300 Pre-Built Modules. Use Them or Extend Them.
Your engineering team's estimate for sovereign AI from scratch came back at 18 months and €6 million. Your board wants a deployed product in twelve weeks. Both numbers are correct. The engineering estimate describes what it actually costs to build the infrastructure that the Leeloo Framework already contains. The board's timeline describes how long it takes to configure and deploy that infrastructure. The question isn't which number is right. It's whether you're buying a platform or commissioning a project.
What 300 modules actually means
Three hundred sounds like a marketing claim. It isn't. Three hundred modules is a production history — a record of every engineering problem that a sovereign AI deployment requires solving, accumulated across every regulated industry we've deployed into.
Each of the 300 modules exists because a live deployment needed it. Not as a roadmap feature. As a go-live dependency. The sensitivity classifier that decides — in milliseconds — whether a query touches data that requires sovereign processing. The context preservation layer that makes the AI feel like a colleague rather than a search engine (your employees don't have to re-explain their role before every question). The output formatter that applies your organization's document templates automatically so the first output matches your standards without revision.
Those three modules alone account for 60% of the user experience in a deployed sovereign AI product. They have no headline value. They're invisible when they work and catastrophic when they're missing.
Ninety-two percent of enterprise AI currently runs on OpenAI infrastructure — directly through the API or embedded in tools like Microsoft Copilot, Salesforce Einstein, and SAP Joule, according to research from Kiteworks and LayerX (2025). That convergence is not a technology preference. It reflects the reality that building sovereign AI infrastructure from scratch is economically prohibitive for all but the largest technology companies. We built the Framework because the infrastructure problem should be solved once, not separately by each organization that needs it.
The seven layers your engineers would build
Neither number in that board debate is inflated. Sovereign AI requires seven distinct architecture layers, each handling a different set of problems. Your team would build all seven.
Foundation Models — selecting, configuring, fine-tuning, and versioning the AI models themselves. No single-vendor dependency. A system that can route queries to the right model for the specific task. This isn't installing an API key. It's a model management layer that runs in production.
Orchestration — the plumbing. How a question like "how did last quarter's revenue compare to forecast by region?" retrieves data from three systems, compares them, checks the results against a template, and returns a formatted answer — without your employee knowing those three systems exist. Thirty-eight modules working together so your team doesn't build that routing logic from scratch.
Data Layer — your organization's knowledge, indexed and searchable by your AI. Specialized search indexes hold your documents in a format the AI can search by meaning, not just keywords. Knowledge maps connect related information across your systems automatically. Automated pipelines keep the whole knowledge base current as new documents arrive. At a Luxembourg law firm, a legal associate searched a 12-year archive of contract templates and case notes in four seconds. That previously required half a day and an assistant. The Data Layer is why.
Security — encryption, access control, audit logging, automatic detection of personal data, and protection against prompt manipulation (preventing employees from using creative phrasing to extract data they shouldn't have access to). Built in from day one, not added at the end. Our Recorder logs every interaction. Our Firewall acts as a one-way valve — AI models can read your data, they cannot send it outside your perimeter.
Compliance — regulatory controls that enforce rules automatically. The EU AI Act (which requires organizations to classify, document, and govern their AI systems by risk level), GDPR data handling requirements, HIPAA protections for patient data, SOX controls for financial records. Compliance modules apply these rules to every AI interaction. When your auditor asks for documentation, the system provides it — not a retrospective reconstruction.
Integration — connectors to your existing systems. ERP, CRM, document management, email, financial reporting. Building each integration from scratch takes two to six weeks per system. Configuring our Integration modules takes one to five days per system. Across ten integrations — the typical enterprise has eight to twelve AI-relevant systems — that's 20 to 60 weeks of engineering time replaced by configuration.
Operations — monitoring, scaling, and deployment management. Keeping everything running in production at the SLA your organization requires: 99.9% for SL1 hybrid sovereign deployments, 99.99% for SL2 fully sovereign environments.
