GPU Solutions

Solutions · Public sector

AI for the public sector, with citizens' data kept in Spain on an ENS-certified platform

GPU Solutions offers public administrations and bodies open AI models running on its own NVIDIA B200 GPUs in a Tier III datacenter in Madrid. Our platform is certified to the Medium category of the ENS (Spain's National Security Framework) by EQA and runs in a datacenter certified to ENS High, which covers Basic and Medium category systems at the platform layer.

In short
  • Platform certified to ENS Medium and ISO/IEC 27001:2023 by EQA.
  • Tier III datacenter in Madrid with ENS High, ISO/IEC 27001:2022, ISO 9001 and ISO 50001.
  • Data processed and stored in Spain, with no subprocessors outside the EU.
  • Open models such as ALIA 40B (Barcelona Supercomputing Center), never trained on your data.

AI in public administration: real value with data that must stay home

Public administrations handle huge volumes of text: regulations, case files, minutes, citizen enquiries. AI helps serve people better and faster: answering questions about a procedure while citing the rule, digitising paper files, transcribing council meetings or giving staff an assistant over internal procedures. These are concrete improvements in response times and accessibility, including in Spain's co-official languages.

That data belongs to citizens, and the legal framework is demanding. Spain's National Security Framework (ENS, Royal Decree 311/2022) applies to the public sector and to private providers serving it, with measures proportional to each system's category. The GDPR and Spain's LOPDGDD govern personal data processing. The AI Act treats some public uses as high-risk, such as assessing eligibility for essential public benefits and services, with obligations applying from 2 December 2027 after the 2026 digital omnibus on AI. And the NIS2 Directive, whose transposing law is still going through Spain's legislative process, strengthens cybersecurity for the administrations within its scope.

So the question is not only which model to use, but where it runs and with what guarantees. Our platform is certified to ENS Medium on top of a datacenter certified to ENS High, with our own team in Spain. We explain what each category means in ENS and AI: Medium and High category; technical detail is on infrastructure, rates on pricing and regulatory deadlines in the regulatory radar.

Use cases for public administrations and bodies

Four uses that already work with open models on our infrastructure. They can be tested first on GPU Flow with public or non-sensitive information and then moved to a private environment.

Citizen-service assistant over regulations

An assistant answers citizens' questions about the requirements, deadlines and paperwork for a procedure, drawing on the body's own regulations and bylaws and citing the article behind each answer. It tells people they are talking to an AI and hands over to a civil servant when the enquiry calls for it. With models such as ALIA 40B or Qwen it can reply in Spanish and in co-official languages, which is worth validating with real cases.

ALIA 40B or Qwen3.8 · search with cited sources (RAG) · private endpoint

Digitisation and OCR of case files

Archives holding years of paper files, or scans without text, become searchable documents and structured data: procedure type, dates, amounts, signatures present. A vision-language model extracts the information and a second step checks it against the body's own rules. Everything happens on our GPUs in Madrid, without sending documents to external OCR services, and the output stays in your own storage space.

Qwen3-VL 32B OCR · Nemotron Nano 12B VL · batch processing on a dedicated pod

Transcription of council sessions and meetings

Recordings of plenary sessions, committees or meetings are transcribed with Whisper large-v3, a multilingual model that supports Spanish and other co-official languages; it is worth validating on your own recordings. A language model then drafts the minutes, an index by speaker and the resolutions adopted, which the clerk's office reviews before publishing. Audio is processed in Spain and, with zero retention, is not kept after transcription.

Whisper large-v3 · Nemotron 3.5 Lightning 30B for minutes · optional zero retention

Assistant for staff over internal procedures

Staff ask how to process a case file, which decision template to use or what the current internal instruction says, and the assistant answers by citing the document. It cuts repeated questions between departments and makes onboarding new staff easier. Internal documents are indexed in a dedicated space with permissions per department, and the administrative decision always remains with the responsible official, never with the model.

Qwen3 14B or Gemma 4 26B · RAG over internal documentation · MIG fraction or dedicated pod

How citizens' data travels

The path of an enquiry or a case file, from your systems to the answer, always inside Spain.

  1. 01

    Connection from your network

    Data arrives over TLS or over a dedicated encrypted point-to-point link, with post-quantum cryptography available.

  2. 02

    ENS Medium platform in Madrid

    It is processed on NVIDIA B200 GPUs on our ENS Medium certified platform, inside a Tier III datacenter certified to ENS High.

  3. 03

    Storage and logs under control

    Documents and indexes are kept in your storage space, with defined quotas and access. With zero retention, requests are not kept once answered.

  4. 04

    A verifiable answer

    The answer comes with references to the source so a civil servant can check it. No data is used to train models.

Regulatory framework and how we help

The rules that frame AI in the public sector and the part our platform covers. Categorising each system under the ENS is the body's responsibility; if your system is High category, we review your scope with you.

