Sovereign, EU AI Act-ready data operations
Putting AI agents on regulated data raises two questions fast: where does the data and every model call run, and what record exists of what the agents did? Data Workers runs in your own cloud, region or premises, on models you choose, and keeps the records that EU AI Act and GDPR reviews ask for.
Before and after
| Today | With Data Workers |
|---|---|
| AI tools that send prompts and sample data to a vendor's cloud | Agents run in your own cloud account, VPC or on-premises, in the region you pick |
| A model chosen by whoever supplies the tool | Your model, your keys, and a sovereign setting that keeps every AI call on models you host |
| Personal data located by hand before every GDPR question | Personal data found by scanning inside your network, with no sample values sent out |
| Records of what an AI did rebuilt from chat logs | A tamper-evident audit trail of every agent action, approver and result |
| A legal review that stalls each new AI use case | One policy path every agent goes through, so a new tool is connected under rules already agreed |
The EU AI Act sets record-keeping and human-oversight expectations for high-risk AI systems, and GDPR already governs where personal data goes. Dates for the Act's obligations have moved, so take them from the European Commission's AI Act page and not from a vendor. Whether a system is high-risk is a legal call for your counsel. The data engineer's guide to the EU AI Act goes deeper on the provisions; this page is about the operating model.
How it works
1. Run it inside your boundary
Data Workers runs in your cloud, your VPC or on-premises (Enterprise tier), so data, agents and audit records stay where your residency rules say. A sovereign setting keeps every AI call on models you host yourself, and you bring your own model and your own keys. See running Data Workers in your VPC or air-gapped.
2. Find personal data and hold agents to policy
The Data Access & Governance Agent finds personal data with scan_pii, and sample values never leave your network. It tests each access and each agent action against your rules with check_policy, so GDPR purpose and access limits apply to agents the same way they apply to people.
3. Keep the records and the human in charge
The Observability Agent reads back the tamper-evident audit trail with get_audit_trail: what was asked, what was approved and by whom, what ran and the result. The Data Access & Governance Agent compiles it into a records pack with generate_audit_report. Anything irreversible waits for a named human, which maps to the record-keeping and human-oversight expectations in the Act.
The impact metrics we move
- •Records pack for an AI system review: from about 2 weeks to 2 h
- •New AI tool connected under policy: from about a month to 4 h
- •Policy applied across domains: from about a week to 5 min
Where teams start
- •One regulated domain in your own cloud. Customer or patient data in a single EU region, with agents running beside it.
- •A sovereign pilot on your own model. Every AI call stays on a model you host, with no outside provider in the path.
- •Personal data inventory for GDPR. Scan the warehouse and tie each finding to an owner. See GDPR lineage and Article 30 records.
- •Records for an AI system review. The audit trail for the pipelines that feed one AI system, ready for your risk and legal teams.
- •Agent access review. Which tools each agent may use, and who approved each change, for your data protection officer.
What powers it
Deployment in your environment, the sovereign setting and the audit trail come with the Data-Agents Swarm. Autopilot Standards hold each domain to the rule your counsel signs off, and Autopilot Routines refresh the records on a schedule. The Autonomous Data-Conductor keeps work inside the autonomy each domain allows, and the Data Context Wizard shows what a change touches before it happens. The Data Access & Governance Agent and Observability Agent do the main work. Data Workers does not make you compliant; it provides the controls and records, as the guide to SOX, HIPAA, GDPR and the EU AI Act explains. For the record format auditors ask for, see MCP audit logging.
Where this shows up: sovereign context, audit evidence on demand and AI agent governance.
The climb: from assisted to autonomous to agentic
Every transformation runs on the same ladder from our thesis: agents first watch and suggest with receipts, then act in approved steps, and a domain moves up only on evidence. L0 to L2 run today. L3 and L4 are where a domain can go once its record earns it, and in a regulated domain that is a decision your owners make.
The pilot
- •Scope. One regulated domain, deployed in your cloud account or on-premises, on a model you choose.
- •First week. Agents start by watching and suggesting. They record every action and show the records pack they would have compiled.
- •By week two. Routine scans, policy checks and records packs run on their own; anything irreversible stays with a named approver.
- •At day 30. We review the impact metrics against your baseline:
- •Records pack for an AI system review: from about 2 weeks to 2 h
- •New AI tool connected under policy: from about a month to 4 h
- •Policy applied across domains: from about a week to 5 min
- •Cost. Start with a pilot ($7,500 one-time, credited in full against the first year). Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter and no markup on model spend. See pricing.
FAQ
Does this make us EU AI Act or GDPR compliant? No. It gives you the controls and records; your counsel and data protection officer decide what is sufficient.
Does any data or prompt leave our environment? With the sovereign setting, no prompt or data goes to an outside model provider, and sensitive-data scanning never sends sample values outside your network.
What stays with people? Irreversible changes, risk classification, legal interpretation and sign-off on any rise in a domain's autonomy.
Which stacks? Snowflake, Databricks and BigQuery, with dbt and Airflow, among 50+ connectors.
What if the agent is wrong? Every write is previewed and approved first, and the record shows who approved it.