Architecture review

AI SOVEREIGNTY CHECK · INSURANCE

Can your AI use case go to production? In three weeks you will know.

The pilot works. What is open is whether it holds up under the Swiss Federal Act on Data Protection (FADP): health data from claims, vendors abroad, decisions that still have to be explained years later. That question usually comes up late, at the data protection impact assessment or in the audit, and then stalls the project for months. The sovereignty check answers it in three weeks at a fixed price: with a compliance assessment in ClearSky, a sovereign target architecture and an action plan with a cost range.

Request the Sovereignty Checkcontact@dxzio.ch
3 weeks
from kickoff to a decision paper
CHF 14,500
fixed price, fully creditable
0
access to your systems needed

Four questions AI projects at insurers get stuck on

Data protection: Does the use case process health data from claims or other sensitive personal data, and does it need a data protection impact assessment under Art. 22 FADP?

Data location: Where do claims data, prompts and models live, is a US company anywhere in the chain, and is the disclosure abroad permitted under Art. 16 FADP?

Traceability: Can a decision prepared today be recomputed in five years with the same model and the same input, and are data subjects informed when it is made automatically (Art. 21 FADP)?

Governance: Who is accountable for the model, the vendors and changes, and is that documented well enough for internal audit and data protection advisors to check?

The sovereignty check examines one concrete use case along these four questions, from the data to operations. The compliance check runs in ClearSky, our platform for assessing cloud services under Swiss law.

Five deliverables, one decision paper

Compliance assessment in ClearSky: every cloud service and vendor of the use case assessed against the FADP and its ordinance, findings ranked by severity with owners, status and an audit log. Public-law insurers also receive their CCRA-PS workbook. For compliance, risk and data protection.

Target architecture: a sovereign variant next to your current one, operated in Switzerland or the EU, no US company in the chain, with running costs.

Data card for the use case: machine-readable in DCAT format, as an audit artefact for internal audit and examiners.

Action plan: the steps to the target architecture in order, with effort and cost range.

Final presentation: 60 minutes with the sponsor and business units, with a recommendation and a decision.

HOW IT RUNS

Three weeks from kickoff

01 /

Week 1 — Intake

Kickoff with the sponsor, two workshops on data flows and on vendors and models, cloud services recorded in ClearSky, first assessment. If it shows the use case holds up without changes, the check ends here at half price.

02 /

Week 2 — Analysis

Assessment in ClearSky against the FADP and its ordinance, target architecture and data card. Interim review with you, 30 minutes.

03 /

Week 3 — Result

Assessment, action plan with cost range and final presentation. Afterwards you decide freely whether to keep working with us.

COMMON QUESTIONS

What insurers ask first

What does the check cost, and what happens to the amount if we continue?

CHF 14,500 fixed price, plus VAT, no change requests. 50% on order, 50% on delivery. If you commission operation of the use case on the Dxzio platform within 90 days of delivery, the full amount is credited.

What if the first week shows everything is fine?

Then the check ends with a short written rationale at half price. You don't pay for an analysis you don't need.

Do you need access to our systems?

No. We work with two workshops and your documents: architecture sketch, vendor contracts, known data flows. Your effort is about 1.5 person-days across everyone involved.

Is this legal advice or a compliance certification?

No. We deliver architecture and a documented assessment that makes the case easier for your legal and compliance advisors. In ClearSky the AI drafts answers and collects evidence; people make the assessment. The legal evaluation and any consultation of the FDPIC stay with you.

What happens to our documents?

The assessment lives in ClearSky, in data centres in the EU (Helsinki, Frankfurt, Paris), operated by Dxzio GmbH in Cham. AI drafts run primarily through GreenPT, in data centres in Paris and Helsinki that, according to their operators, run on renewable energy. We use no providers in the US, and every call is logged. We don't need personal data from claims. A data processing agreement up front, deletion on request after completion.

Can we keep the assessment going ourselves afterwards?

Yes. The assessment stays in ClearSky, and you can keep it current there when requirements or vendors change. We state the terms in the quote. More about ClearSky: clearsky.cloudzn.ch