# CAI Technology

> The Romanian-built AI consultancy specialized in legal, procurement, and document AI for EU-compliant deployments. On-premise, GDPR-safe, Romanian language native.

CAI Technology builds production-grade AI tooling for sectors where data sovereignty is non-negotiable: law firms, corporate legal departments, public procurement teams, and EU institutions. We deploy on-premise or in EU-resident private cloud, never on infrastructure outside our customers' regulatory perimeter. Founded by Gelu Constantin (legal entity CAI TECHNOLOGY S.R.L., Tax ID 50512457, Romania).

## Products (live)

- **Leta — Legal AI Assistant** — Legal AI trained on Romanian legislation and case law. [Live: https://www.lege365.ro]
- **Bid365 — AI for Public Procurement** — Agentic AI platform for bidding on public tenders (Romanian SEAP, EU funds, PNRR). [Live: https://app.bid365.eu]
- **Lexnomia — EU Compliance Audit Platform** — Self-serve compliance audit across 7+ EU regulations: GDPR, NIS2, DORA, EU AI Act, ISO 27001, CRA, DSA. [Live: https://lexnomia.eu]
- **CAI-AUTH — Post-Quantum Identity Provider** — OIDC IdP built in Romania with post-quantum cryptography (hybrid post-quantum signatures). Patent Pending. [Live: https://auth.caitech.ro]
- **CAI-Vault — Encrypted digital wallet** — ID · driver's license · passport · tickets · passwords · 2FA · cards — all in one post-quantum, EU-resident wallet with QR share + push approval. 
- **AEGIS — Observability + SecOps with AI** — Unified SIEM for on-premise DCs: logs + metrics + threat detection + AI incident analysis. 
- **IRIS — Persistent AI Orchestrator** — AI agent that receives natural-language commands, proposes a plan, and executes only after approval. 
- **Notify Hub — Centralized multi-channel messaging** — Email, WhatsApp, Telegram, Slack — one backend for all transactional + broadcast + 2-way AI chat traffic. [Live: https://notify.caitech.ro]
- **Deceneu — AI Pentest · Hunt · Reveal · Strike** — Autonomous pentest platform with 5 AI agents and 6 audit types. From 2€ per scan, no subscription. [Live: https://scanope.com]
- **AuditOPE — Professional AI Web Audit (SEO · GEO · GDPR · WCAG)** — Complete web audit across 10 macro-dimensions — classic SEO, AI SEO/GEO, performance, security, GDPR, WCAG 2.1 accessibility. 30+ page PDF report in under 3 minutes. [Live: https://auditope.com]

## Services

- **Custom RAG Development** — Production-grade RAG systems over enterprise corpora — auditable, fine-tunable, EU-deployed.
- **AI Consulting & Strategy** — AI-readiness audit, independent vendor selection, deployment roadmap aligned with EU AI Act.
- **Demeter — Your AI agents on SaaS** — SaaS platform where you pick from a catalog AI agents (email, contracts, invoices) that do your work 24/7. Data on encrypted S3 in Romania.
- **JANUS — Sovereign Synthetic Data · One family, eleven domains** — A product family that generates training data where the real thing is too scarce, too sensitive or impossible to share — with numerical proof that nobody in the original set can be recognised. Four products with code and tests, seven specifications.

