Digital sovereignty realized: Lessons from Spain’s legaltech ecosystem

In June, the European Commission confirmed that, after months of negotiation and with express permission from Washington, it had managed to access Claude Mythos – Anthropic's cybersecurity artificial intelligence (AI) model considered too powerful for the general public. This episode, which we have already discussed in this medium, illustrates an uncomfortable reality: Europe depends on decisions made in Washington even to protect its own critical infrastructure. In Valencia, an initiative has been announced that points in the opposite direction.

Legit & Legal Intelligence, what is it for?

Andersen, a multidisciplinary law firm with offices in Spain and Portugal, and 1MillionBot, an Alicante-based technology company specializing in conversational and agent-based AI founded in 2018, have formalized Legit & Legal Intelligence: a joint vehicle to design, implement, and supervise artificial intelligence projects under an approach they call compliant by design – regulatory compliance incorporated from the project's conception, not added later as a patch.

The important fact is not the alliance itself, but its architecture. According to the launch note, the initiative "aligns with the national AI strategy articulated around the ALIA project" – the public artificial intelligence infrastructure promoted by the Government of Spain and developed with the Barcelona Supercomputing Center – as well as with open linguistic models of European scope, such as the EuroLLM family. The note itself states bluntly: "The dependence on proprietary models developed and controlled outside Europe poses increasing risks for public administrations and private organizations, both for reasons of data control and operational continuity and technological autonomy."

It is, in essence, the same concern that led the EU to negotiate for months access to Mythos. Only here the response is not to ask permission from a foreign provider, but to build an own alternative.

Why is this not a corporate anecdote?

The European AI Regulation progressively imposes obligations of transparency, risk management, and supervision on artificial intelligence systems operating in particularly sensitive sectors: financial, insurance, health, educational, labor, and the public administration itself. Any organization deploying AI in these areas now needs more than just a functional tool: it must be able to demonstrate to a supervisor that the system complies with standards such as ISO/IEC 42001 and with the Regulation itself, with complete traceability from design to production.

That technical-legal requirement is, in itself, a new market. And the way that market is built – with what infrastructure, with what models, under what jurisdiction – determines whether Europe again depends on US providers to comply with its own regulation or if it achieves a genuinely own layer of infrastructure.

The pattern that connects both cases

Mythos and Legit & Legal Intelligence have nothing to do with each other in terms of product – one is an offensive cybersecurity model with extraordinary capabilities; the other is a regulatory compliance platform for business AI. But both cases are symptoms of the same structural problem: for years, the artificial intelligence infrastructure on which European governments and companies depend has been built almost entirely outside Europe, under foreign jurisdiction and control.

What changes now is that alternatives built from within are beginning to appear, with their own names and real cases deployed in Spanish public administrations: public infrastructure like ALIA, open models like EuroLLM, and companies like 1MillionBot that have been deploying AI agents with "model provider-independent architectures" since 2018; that is, explicitly designed not to be trapped in the dependency on a single foreign provider.

An alliance between a law firm and an AI company does not, by itself, resolve the structural dependency that Europe drags in computing infrastructure, chips, and frontier models. ALIA and EuroLLM are still projects in development, not mature and proven alternatives at scale compared to the large US commercial models. And the fact that an initiative is presented as "sovereign" does not guarantee that it is in practice; it will have to be seen, over time, if these solutions really avoid dependence on cloud infrastructure or hardware components that ultimately remain under foreign control.

But the direction of the movement matters. When the Spanish legaltech industry itself begins to design its services around digital sovereignty as a sales argument – not as a slogan, but as a concrete technical architecture – it is a sign that the debate on European technological dependence has ceased to be a topic for think tanks and ministries. It has reached the market.