---
title: Where I work
source: https://rubradigital.com/locations
site: Rubra Digital
description: Sixteen markets across Europe and North America, with the local regulatory context.
---

# Where I work

**Summary:** Sixteen markets across Europe and North America, with the local regulatory context.

## Germany

Germany is the most process-intensive AI market in Europe, and that is usually a feature rather than an obstacle. Procurement expects written documentation of data flows before a pilot starts, and any system touching employee data normally needs a works council (Betriebsrat) agreement, which is negotiated in parallel with the build rather than after it. Mittelstand manufacturers and BaFin-regulated financial firms are the two segments where retrieval over internal documentation pays back fastest.

- Regulator: BfDI and the sixteen state data protection authorities
- Frameworks: EU AI Act, GDPR / BDSG, NIS2, DORA, BaFin MaRisk / BAIT
- Data residency: EU regions in Frankfurt or Berlin, with model inference kept inside the EU.
- Cities: Berlin, Munich, Frankfurt, Hamburg, Cologne, Stuttgart
- Full page: https://rubradigital.com/locations/germany

## Netherlands

The AP has been unusually forward-leaning on algorithmic transparency, and it runs a dedicated algorithm oversight directorate that publishes sector risk reporting, so Dutch boards tend to ask about explainability earlier than their peers elsewhere. English is the working language in almost every scale-up and most enterprises, which shortens the discovery phase considerably.

- Regulator: Autoriteit Persoonsgegevens (AP)
- Frameworks: EU AI Act, GDPR / UAVG, DORA, NIS2
- Data residency: EU regions in Amsterdam, with Dutch-language embeddings tuned for retrieval quality.
- Cities: Amsterdam, Rotterdam, Utrecht, The Hague, Eindhoven
- Full page: https://rubradigital.com/locations/netherlands

## United Kingdom

The UK has deliberately not passed a single AI statute; oversight instead sits with existing regulators applying a shared set of principles, with the ICO and FCA doing most of the practical work. That makes UK delivery faster to start than EU delivery, but it shifts the burden onto sector rules. An FCA-regulated firm faces a tougher bar under Consumer Duty than anything the EU AI Act imposes on the same use case.

- Regulator: Information Commissioner's Office (ICO)
- Frameworks: UK GDPR / DPA 2018, FCA Consumer Duty, SYSC operational resilience, ICO AI guidance
- Data residency: UK regions in London, or EU regions where the client also operates in the EEA.
- Cities: London, Manchester, Edinburgh, Cambridge, Bristol, Leeds
- Full page: https://rubradigital.com/locations/united-kingdom

## France

The CNIL has published more concrete practical guidance on AI development than any other European authority, which gives French projects an unusually clear compliance path. Public sector and defence-adjacent work often carries a SecNumCloud hosting requirement that rules out most US-headquartered providers, so architecture decisions need to be made early. French-language retrieval also needs real attention: naive chunking performs noticeably worse on French legal and administrative prose.

- Regulator: Commission Nationale de l’Informatique et des Libertés (CNIL)
- Frameworks: EU AI Act, GDPR, CNIL AI recommendations, DORA, SecNumCloud
- Data residency: EU regions in Paris or Marseille; SecNumCloud-qualified hosting where required.
- Cities: Paris, Lyon, Toulouse, Lille, Nantes
- Full page: https://rubradigital.com/locations/france

## Switzerland

Switzerland sits outside the EU AI Act, but Swiss firms selling into the EU are caught by it anyway, so most Swiss clients build to the EU standard by choice. Banking secrecy obligations are stricter than GDPR on data egress, and for private banking and pharma work the practical answer is often a fully in-country deployment. Multilingual retrieval across German, French and Italian is the norm rather than the exception here.