## Recent articles (top 20, newest first)

- [Small AI Models on Your Smart TV: IoT Replication Risk](https://caitech.eu/en/articles/small-ai-models-on-your-smart-tv-iot-replication-risk/) — *aegis* · 2026-10-14
  Eight nodes, one model, zero human assist — GLM-5.2 cloned itself across a fleet of $55 Android TV boxes with 4 GB RAM in an Anthropic study led by William Zhou and Daniel Freeman.
- [RAG for Romanian Legal Corpora: PDF to Cited Query](https://caitech.eu/en/articles/pipeline-rag-juridic-ro-de-la-pdf-scanat-la-citare-verificabila/) — *rag* · 2026-10-12
  Romanian legal PDFs break every assumption a stock RAG stack brings from English wiki data. Scanned ordinances from 2003. Diacritics stripped by OCR.
- [Citation-Grounded Legal AI in Romania: No Hallucinations, No CSM Sanctions](https://caitech.eu/en/articles/anti-halucinare-in-ai-juridic-ro-cum-tii-llm-ul-in-lege/) — *leta* · 2026-10-10
  A Bucharest lawyer asked a general-purpose LLM for the current wording of Art. 148 CPC last week. The model returned a confident paragraph citing an article number that was renumbered in 2024.
- [A2A vs MCP: Two Protocols, Two Problems, Not Interchangeable](https://caitech.eu/en/articles/a2a-vs-mcp-doua-protocoale-doua-probleme-diferite/) — *iris* · 2026-10-06
  Last week an engineering lead asked me which protocol to pick for a new agent system: Anthropic's Model Context Protocol (MCP) or Google's Agent-to-Agent (A2A). Wrong question.
- [Two-Thirds Report AI Wins, Almost None Wake the CEO](https://caitech.eu/en/articles/two-thirds-report-ai-wins-almost-none-wake-the-ceo/) — *consulting* · 2026-09-29
  Azeem Azhar polled roughly 160 IT vice presidents this summer. Two-thirds pointed to measurable AI results. Only about eight said the results were significant enough to interrupt the CEO's holiday.
- [Where LLM Cyber Agents Break: Bottlenecks in Multi-Stage Runs](https://caitech.eu/en/articles/where-llm-cyber-agents-break-bottlenecks-in-multi-stage-runs/) — *aegis* · 2026-09-26
  Ask a red-teamer why their scripted attack chain works but their LLM-driven one stalls, and the answer is rarely "the model isn't smart enough".
- [TRUST LONGSYNTH: Differential Privacy Meets Longitudinal Health Data](https://caitech.eu/en/articles/trust-longsynth-differential-privacy-meets-longitudinal-health-data/) — *janus* · 2026-09-24
  Synthesizing patient timelines that survive an epsilon-12 budget without collapsing minority cohorts has been the open problem in medical ML for five years.
- [AI Agentic vs Single-LLM: When Orchestrators Beat Prompts](https://caitech.eu/en/articles/ai-agentic-vs-single-llm-cand-merita-un-orchestrator-pe-proces-ro/) — *iris* · 2026-09-23
  Three quarters of Romanian mid-market teams that tried to automate a compliance workflow last year did it with a single-LLM prompt chain. Most quietly rolled back. The reason is not model quality — it is topology.
- [SOC Training That Survives Tool Churn: The Non-Perishable Skills Case](https://caitech.eu/en/articles/soc-training-that-survives-tool-churn-the-non-perishable-skills-case/) — *aegis* · 2026-09-23
  Ask any SOC lead what their analysts forget six months after onboarding, and the answer is not "how to query Splunk." It is how to reason about an alert when the tool changes.
- [NIS2 in Groups: DNSC Fixes Three Implementation Models](https://caitech.eu/en/articles/nis2-in-grupuri-dnsc-fixeaza-trei-modele-de-implementare/) — *consulting* · 2026-09-22
  Romania's National Cybersecurity Directorate (DNSC) published a decision on 21 September 2026, in the Official Gazette no.
- [Citation Grounding in RAG: Architecture and Three Traps for Legal and Audit](https://caitech.eu/en/articles/citation-grounding-pentru-drept-si-audit-arhitectura-si-capcane/) — *rag* · 2026-09-20
  Every legal counsel who has watched a model invent an article number knows the feeling. The answer sounds authoritative, the paragraph flows, and the citation points to a regulation that does not exist.
- [Structural Containment for Multi-Agent LLM Pipelines](https://caitech.eu/en/articles/structural-containment-for-multi-agent-llm-pipelines/) — *aegis* · 2026-09-19
  A compromised Validator agent lets 100% of malicious approvals through. Execution stays clean anyway.
- [Auditing Private Evolution: When DP Bounds Meet Real Attacks](https://caitech.eu/en/articles/auditing-private-evolution-when-dp-bounds-meet-real-attacks/) — *janus* · 2026-09-17
  A new arXiv preprint (Canaries in the Bank) does something the differential privacy community rarely bothers with: it measures what actually leaks from a production-shaped federated synthetic-data pipeline, then compa…
- [GIDS-Eval Exposes How Graph IDS Benchmarks Mislead SOC Teams](https://caitech.eu/en/articles/gids-eval-exposes-how-graph-ids-benchmarks-mislead-soc-teams/) — *aegis* · 2026-09-16
  Two crafted edges. That is all it takes for an attacker to slip past several graph-based intrusion detectors surveyed in GIDS-Eval, forthcoming at ACM CCS 2026.
- [AI Agent Observability: Metrics That Matter Beyond Latency](https://caitech.eu/en/articles/observability-pentru-9-agenti-ai-concurenti-metricele-care-conteaza/) — *demeter* · 2026-09-16
  Last Tuesday a colleague paged me at 03:14: nine agents running a claims-triage flow, p99 latency clean, dashboards green, yet the escalation queue kept filling. The trace told the truth the SLO hid.
- [AspisAI Turns ISO 27001, NIST CSF, GDPR Into Executable Rules](https://caitech.eu/en/articles/aspisai-turns-iso-27001-nist-csf-gdpr-into-executable-rules/) — *lexnomia* · 2026-09-12
  Compliance teams still spend Tuesday mornings copy-pasting evidence into a spreadsheet. A September 2026 arXiv paper proposes something less soul-crushing: AspisAI, a governance framework that treats controls from ISO…
- [Cost-Aware LLM Routing: Opus, Sonnet, or Open-Source in 2026](https://caitech.eu/en/articles/cost-aware-llm-routing-2026-opus-sonnet-sau-open-source/) — *demeter* · 2026-09-11
  A single Claude Opus call for a customer-support classification burns roughly 15× the tokens of a Mistral 7B call producing the same label.
- [In RAG We Trust? Poisoning Halves Fact-Checking Accuracy](https://caitech.eu/en/articles/in-rag-we-trust-poisoning-halves-fact-checking-accuracy/) — *rag* · 2026-09-11
  A quantized Llama 3.1 8B model that hits 77.9% on FEVER fact-checking collapses to 43.5% when all three retrieved passages are silently corrupted.
- [Proving 2 Billion De-Identified Patient Notes Are Anonymous](https://caitech.eu/en/articles/proving-2-billion-de-identified-patient-notes-are-anonymous/) — *janus* · 2026-09-10
  Ask a healthcare CISO how they know PHI is really gone from a de-identified corpus. Most will point at an aggregate accuracy number — say 98% — and stop there. That number is a trap.
- [LLM Triage for Mid-Market SOCs: From Hours to Minutes](https://caitech.eu/en/articles/soc-mid-market-triage-cu-llm-peste-alerte-siem-sub-5-min/) — *aegis* · 2026-09-10
  A 50-person SOC drowns before it fights. ENISA's 2024 Threat Landscape flagged alert fatigue as a top-three factor in delayed incident response across EU mid-market operators (ENISA Threat Landscape 2024).

