This article is part of our curated Growth Hub — five pillars on sovereignty, AI, cloud economics, data and security. Visit the Growth Hub.
Europe has spent five years debating sovereignty at the infrastructure layer: which cloud, which region, whose keys, whose jurisdiction. Meanwhile, the most sensitive text in most organisations is produced somewhere nobody mapped. A caseworker dictates a file note. A doctor summarises a consultation. A control-room engineer writes up an incident at 3 a.m. If that dictation runs through a cloud speech API, the organisation has quietly built an export route for personal data that no architecture board ever approved and no processing register describes.
Local-first AI closes that route by moving the model to the data instead of the data to the model. It is not a complete sovereignty strategy and it does not replace a sovereign cloud programme. It is something more immediately useful: the one sovereignty control a public authority, a hospital or a KRITIS operator can deploy this quarter — without a migration, a data centre, or a single new cloud contract. This article sets out where local-first AI fits, what it answers under the GDPR, NIS2, the KRITIS-Dachgesetz and the EU AI Act, where it stops, and how we built Secretary42 to that standard.
Key takeaways
- The endpoint is the unmapped part of most sovereignty programmes — dictation, transcription and summarisation tools that staff install themselves, outside procurement.
- Local-first processing removes the compliance surface instead of documenting it: for the speech path there is no recipient, no transfer, no processor contract and no sub-processor list to maintain.
- One architectural decision answers parts of four rulebooks at once: GDPR data minimisation, NIS2 supply-chain duties (in force in Germany since 6 December 2025), KRITIS resilience obligations (registration opens 17 July 2026), and the EU AI Act transparency duties that still apply from 2 August 2026.
- It is deployable in a quarter — and it is not a substitute for a sovereign cloud, key management or a BSI C5 attestation. Knowing that boundary is what makes the argument credible in a tender.
- Secretary42 is our worked example: a bundled whisper.cpp engine, no cloud transcription fallback, local history, and diagnostics that are opt-in and off by default.
Europe’s sovereignty blind spot is the endpoint
Sovereignty programmes are usually scoped top-down: core systems, then the data platform, then the cloud landing zone. That is the right order for infrastructure, and it is also why the endpoint is consistently last. The result is a familiar gap. An authority that has spent two years negotiating data residency for its case management system has staff pasting the same case details into a browser-based transcription tool with a free tier and a US processor.
This is not a training problem. It is an availability problem: dictation is the fastest way to turn a thought into a document, and if the only fast option is a cloud service, people will use the cloud service. The fix is not a policy banning it. The fix is a local option that is at least as fast, so the compliant path is also the convenient one.
What “local-first” has to mean to count
The term is being used loosely, including by vendors whose products are local right up until the moment they are not. Four properties decide whether a claim survives a vendor security review.
The model runs where the data is created
Speech-to-text executes on the endpoint, using a model stored on that endpoint. Audio is never uploaded for inference. This is the property that removes the transfer, and everything else follows from it.
There is no cloud fallback
A “local” product that silently switches to a cloud API for long recordings, unsupported languages or a low-memory device is not local. It is a cloud product with a local cache, and it fails a review the moment an auditor asks under which conditions the fallback triggers. The absence of a fallback is the testable claim — and it is testable on your own network.
The history stays local and the user controls it
Transcripts are personal data even when the audio is gone. If history lives in a vendor account, the transfer came back through a different door. Local storage that the user can view, copy and delete keeps the deletion obligation where it can actually be honoured.
It works offline
Offline capability is the proof that the previous three properties are real. It is also an operational control in its own right, which is exactly why it matters to critical infrastructure.
What the rulebooks ask — and what local-first answers
GDPR: the shortest possible answer
Data minimisation under Art. 5 is usually argued. With on-device processing it is demonstrated: the audio never leaves the device, so there is no recipient to name, no Art. 28 processor contract for the speech path, and no Art. 44 ff. transfer assessment to defend. For special-category data under Art. 9 — health records, social services files, HR investigations — that difference is not cosmetic. It is the difference between a DPIA that documents mitigations and a DPIA that documents an absence of processing by third parties.
NIS2 and the KRITIS-Dachgesetz: one fewer dependency
Germany’s NIS2 implementation (NIS2UmsuCG, amending the BSIG) has applied since 6 December 2025 with no transition period, covering roughly 29,500 entities across 18 sectors, with incident reporting at 24 hours, 72 hours and one month. Supply-chain security is an explicit duty — and every cloud AI service in the workflow is a supply-chain entry you must inventory, assess and monitor. A local tool is one fewer.
The KRITIS-Dachgesetz adds the physical-resilience layer: registration opens on 17 July 2026, with a first risk analysis due nine months after registration and a resilience plan a month later, for operators in ten sectors above the 500,000-resident threshold. Resilience plans have to assume degraded conditions. A dictation tool that stops working when connectivity does is a dependency you have to plan around; one that runs on the device is not.
