The federal government already runs its models on its own servers.
Germany's AI platform for officials runs open models, each with a model card, on a network cut off from the internet, and takes VS-NfD data. Kernwall OS puts the same pattern in one box for public bodies outside that network.
Germany · KIPITZ
Open models, model cards, no outside providers.
The federal government described its own platform to the Bundestag this summer. It is the pattern an appliance packages.
VS-NfD data, and nothing sent to outside AI providers.
Its answer to a parliamentary question: the central AI platform KIPITZ runs in ITZBund's data centres, may process data classified VS-NfD, and transmits no data to external AI providers. The finance ministry allows public AI services for publicly available data only.
Open models with model cards, on a network cut off from the internet.
KIPITZ mostly uses open-source models on its own servers in the federal network. Each model carries a model card on its origin. ITZBund downloads and installs them, with no training of its own, to reduce legal risk.
A sovereign AI cloud for federal, state and local use.
For scale, the same government awarded an AI platform to Deutsche Telekom with SAP, naming KIPITZ as an early application. The announcement names no classification level and no on-premises option.
KIPITZ is ITZBund's own platform in its own data centres. It does not run Kernwall OS, and we do not suggest it should. Our reading is narrower: a Land ministry, a court, a police site or a city outside the federal network wants the same properties without building a platform team first.
An authority runs VS-NfD under its own directive, the VSA, and we map it below. The Merkblatt companies sign on contract is on the defense page.
Who holds the switch
Two events in four months put access in another state's hands.
One hit an international court's licences, the other every customer of two hosted models.
A court's software now rests on a revocable US licence.
The US designated the ICC itself. General licence 14 still permits telecoms and enterprise software for the court, with no stated expiry. General licence 13 winds everything else down by 7 Apr 2027.
Two frontier models, switched off for every customer.
A US export-control directive required a licence for foreign nationals to use two models, so their provider disabled both worldwide. One came back globally from 1 Jul; the other only for some US organisations.
What the ECB made of itThe court's enterprise software is still licensed. The point is that the licence can be withdrawn by a government the court does not answer to. Open weights already on an appliance in your building keep answering whatever happens to a remote service, because nothing on the box calls out.
France · the Commission
Public buyers already score clouds on who can switch them off.
Both rules are written for cloud services. A box the administration owns and runs is a different thing, and we say so plainly.
SecNumCloud is law for the State's most sensitive data in private clouds.
Décret 2026-272 covers State administrations, their operators and named public-interest groups, for particularly sensitive data processed by a cloud service from a private provider. ANSSI's SecNumCloud 3.2 framework was approved by arrêté of 12 Aug 2026.
EU institutions now buy cloud by sovereignty score.
The Commission's first tender under its Cloud Sovereignty Framework set SEAL-2 as the floor. Four bidders reached SEAL-3.
The French decree governs a cloud service “fourni par un prestataire privé”. An appliance an administration owns, racks and runs, with no vendor access, is not that in our reading. Your security officer decides.
SEAL levels score cloud providers, not appliances, and none applies to Kernwall OS. The GPUs inside are US-made, so a “chips to software” EU claim would be false. What we can show is the EU signing chain and an appliance nobody else can reach.
Why now
Three dates have passed. The AI Act's is next.
A drafting, summarising or translation assistant is not high-risk under the AI Act on its own. Benefits, policing, migration and justice uses are, from Dec 2027.
- Jul 2024KIPITZ runs open models on federal servers.
- Apr 2026France puts sensitive State cloud data on SecNumCloud.
- Oct 2026The US designated the ICC; wind-down ends Apr 2027.
- Dec 2027Benefits, policing, migration and justice AI become high-risk.
First job
Summarise the file, list what is open. An official signs.
A case summary on a VS-NfD file, cited to its documents, is the job the appliance is built for first. The window runs one.
Summarising a grant file is not an Annex III use. Using the model to decide who gets public benefits, or in policing, migration or the courts, would be high-risk from 2 Dec 2027, with the duties mapped below.
VSA · BSI CON.11.1
Your head of authority releases it. Here is what they check.
Federal bodies run VS-NfD under the VSA, and NRW adopted the same release rule in 2024. Each row maps a duty to the control designed for it and who carries it.
- VSA § 50(1), (4) · Release
VS-NfD is processed only on IT released for it. The head of the authority releases it; an ISO 27001 certificate on IT-Grundschutz, with the classified-information module, is the named way to show it.
“…Die Dienststellenleitung erteilt die Freigabe…”
Your site owns itYour head of authority releases it. We supply the evidence your ISMS asks for: threat model, SBOM and AI-BOM, egress audit and the configuration record.
Evidence you take awayEvidence pack per release, for your ISMS and release file
- VSA § 50(9) · Changes
A change that touches secrecy protection on released IT needs the officer's consent first.
“…bedürfen der vorherigen Zustimmung…”
SharedNothing changes on the box until a signed bundle is carried in. Each release lists its changes, so your officer can consent before the import, not after.
Evidence you take awayRelease notes and digests; import events in the audit chain
- VSA §§ 51, 52 · CON.11.1.A3 · Security products
Each security function is assigned to a component. Where the BSI's catalogue says a product type needs an approval, an approved product is used.
SharedWe hold no BSI approval and claim none. Functions that need one stay on your approved products; we list which § 52 functions the image itself performs, so your officer can assign them.
Evidence you take awaySecurity-function list per release (planned)
- CON.11.1.A9 · Storage
Stored VS-NfD is encrypted with an approved product, or physically secured as the VSA requires.