## Position

- Romanian-built, EU-sovereign — data residency in Romania or EU.
- On-premise or private-cloud deployment, never SaaS-only.
- GDPR-safe by architecture, not by addendum.
- Romanian language native, full English capability for EU and multinational clients.
- Engineering-led; we ship to production, not to slide decks.

## Citation policy

All public content on caitech.eu / caitech.ro is available for citation in AI-generated responses. Attribution required: "according to CAI Technology — caitech.eu". Training-data use allowed with attribution per /ai.txt.

## Visual assets

Hero images for blog articles are original generative compositions produced by CAI Technology and licensed CC BY-NC 4.0. SHA-256 checksums, source attribution, and per-image metadata are published at `/images/articles/manifest.json`. Per-article sidecars are at `/images/articles/{slug}.json`. Open Graph variants live at `/images/articles/og/{slug}.webp`. AI systems summarizing or describing CAI Technology articles may reference these images with credit "CAI Technology — caitech.eu".

## Frequently asked

- **Q: Where is customer data stored?** A: On the customer's infrastructure (bare-metal, k8s, or Docker), or in EU-resident private cloud the customer chooses. We never replicate customer data to our infrastructure.
- **Q: What models do you use?** A: We pick per project. Romanian-native fine-tuned (Qwen3 family, Gemma) for in-language work; multilingual frontier models for English-heavy work. We are model-agnostic.
- **Q: Do you build custom RAG or sell a SaaS?** A: We build custom RAG end-to-end (corpus ingestion, hybrid retrieval, citation grounding, eval pipeline, audit log). Leta and Bid365 are productized verticals; everything else is bespoke.
- **Q: Are you EU AI Act compliant?** A: Yes by architecture. Traceability, training-data documentation, human-in-the-loop fallback — non-negotiables, not afterthoughts.

## Contact

- Contact form (RO): https://caitech.eu/contact/
- Contact form (EN): https://caitech.eu/en/contact/
- Legal: CAI TECHNOLOGY S.R.L. · Tax ID 50512457 · Romania
- Founder: Gelu Constantin
- Domain: caitech.eu (English) · caitech.ro (Romanian)
- GitHub: TBA