- Regulator: Federal Data Protection and Information Commissioner (FDPIC)
- Frameworks: revFADP, FINMA circulars, Swiss banking secrecy, EU AI Act (extraterritorial)
- Data residency: Swiss regions in Zurich or Geneva, with in-country inference where secrecy rules require it.
- Cities: Zurich, Geneva, Basel, Lausanne, Zug
- Full page: https://rubradigital.com/locations/switzerland

## Ireland

Ireland hosts the European headquarters of a large share of global technology and pharmaceutical companies, which means the DPC acts as lead supervisory authority for cross-border processing far beyond Ireland itself. Projects here are frequently multi-jurisdictional from the first sprint, and the compliance narrative has to satisfy several markets at once. English-first delivery and EU data residency in one place is the reason many groups anchor their AI programme in Dublin.

- Regulator: Data Protection Commission (DPC)
- Frameworks: EU AI Act, GDPR, DORA, Central Bank of Ireland guidance
- Data residency: EU regions in Dublin.
- Cities: Dublin, Cork, Galway, Limerick
- Full page: https://rubradigital.com/locations/ireland

## Spain

Spain created AESIA, the first dedicated national AI supervisory agency in the EU, and ran the EU’s first AI Act regulatory sandbox, so Spanish organisations often have earlier practical exposure to AI Act conformity work than their neighbours. Banking and insurance groups in Madrid are the most active buyers, and multilingual retrieval spanning Castilian Spanish and Catalan is a routine requirement in Catalonia.

- Regulator: Agencia Española de Protección de Datos (AEPD)
- Frameworks: EU AI Act, GDPR / LOPDGDD, AESIA supervision, DORA
- Data residency: EU regions in Madrid or Spain Central.
- Cities: Madrid, Barcelona, Valencia, Seville, Bilbao
- Full page: https://rubradigital.com/locations/spain

## Sweden

Swedish organisations tend to be technically self-sufficient and buy consulting for the parts they cannot easily hire for: evaluation rigour, retrieval quality and architecture review rather than end-to-end delivery. Decision-making is consensus-driven and slower to start, but the resulting engagements are unusually collaborative. Swedish-language retrieval benefits materially from compound-word-aware chunking.

- Regulator: Integritetsskyddsmyndigheten (IMY)
- Frameworks: EU AI Act, GDPR, NIS2, Finansinspektionen guidance
- Data residency: EU regions in Stockholm.
- Cities: Stockholm, Gothenburg, Malmö, Uppsala
- Full page: https://rubradigital.com/locations/sweden

## Denmark

Denmark has one of the most digitised public sectors in Europe, and that maturity carries into private-sector expectations: clients arrive with clean, well-structured data far more often than elsewhere, which shortens the retrieval engineering phase. Life sciences and shipping are the two sectors where I see the strongest demand for document-heavy retrieval systems.

- Regulator: Datatilsynet
- Frameworks: EU AI Act, GDPR, NIS2, Danish public sector IT standards
- Data residency: EU regions in Copenhagen or Frankfurt.
- Cities: Copenhagen, Aarhus, Odense, Aalborg
- Full page: https://rubradigital.com/locations/denmark

## Belgium

Brussels concentrates EU institutions, trade associations and law firms whose core asset is a very large corpus of regulatory text, which is close to the ideal use case for retrieval. Nearly every system here has to work in Dutch and French simultaneously, and getting cross-language retrieval right (a French query returning the relevant Dutch document) is usually the hardest requirement in the brief.

- Regulator: Autorité de protection des données / Gegevensbeschermingsautoriteit
- Frameworks: EU AI Act, GDPR, NIS2, EU institutional procurement rules
- Data residency: EU regions in Belgium or the Netherlands.
- Cities: Brussels, Antwerp, Ghent, Leuven
- Full page: https://rubradigital.com/locations/belgium

## Austria

Austrian procurement resembles Germany’s: thorough documentation, works council involvement for anything touching employees, and a strong preference for EU-domiciled suppliers. Vienna serves as the regional headquarters for a lot of Central and Eastern European operations, so an Austrian engagement often has to account for eight or nine additional country subsidiaries.

