 2020, were both struck down by that court. An enterprise that builds its AI strategy on a single transfer mechanism is, in effect, betting on the outcome of litigation it does not control.

None of this means that every workload must stay in Europe. It means the decision should be made deliberately, workload by workload, with a fallback that does not depend on a court in Luxembourg.

What we have actually built

We prefer to describe experience by what has been shipped and used. Leemer Group is four products built from Waterford since 2023, and each one taught us something that applies directly to enterprise AI.

Leemer Chat (February 2023): making models useful to real people. Before any question of infrastructure, there is the question of whether people will use the tool at all. Leemer Chat taught us that the interface, the continuity of context and the move from a question to something usable decide adoption more than benchmark scores do. Most failed enterprise pilots fail here, not in the model.

Leemer Labs (mid-2025): models adapted to a job, run where the data lives. Leemer Labs trains, fine-tunes, evaluates and serves models. We have worked with companies and AI experts on model training and fine-tuning, and tested early models from providers including Z.ai, Moonshot AI and OpenAI. Our inference runs on NVIDIA H200 GPUs in Ireland, with a data region in Dublin and Waterford, behind an OpenAI-compatible gateway: your existing tooling changes one URL, not its architecture. The Born programme post-trains open-weight models on NVIDIA B200 GPUs with a 50-billion-token dataset we built for the work. Born2-9B, our code-review specialist, is in API preview from Europe today. Our 9B Irish model is designed to be small enough for an organisation to host on infrastructure it controls, so contracts, case files and internal documents never pass through a third party.

Critique.sh (April 2026): evidence, not confidence. Critique exists because producing an answer and establishing that the answer is sound are different jobs. Since launch it has reviewed hundreds of millions of lines of code and processed billions of tokens. The discipline it enforces, a concrete finding, a reproduction where possible, the checks performed and an honest account of what remains uncertain, is exactly the discipline an auditor will ask of any AI system you deploy.

DáilDex: high-stakes information, held to its source. DáilDex makes the Irish parliamentary record easier to follow. It has been used by multiple TDs and ministers, and by people working in the office of the Minister for Health and the office of the Taoiseach. When the readers are the people who make the law, every answer has to be traceable to the record and clear about the line between source and explanation. That is the same standard a regulated enterprise needs from an internal knowledge system.

Four different products. One lesson repeated: AI earns its place when it is close to the problem, close to the data and accountable for what it says.

What we can work on with you

We work best with organisations that have a defined problem and data they care about. Typical engagements look like this:

Sectors where these questions are sharpest include financial services, healthcare, legal and professional services, the public sector, and software companies building AI into their own products. Financial entities already working under DORA and organisations in scope of NIS2 will recognise the theme: third-party dependency is a risk to be managed, not a detail to be assumed away.

What we will not tell you

An honest pitch has edges, so here are ours.

We are small, on purpose. We are not a hyperscaler, and we will not pretend to replace one across your whole estate. We are a focused team that stays close to the work, and that is why we are useful on the parts that matter most.

Being European is not a compliance certificate. European infrastructure removes one category of exposure. It does not make a badly designed system lawful. We will help you do the rest of the work too: data minimisation, purpose limitation, documentation and evaluation.

Not everything needs a model. Some of the most valuable advice we give is to use deterministic software instead. We would rather lose an engagement than sell you AI where a database query would do.

Our own claims are labelled. Where we report our own benchmark results, usage or throughput, we say so, and we say when a figure is preliminary. We expect the same discipline from any system we help you build.

Where to start

The best first conversation is narrow. Bring one workflow, one body of data and one question you need answered well. We will tell you whether AI is the right tool, where it should run, what it would cost to operate and how you would know it was working.

If you are a European or Irish organisation weighing where your intelligence should live, write to hello@leemerlabs.ie. A person in Waterford will reply.

The question from that Senate hearing will reach your organisation eventually. It is better to have an answer ready than to discover you never had one.

Sources

• The Register: Microsoft admits it ‘cannot guarantee’ data sovereignty, on the French Senate hearing.
• Eurostat: Use of artificial intelligence in enterprises.
• CSO: Information Society Statistics, Enterprises 2025, Artificial Intelligence.
• EESC policy note on AI adoption, on reasons for non-adoption.
• Digital Omnibus on AI, Regulation (EU) 2026/1744.
• Department of Enterprise, Tourism and Employment: AI Office of Ireland established.
• WilmerHale: Court of Justice to review challenge to the EU–US Data Privacy Framework.
• Leemer Labs, on inference infrastructure and the Born programme.