Running all seven builds in parallel takes 18 to 24 months, assuming you can hire the talent. That assumption deserves scrutiny.
The talent problem no one wants to say out loud
Building from scratch assumes you can hire sovereign AI architects. You probably can't — not as employees.
Real sovereign AI architects who understand the full stack — models, orchestration, security, compliance, integration, and operations at production scale — start companies. They don't take staff positions. The talent gap is structural, not cyclical. Every organization that has chosen to build from scratch has discovered this, usually at month six when the most critical positions remain unfilled and the timeline starts extending.
Maintaining 300 modules across seven layers and keeping pace with regulatory updates requires eight to twelve specialized engineers at €150,000–€250,000 per year each. That's €1.2M–€3M annually before infrastructure, before the 70% failure rate for custom builds (McKinsey), before the ongoing cost of staying current with regulations.
Our monthly license — €30,000–€80,000 — covers the team, the infrastructure, and the continuous improvement. When the EU AI Act releases updated technical standards for high-risk AI systems, our Compliance modules are updated and pushed to clients as configuration changes. That regulatory update cycle — which takes a custom build team three to six months of engineering time per update — takes a Framework client one configuration deployment.
Palantir built its data intelligence platform over 20 years and more than $3 billion in funding before offering it commercially. That's the accurate comparison for what it takes to build sovereign AI infrastructure correctly from scratch. Our Framework is that prior investment, distilled into 300 configurable modules and available on an eight-week deployment timeline.
Pre-built doesn't mean inflexible
Extensibility is almost always the first question. "Can we customize it?"
Every module in the Framework is built with an extension interface — a documented way to override, customize, or replace its behavior for your organization's specific requirements. An accounting firm that needs custom output formats for client reports can extend the output module without touching the security, routing, or compliance modules underneath. The sovereign foundation stays intact. The application logic is yours.
In practice, the modules clients extend are almost always at the application layer: document templates, workflow logic, industry-specific output formats, custom integrations for proprietary systems. The modules clients never extend: the security layer, the compliance controls, the audit logging, the sensitivity classifier. Not because they can't — because those modules were built by specialists who've deployed them in regulated environments under active audit, and extending them offers no differentiation while creating maintenance overhead.
What the extensibility question really asks is this: "What layer should our team's time be spent on?" Every hour your team spends extending the Security modules is an hour not spent on the workflow intelligence that makes your employees 40% more productive. Configure the infrastructure. Build the differentiation.
A Luxembourg financial services firm deployed using SL2 sovereignty — meaning zero data exits their EU infrastructure, with dedicated compute and dedicated storage — in nine weeks. Their engineering team configured the security modules, compliance controls, and data residency enforcement to their specific regulatory requirements (MiFID II — the EU regulation governing investment services and financial markets — GDPR, and internal audit standards), then spent the remaining weeks on business logic: connecting their existing systems, configuring AI workflows, and training their first users. Nine weeks from contract to production deployment.
The decision this article is for
Two timelines sit on opposite sides of a board table. The CTO's desired timeline is driven by competitive pressure and board expectation: deploy AI this quarter. The engineering team's timeline is driven by correctness: build it right, which takes 18 months. Both are honest.
Resolving this tension isn't a matter of compromise — it's a recognition that both numbers are correct but they're building different things. Eighteen months is the right estimate for building sovereign AI infrastructure from scratch. Eight weeks is the right estimate for configuring and deploying infrastructure that already exists.
300 modules means 300 things your team doesn't build. Our license covers the infrastructure — security, compliance, orchestration, data, integration, operations, and the AI models themselves. Your team builds the application on top. That's not a limitation of the Framework. It's the correct division of labor between what every sovereign AI deployment needs and what only your organization needs.
Eighteen months and six million euros — that estimate was right about the problem. Our Framework is the path their estimate didn't have access to.