EU AI Act: what still lands in August 2026
The Digital Omnibus agreed in May 2026 deferred the high-risk obligations — Annex III systems to 2 December 2027 and Annex I to 2 August 2028 — but the Art. 50 transparency duties remain on the original schedule of 2 August 2026. The practical consequence for AI in day-to-day office work is unchanged: you must know which model is in use and be able to say so. A model you ship, version and store yourself is far easier to describe in an AI inventory than an API endpoint whose model changed last Tuesday.
EU industrial policy: the tier that is already sovereign
The Commission’s Cloud and AI Development Act proposes an EU-wide sovereignty framework with four assurance levels, a tripling of EU data centre capacity over five to seven years, and joint public-sector purchasing power. Those are multi-year programmes at the infrastructure tier. The endpoint tier needs no such programme: it is already inside your perimeter, in your jurisdiction, under your administration. Buying European software for it is the cheapest contribution an organisation can make to the same policy goal — and it is procurement it can execute this year. We make the commercial version of this argument in Digital Sovereignty as a Growth Strategy.
Where it matters most
Public administration
Case notes, hearing records, internal memos and citizen correspondence are dictated constantly, often by staff working under time pressure at a service counter. A local option keeps that text inside the authority’s own estate and makes the answer to the procurement question — “where is this processed?” — a single sentence rather than a vendor annex.
Health, social services and HR
These functions generate special-category data continuously and are the most common source of shadow-IT transcription. On-device processing turns a recurring DPIA argument into a settled architectural fact.
Critical infrastructure operations
Control rooms document incidents while the incident is happening — which is precisely when external connectivity may be degraded, restricted, or deliberately severed. Local dictation keeps the shift log moving during the event that the log exists to record.
Secretary42: the worked example
We built Secretary42 because we kept meeting this gap in client engagements and could not point to a tool that met the four properties above without qualification. It is a desktop dictation app for macOS (Apple Silicon) and Windows x64: press a global hotkey, speak, and the text appears at your cursor in whatever application you are using.
Speech-to-text runs on the device through a bundled whisper.cpp engine with quantised Whisper models, from a compact model of around 31 MB up to Large v3. There is no cloud transcription and no cloud transcription fallback. Transcription history is stored locally in SQLite, where the user can view, copy or delete it. Diagnostics are opt-in and off by default, and even when enabled carry only sanitised crash and performance metadata — never audio, transcript text or file paths. Checkout, licence delivery, model downloads, updates and support are online flows that sit outside the dictation path. The product is built and operated by insight 42 UG in Ingolstadt, Germany; the product site is secretary42.de.
Endpoint sovereignty in 90 days
- Weeks 1–2 — Classify the speech. Find where dictation, transcription and summarisation already touch case files, patient notes, incident logs and citizen correspondence. Include the tools staff installed themselves; that is where the exposure usually is.
- Weeks 3–4 — Pin the boundary. Decide which of those flows must never leave the endpoint. Written down, that decision is the policy. Everything after it is enforcement.
- Weeks 5–8 — Prove it. Verify the claim on your network rather than in a brochure: capture traffic during a dictation session and confirm that nothing leaves. Record the result in the DPIA and in your technical and organisational measures.
- Weeks 9–12 — Roll out and document. Deploy first to the teams producing the most sensitive text, update the processing register, and reuse the evidence in your next tender response — where it stops being a cost and starts being a qualifier.
The honest limits
Local-first is a control, not a certificate. It does not produce a BSI C5 attestation, and if your buyers require one you still need the work described in our BSI C5 audit preparation guide. The model weights still originate somewhere, so provenance, licensing and version pinning belong in your AI inventory. The device becomes the security boundary, which makes disk encryption, endpoint management and lock-screen policy load-bearing rather than optional — the ground covered in our work on cloud and IT security. Local models trade some accuracy for privacy and speed, and for workloads at the very top of the sensitivity scale you will still need a sovereign platform underneath, not just a sovereign endpoint. Local-first solves the speech path. It does not solve the estate.
Put the boundary where the data is created
Insight42 designs and implements sovereign architectures for enterprises and public-sector organisations — data residency, key management, BSI C5 and NIS2 readiness, and the evidence that turns controls into won deals. If the endpoint is the gap in your programme, request a sovereignty assessment, or start by putting Secretary42 on the machines that produce your most sensitive text.
Related reading
- Digital Sovereignty as a Growth Strategy: Why Control Wins Deals in Regulated Markets
- Sovereign Cloud Germany: Digital Sovereignty for the Public Sector
- Preparing for a BSI C5 Audit: Practical Tips
More insights like this in our Growth, Innovation & Digital Strategy hub.