From contractual to architectural safeguards: MencIA and sovereignty by design facing generative artificial intelligence in the local public sector. A reading of the GDPR at its tenth anniversary

Abstract

The adoption of generative artificial intelligence in local administrations strains the safeguards model underlying the General Data Protection Regulation, which is essentially contractual in nature: training opacity, limited auditability, structural extraterritoriality and functional polyvalence exceed its assumptions of bounded technologies, determinable purposes and identifiable processors. This paper proposes the notion of architectural sovereignty as the technical translation of data protection by design under Article 25 GDPR and examines it through a case study: MencIA, an open-source artificial intelligence ecosystem deployed on proprietary infrastructure by the Provincial Council of Lugo. The analysis of the artefact, tested article by article against the Regulation and against the Spanish Data Protection Agency’s policy on generative AI (November 2025), shows that local execution simplifies the responsibility assessment, sustains the traceability and repeatability of operations and keeps sensitive information within the administration’s perimeter. As a prospective validity test, the model neutralises by design the risk configurations that the Agency’s guidance on agentic AI (February 2026) deems unacceptable, subject to the limitations of an operational proof of concept.