Regulatory framework and how we help
RuleWhat it requiresHow we help
ENS (Royal Decree 311/2022)Security measures proportional to the system's category (Basic, Medium or High), applying to the public sector and to private providers serving it, with certified conformity.Platform certified to ENS Medium by EQA on a datacenter certified to ENS High: covers Basic and Medium category systems at the platform layer. For High category, we review your scope.
GDPR and LOPDGDDA legal basis for each processing activity, a data protection officer for public authorities and bodies, a processing agreement and control of transfers outside the European Economic Area.Standard DPA, data processed and stored in Spain, no subprocessors outside the EU and optional zero retention.
AI ActObligations for high-risk systems, such as those assessing access to essential public benefits and services, from 2 December 2027; public bodies using them must assess their impact on fundamental rights. Transparency when citizens interact with an AI.Open models with identified versions, documented infrastructure and logs under your control for technical documentation and human oversight.
NIS2 (Directive (EU) 2022/2555)Risk management, incident reporting and supply chain security for the administrations within its scope. In Spain the transposing law is still going through the legislative process.Platform certified to ISO/IEC 27001:2023 and ENS Medium, security documentation for your supplier assessment and our own team in Spain.
Spanish Law 40/2015 and Public Sector Contracts Law 9/2017For automated administrative action, designating in advance the body responsible for its specification, supervision, quality control and audit; in procurement, publicity, transparency and equal treatment.Public list prices, verifiable technical specifications and security documentation ready to include in tender specifications and procurement files.

Regulatory radar: public sector

Deadlines and updates from the ENS, the AI Act, NIS2 and data protection law that affect public administrations, with official sources. Full view in the regulatory radar.

  1. AI Act high-risk obligations for Annex III systems start to apply

    Covers credit scoring, life and health insurance pricing, justice, essential public services and employment. Requires risk management, data quality, logging, human oversight and technical documentation.

    Official source: EUR-Lex · Reglamento (UE) 2026/1744 ↗

    DeadlineEU

  2. EuroHPC AI Gigafactories call closes (up to 7 consortia)

    Awards are expected in early 2027. Spain is bidding with a public-private candidacy. It signals where European compute capacity for training and running models will be located.

    Official source: EuroHPC ↗

    DeadlineEU

  3. Comunidad de Madrid begins deploying its sovereign AI cloud in Alcalá de Henares

    The stated goal is to strengthen data protection and speed up AI use in the regional administration. It confirms the public-sector trend towards infrastructure under its own control.

    Official source: Comunidad de Madrid ↗

    OngoingSpain

  4. AI Omnibus Regulation (EU) 2026/1744 published: new timetable for high-risk AI

    In force since 27 July 2026. Annex III obligations move to 2 December 2027 and Annex I obligations (AI in regulated products such as medical devices) to 2 August 2028.

    Official source: EUR-Lex · Reglamento (UE) 2026/1744 ↗

    In forceEU

  5. CCN-CERT BP/36: good practices against offensive AI

    Recommends asset inventory, patching prioritised by exploitability, phishing-resistant authentication and governance of AI agents. A practical reference for bodies subject to the ENS.

    Official source: CCN-CERT ↗

    PublishedSpain

  6. Commission consults on draft guidelines for classifying high-risk AI systems

    The guidelines will use examples to clarify which use cases fall under the high-risk regime. The final version is expected at the end of 2026 and will help organisations review their AI system inventory.

    Official source: Comisión Europea ↗

    ProposalEU

  7. CGPJ Instruction 2/2026: judges may only use AI tools provided by the Administration

    It requires human control of every output and bans entering case data into non-official AI systems. It sets the confidentiality standard expected around the judiciary.

    Official source: BOE-A-2026-2205 ↗

    In forceSpain

Recent laws, guidance and decisions →

Frequently asked questions

Which ENS category does your platform cover?

Our platform is certified to ENS Medium by EQA and runs in a Tier III datacenter in Madrid certified to ENS High. That covers Basic and Medium category systems at the platform layer. If your system is categorised as High, we review the scope with your security team to define the right fit.

Where is citizens' data processed and stored?

In Spain. Data is processed on our own NVIDIA B200 GPUs in a Tier III datacenter in Madrid and stored there, with no subprocessors outside the EU. We sign a standard DPA with optional zero retention, and the data is never used to train models. Datacenter visits can be arranged by appointment.

Is a citizen-service chatbot high-risk under the AI Act?

Usually not, as long as it informs and guides without deciding on anyone's rights. The AI Act requires transparency: people must know they are talking to an AI. Systems that assess eligibility for public benefits, for example, would be high-risk, with obligations from 2 December 2027. Each case is worth reviewing with your legal team.

How can a public body contract with you?

Through whichever procedure under Spain's Public Sector Contracts Law 9/2017 fits the amount and scope. Our list prices are public (for example, €8.00/h for a full NVIDIA B200 GPU, excluding VAT) and we provide technical specifications, certificates and security documentation for the procurement file. See pricing or write to us.

Which models can we use, and in which languages?

Open models such as ALIA 40B from the Barcelona Supercomputing Center, Qwen, GLM, Gemma and Nemotron, plus Whisper large-v3 for transcription and text-to-speech models. All of them run on our GPUs, with no third-party APIs. For Spanish and co-official languages we recommend validating with your own texts and recordings before deployment.

How long does it take to launch a pilot?

A standard dedicated environment is ready 72 hours after signature. Before that you can test the models on GPU Flow with non-sensitive data and size the real workload with us on our cluster. Support comes from our own team in Spain, in Spanish and English, with a response in under 4 hours on business days and a public status page.

Let's talk

Tell us about the system and its ENS category and we will review your scope

Review my case →