AI Certa. Compliance, made practical.

A specialized language model for the EU AI Act, fine-tuned for Italian SMEs and small enough to run on your own hardware. Trained, validated and packaged by ZenkeiX.

AI Certa product: a chat and assessment interface for EU AI Act compliance, shown on a laptop and phone
1.5BBase parameters
4-bitQuantized base
50Curated training pairs
52.6%Lower training loss
Step 40Best checkpoint

AI Certa is a specialized language model for EU AI Act compliance, built for Italian SMEs. It answers questions about obligations, risk classification and documentation for a company's own AI systems, and because it runs on a compact 4-bit base it can be deployed locally, so nothing sensitive has to leave the building. ZenkeiX designed the dataset, ran the fine-tuning and validated the result. It is a private build, delivered for internal compliance work.

The problem

The EU AI Act lands on companies that have no in-house legal-AI expertise. A small business that runs a support chatbot or a scoring model now has real obligations, and no clear way to know which ones apply. The obvious shortcut, pasting the question into a general-purpose assistant, has two problems: it sends internal information to a third party, and it answers regulation with confident, plausible guesses.

What we built

A compact language model specialized on the AI Act and the compliance work that surrounds it, wrapped in a simple product surface: chat, a document library, and assessments that track obligations per system. The model is fine-tuned on a curated dataset, not scraped scale, and it is small enough to run on modest hardware inside the client's own environment.

The AI Certa app: a chat answering an EU AI Act question next to a compliance document library
The product: grounded answers on obligations, alongside the company's own compliance library

The engineering behind it

A small specialized model is only useful if it is built with discipline. The value here is not size, it is the pipeline: a curated dataset, a controlled fine-tune, and an honest reading of what actually improved.

A curated dataset, not scraped scale

The training data is a set of instruction and answer pairs written by hand, each one a real compliance question with a careful, source-grounded answer. It is deliberately small and specialized: the goal is to transfer a consistent, expert behaviour on a narrow domain, not broad coverage. On a regulated topic, one wrong answer costs more than a hundred missing ones.

QLoRA on a 4-bit base

We fine-tuned with QLoRA, training rank-16 adapters on the attention and MLP projections across all 28 layers of a 4-bit quantized base. That adds up to about 18.5 million trainable parameters, roughly one percent of the base model, and the result is a small, portable component that sits on top of an open base and can run locally. That choice is what makes private, on-premise deployment realistic instead of aspirational.

Where those parameters land is telling. The MLP projections carry far more adapter capacity than the attention ones, so most of the specialization lives in the feed-forward path.

LoRA parameters by target module Trainable adapter parameters per module. The three MLP projections (down, gate, up) hold about 4.70 million each, far more than the attention projections: q and o about 1.38 million, k and v about 0.80 million. MLP projections Attention down_proj gate_proj up_proj q_proj o_proj k_proj v_proj 4.70M 4.70M 4.70M 1.38M 1.38M 0.80M 0.80M 0 1M 2M 3M 4M 5M Trainable parameters
Adapter parameters per target module: the feed-forward (MLP) path holds most of the specialized capacity
LoRA trainable parameters by target module
ModuleTypeParameters
down_projMLP4,702,208
gate_projMLP4,702,208
up_projMLP4,702,208
q_projAttention1,376,256
o_projAttention1,376,256
k_projAttention802,816
v_projAttention802,816

Reading the training, not just running it

Training loss fell from 2.395 to 1.136, a 52.6% reduction, and validation loss reached its best point at step 40, not at the end of the run. The best checkpoint is not the last one. Picking it deliberately, at the point of best balance between specialization and generalization, is the difference between a model that learned the domain and one that memorised the dataset. It is the same discipline we write about in how to reduce AI hallucinations.

Loss over the fine-tuning run Training loss falls steadily from 2.395 to 1.136 across 50 steps. Validation loss falls too, then flattens, reaching its best value of 1.500 at step 40 before edging up to 1.506. The best checkpoint is step 40, not the last step. 2.4 2.0 1.6 1.2 1.0 0 10 20 30 40 50 Step Loss Best checkpoint step 40 · val 1.500 Training loss Validation loss
Loss across the fine-tuning run: validation flattens and turns up while training keeps falling, so step 40 is the checkpoint we kept
Loss by step during fine-tuning
StepTraining lossValidation loss
12.395
52.342.18
101.971.83
151.701.69
201.551.61
251.421.55
301.321.52
351.241.505
401.191.500
451.151.506
501.1361.506

Private by design

Because the base is quantized to 4 bit and the specialized component is light, the whole model runs on ordinary hardware without a cloud round-trip. The company's documents, systems and questions never leave its own environment. For a tool whose entire subject is regulatory risk, that is not a nice-to-have, it is the point. It is the practical side of AI Act compliance.

The stack

A deliberately lean fine-tuning pipeline, chosen so the result stays small, reproducible and easy to deploy in place.

Qwen2.5 1.5B Instruct 4-bit quantization QLoRA, rank 16 PEFT / LoRA adapters Local, on-premise

The kind of AI we build

AI Certa is a custom language model end to end: dataset design, fine-tuning, validation and private deployment. It is the same work we do when we build custom LLMs and retrieval systems, and it sits right next to our AI Act compliance work. If you need a model that knows your domain and stays in-house, we can build it.

Frequently asked

What is AI Certa?

AI Certa is a specialized language model for EU AI Act compliance, fine-tuned for Italian SMEs. It answers questions about obligations, risk classification and documentation for a company's own AI systems, and it is small enough to run locally. ZenkeiX designed the dataset, trained the model and validated it.

Why build a private, on-premise LLM instead of using ChatGPT?

Because the subject is regulatory risk. A private model runs on your own hardware, so your documents, systems and questions never leave your environment, and it is specialized on the AI Act rather than answering from general knowledge. It is the practical side of AI Act compliance.

How was AI Certa trained?

With QLoRA on a 4-bit quantized base (Qwen2.5 1.5B Instruct), training rank-16 adapters on the attention and MLP layers over a curated dataset of compliance question-and-answer pairs. Training loss fell 52.6% and we kept the best-validating checkpoint, at step 40.

Can a 1.5B model really run locally?

Yes. A 4-bit base with light LoRA adapters runs on ordinary hardware without a cloud round-trip, which is exactly what makes private deployment realistic. The trainable component is about 18.5 million parameters.

Can ZenkeiX build a private specialized model for us?

Yes. Dataset design, fine-tuning, validation and private deployment is the work we do for custom LLMs. Bring the domain, we handle the engineering.

Does a small, curated dataset really work?

For a narrow domain, yes. A curated set of high-quality examples transfers a consistent, expert behaviour better than scraped scale. On a regulated topic, one wrong answer costs more than a hundred missing ones.

Need AI that stays in-house?

We design, fine-tune and deploy private models end to end. Bring the domain, we handle the engineering.

Book a call Custom LLM development