Your sector has its own wall.
Your fab, plant or bank keeps data inside for its own reasons, under its own rules. Each page starts with those rules and shows the Kernwall control that answers each one, and the evidence you hand your assessor.
Sectors
Find your sector. Read its mapping.
01Mapping published
Semiconductors and manufacturing
The Machinery Regulation's cyber clauses and SEMI's fab-equipment standards, mapped row by row to Kernwall's controls and the evidence your assessor takes away.
- Machinery Reg. 2023/1230
- SEMI E187
- IEC 62443-4-2
02Mapping published
Defense and its suppliers
The VS-NfD rulebook's air-gapped route, mapped clause by clause to each control and whether Kernwall or you own it, plus the 2026 law that lets the Bundeswehr buy European.
- VS-NfD-Merkblatt
- BwBBG
- NIST SP 800-171
03Mapping published
Energy and nuclear
Where an advisory model sits against your plant's defensive levels, which model licences rule out nuclear use, and the EU clocks you face as an energy supplier.
- NRC RG 5.71
- NIS2
- Llama AUP §3.1
04Mapping published
Healthcare
Why a box your hospital runs answers to § 391, not the C5 gate for hosted AI, the AI Act dates for triage and device AI, and your deployer duties mapped to controls.
- § 391 SGB V
- § 393 SGB V
- AI Act Art. 26
05Mapping published
Financial services
Why an on-site AI vendor still goes in your DORA register, BaFin's own comparison of on-premise, tenant and API models, and the Art. 30 clauses mapped to Kernwall's controls.
- DORA Art. 30
- BaFin AI guidance
- AI Act Annex III
06Mapping published
Government
Germany's federal AI platform already runs open models on its own servers for VS-NfD data. Kernwall brings the same pattern to your office, outside that network.
- VS-NfD
- AI Act Art. 27
- SREN Art. 31
Use cases
One OS, from your line to your enclave.
The same signed Kernwall image runs on a fanless edge box and on a multi-GPU server. It is built first for these jobs. Each row runs its session in a window.
- 01 · Kernwall Edge
Visual inspection on the line
A fanless box beside the conveyor checks every part where the camera is. Images never leave the cell, and flagged parts wait for a human verdict.
- Jetson Thor T5000, 128 GB
- 40–130 W, fanless
- Factory line
edge-line-3station 3 · model weld-seam-v4 · signed ✓part 4417 passpart 4418 passpart 4419 porosity at seam 2 · held for reviewpart 4420 passimages stored on the appliance · outbound connections: 0 - 02 · Kernwall Workgroup
Engineering copilot over your SOPs
Your engineers ask in plain words. Answers cite the SOP and section, and only from files they may already open.
- 2–4× RTX PRO 6000
- Up to 50 named users on a 120B MoE
- Comms room, 230 V
ai.fab.local$ Why do we re-season the chamber after a wet clean?To restore a stable wall coating before product wafers run, so etch rate and uniformity match the qualified baseline.sources: SOP-ETCH-114 §4.2 · PM-CHK-031 §2access: inherited from the file share ACLs - 03 · Kernwall Edge
Voice agent on the shop floor
Hands busy, gloves on: your operators ask out loud and hear the answer. Speech recognition and the model both run in the box, so the audio stays on site.
- Jetson Thor T5000, 128 GB
- Speech recognition and 8–30B models
- Line, vehicle or forward site
edge-hall-b▍▍▌▍▎▍▌▍▍▎ listening · transcribed on device$ What torque for the M8 flange bolts on pump 2?WI-PMP-207, step 6: cross pattern, two passes. The torque value is on the panel.audio kept locally per site policy · outbound connections: 0 - 04 · Kernwall Desk
Procurement analysis on a classified network
Your analysts compare bids against the requirement inside the enclave. The model, the documents and the audit trail stay on the restricted network, with nothing to declassify.
- DGX Spark-class, 128 GB
- 1–5 users
- ~150–250 W, office
analyst-ws-02$ Compare the three bids for lot 4 against requirement R-12.Bid A meets R-12. Bid B meets it with a deviation in §3.4. Bid C does not state compliance.network: restricted enclave · no uplinkquery and answer written to the audit chain ✓