- Regulator: Datenschutzbehörde (DSB)
- Frameworks: EU AI Act, GDPR / DSG, NIS2, FMA guidance
- Data residency: EU regions in Vienna or Frankfurt.
- Cities: Vienna, Graz, Linz, Salzburg
- Full page: https://rubradigital.com/locations/austria

## Norway

Norway applies GDPR through the EEA agreement and is aligned with the EU AI Act on the same basis, so the compliance picture closely tracks the EU with a lag. Energy, shipping and public sector dominate demand, and offshore engineering documentation, meaning decades of scanned technical drawings and inspection reports, is a recurring and genuinely hard retrieval problem.

- Regulator: Datatilsynet
- Frameworks: GDPR (via EEA), EU AI Act (EEA adoption), Finanstilsynet guidance
- Data residency: Norwegian regions in Oslo, or EU regions where the EEA basis is sufficient.
- Cities: Oslo, Bergen, Stavanger, Trondheim
- Full page: https://rubradigital.com/locations/norway

## Poland

Poland hosts a very large share of Europe’s shared service and engineering centres, so the buyer is often a global capability centre delivering for a parent company elsewhere. That changes the engagement shape: the system is built in Warsaw or Kraków but has to satisfy the governance requirements of the group headquarters. Polish is morphologically rich, and lemmatisation-aware retrieval makes a measurable difference.

- Regulator: Urząd Ochrony Danych Osobowych (UODO)
- Frameworks: EU AI Act, GDPR, NIS2, KNF guidance
- Data residency: EU regions in Warsaw.
- Cities: Warsaw, Kraków, Wrocław, Gdańsk, Poznań
- Full page: https://rubradigital.com/locations/poland

## Italy

The Garante has been the most interventionist data protection authority in Europe on generative AI specifically, including enforcement action against major model providers. Italian clients consequently want a documented lawful basis and a clear data-flow diagram before a pilot goes anywhere near production. Manufacturing groups in the north and banking in Milan are the strongest sources of demand.

- Regulator: Garante per la protezione dei dati personali
- Frameworks: EU AI Act, GDPR, DORA, Banca d’Italia guidance, AgID public sector rules
- Data residency: EU regions in Milan.
- Cities: Milan, Rome, Turin, Bologna
- Full page: https://rubradigital.com/locations/italy

## United States

There is no single federal AI statute, so the operative constraints are sector rules and a growing patchwork of state law. Colorado’s AI Act for consequential decisions, New York City’s bias-audit requirement for automated employment tools, and California’s privacy regime are the ones that most often bite. NIST’s AI RMF is not binding but has become the de facto framework enterprise buyers ask suppliers to map against. US engagements move faster than European ones and are far more likely to be judged on a measurable business metric within the first quarter.

- Regulator: FTC, sector regulators, and state attorneys general
- Frameworks: NIST AI Risk Management Framework, Colorado AI Act, California CCPA/CPRA, NYC Local Law 144, HIPAA, GLBA / SEC / FINRA, SOC 2
- Data residency: US regions in Virginia, Oregon or Texas, with HIPAA-eligible services where PHI is in scope.
- Cities: New York, San Francisco, Boston, Chicago, Austin, Seattle
- Full page: https://rubradigital.com/locations/united-states

## Canada

Canada’s proposed AI legislation (AIDA, inside Bill C-27) died on the order paper, so there is currently no federal AI statute in force. PIPEDA, Quebec’s Law 25 and sector guidance do the real work. Law 25 is the sharper constraint in practice: it grants a right to an explanation for automated decisions and imposes French-language obligations that affect the interface as much as the model. OSFI’s model risk guidance sets the bar for federally regulated financial institutions.

- Regulator: Office of the Privacy Commissioner of Canada (OPC)
- Frameworks: PIPEDA, Quebec Law 25, OSFI B-13 and E-23, Voluntary Code of Conduct on generative AI
- Data residency: Canadian regions in Toronto and Montreal, with in-country inference for regulated clients.
- Cities: Toronto, Montreal, Vancouver, Ottawa, Calgary
- Full page: https://rubradigital.com/locations/canada

---

Rubra Digital. Independent LLM and RAG consulting for regulated and document-heavy organisations in Europe and North America.
Contact: hello@rubradigital.com · https://rubradigital.com/contact