“…entsprechend den Vorgaben der VSA materiell gesichert…”
Your site owns itThe appliance's disk encryption is not BSI-approved, so the box is the physically secured kind: in a locked room or rack your officer specifies. That is our reading.
Evidence you take awayYour room and key records
- CON.11.1.A4 · Procurement
Contracts keep the disks of defective or leased hardware with the authority.
“…im Besitz der Dienststelle verbleiben…”
SharedDrives stay with you. A unit goes back for repair without its disks, and the replacement is provisioned from the signed image.
Evidence you take awayRepair terms in the contract; re-provisioning record (planned)
- CON.11.1.A6, A17 · Maintenance
Maintenance should happen on the premises, and outside staff who are not obligated are accompanied throughout.
“…innerhalb der eigenen Dienstliegenschaft…”
SharedWe install and service on site, accompanied by your staff, and need no access to VS-NfD to do it.
Evidence you take awayService visit record; administrator actions in the audit chain
- CON.11.1.A18 · Remote maintenance
A remote-maintenance link needs approved encryption, is opened and closed by the authority, and makes the far end VS-IT too.
“…durch die Dienststelle auf- und abgebaut…”
Kernwall OS builds itThere is no remote maintenance to secure. The image runs no remote-access service; updates arrive as signed offline bundles.
Evidence you take awayEgress audit report; listening-services manifest per release (planned)
- VSA § 58 · CON.11.1.A16 · Interconnection
Before VS-IT is connected to other VS-IT, the authority checks what may flow and documents why the link is needed.
SharedThe box ships with no uplink. If you put it on your VS-NfD house network, the manifest names every listening port for that check.
Evidence you take awayListening-services manifest per release (planned)
- VSA § 55(2) · Anlage V 6.2 · Transfer
VS-NfD travels only over released IT. Inside a released network it may go unencrypted; outside it, approved encryption is the rule.
Your site owns itUsers reach the box over your released house network. The box itself sends nothing beyond it.
Evidence you take awayNetwork plan in your release file; egress audit report
VSA and BSI CON.11.1 duties for VS-NfD IT in an authority, mapped to appliance controls.
At VS-NfD the release is your authority's, not the BSI's; its vote comes in only from VS-VERTRAULICH up. No AI product holds a BSI approval, Kernwall OS included, and the module's heaviest item, remote maintenance, does not arise on a box with no remote access.
AI Act Art. 26 and 27 · SREN Art. 31
What a public body has to write down before a high-risk use.
Public bodies carry duties private deployers mostly do not: an impact assessment and registration. Each row maps a duty to the control designed for it and who carries it.
- AI Act Art. 27(1)(a)–(b) · Impact assessment
Before first use of a high-risk system, a public body assesses its impact on fundamental rights, starting with the processes it is used in and how long and how often.
“…Prior to deploying a high-risk AI system…”
SharedA fixed system to describe: one signed image with pinned model versions and a model card per model, so the description holds until the body changes it.
Evidence you take awayAI-BOM and model cards per release; release ledger
- AI Act Art. 27(1)(e) · Oversight
The assessment describes how human oversight is implemented, according to the instructions for use.
“…according to the instructions for use…”
SharedEvery answer is a draft that a named official signs. The instructions for use name those checkpoints, so the assessment can quote them.
Evidence you take awayInstructions for use per release (planned); sign-off events in the audit chain
- AI Act Art. 27(2) · Changes
If an element of the assessment changes or is out of date, the body updates it.
Your site owns itNothing changes on the box until the body carries in a signed bundle. Each release lists its model and policy changes, so the body can see when to update.
Evidence you take awayModel and policy changes in the release notes; release ledger
- AI Act Art. 27(3) · Notification
The body notifies the market surveillance authority of the results, on the template the AI Office provides.
Your site owns itThe body's own step. We supply the system facts the template asks for: versions, data flows and logging.
Evidence you take awaySystem description per release (planned)
- AI Act Art. 26(2) · Oversight staff
Oversight goes to people with the necessary competence, training and authority.
“…necessary competence, training and authority…”
Your site owns itRoles come from the body's own directory. We train administrators and users on site at installation.
Evidence you take awayRole assignments in the audit chain; training record (planned)
- AI Act Art. 26(6) · Logs
Deployers keep the system's automatically generated logs for at least six months.
“…of at least six months…”
SharedPrompts, answers, user and model version are logged append-only on the appliance's own disks, kept as long as the body sets. No copy sits with a vendor.
Evidence you take awayHash-chained log export; retention setting per appliance
- AI Act Art. 26(8) · Registration
Public authorities register their use of a high-risk system, and may not use one that is missing from the EU database.
“…they shall not use that system…”
SharedThe body registers its use. Each release carries a stable identifier and digest, so the entry names exactly what runs on the box.
Evidence you take awayRelease identifiers and digests in the release ledger
- SREN Art. 31 · Private cloud
In France, the State's particularly sensitive data processed by a cloud service from a private provider needs a SecNumCloud-qualified service.
Your site owns itIn our reading this row does not apply: the administration owns and runs the box, and the vendor has no access to it. Ask your RSSI.
Evidence you take awayStatement of no vendor access; egress audit report
Public-body deployer duties and the French cloud rule mapped to appliance controls.
An impact assessment describes one system. A hosted model can change under it overnight. A signed, pinned image changes only when the body carries in the next release, so the assessment stays true until then.
Test it
Bring your first use case to a pilot.
Tell us which files the assistant would read and what your security officer checks before release. The pilot runs on your hardware, inside your network, against that list.