Skip to main content
FromNine
Menu

AI & data

Generative AI that keeps working after the pilot.

We build generative AI applications on your own documents and data. Retrieval respects who may see what, every release passes an evaluation gate, and you can see the cost, quality and response time of each request.

For public bodies and companies in Ireland that need generative AI to stand up to questions from the DPC, sector regulators and their own staff.

Talk to us about your projectExplore enterprise knowledge
AI Engineering & GenAI: the layersFour layers, one behind the other. First comes retrieval across your own sources, next the model gateway, then evaluation and guardrails, and last the application your staff work in. A single route leads from the sources through to the application.01Retrieval across your sources02Model gateway with routing03Guardrails and evaluation04Live application
  1. 01Every answer names its source, and the system says so when it has no evidence
  2. 02A golden dataset and release gates, agreed with your teams before launch
  3. 03Routing and budgets that show the cost and response time of each request

01 Problems

Why generative AI projects stall

Choosing the model is seldom the difficult bit. Most programmes get stuck on everything that surrounds it.

  1. 01

    The pilot went down well, but nobody could prove it worked

    A handful of people tried a handful of questions. Without a test set, every prompt tweak or model upgrade is a bet.

  2. 02

    Staff are shown documents they have no right to see

    Content went into the index without its access rights. Your security team and data protection officer halt the rollout, and they are right to.

  3. 03

    Spending rises faster than use

    Each request hits the biggest model with the longest context. Nobody knows what a single answer costs, so nobody can control it.

  4. 04

    Plausible answers that turn out to be wrong

    Retrieval brings back near misses, the model papers over the gaps in fluent prose, and after the third confident error users stop trusting it.

02 Delivery ledger

What you get from us

  1. 01 Retrieval and knowledge systems for the enterprise

    We design retrieval source by source: how each document is parsed and split, how keyword and vector search work together, and how access rights follow each passage. It is the foundation of our knowledge assistants for organisations.

    What we do

    • A list of every source, its owner, its format and how access works
    • Chunking and metadata choices for each type of document
    • Hybrid keyword and vector search, followed by re-ranking
    • Retrieval that applies the access rights already set in each source

    What you receive

    • Ingestion pipelines that pick up changes
    • A retrieval service that cites sources and knows when to abstain
    • A report on retrieval quality for each source

  2. 02 A model strategy you can change later

    A gateway sits between your applications and the models. It routes each task to a suitable model, falls back when a provider goes down, and lets you switch as prices and capabilities move.

    What we do

    • A choice between hosted frontier models, deployments hosted in the EU and open-weight models you run yourself
    • Routing based on task, data sensitivity and cost
    • Timeouts, fallbacks, rate limits and caching
    • Review of data processing terms with your legal and security people

    What you receive

    • A model gateway whose routing policy is configuration
    • A recorded model decision for each use case
    • Budgets for cost and latency by request type

  3. 03 Evaluation treated as engineering

    We agree what good looks like with the people who own the process, then turn it into test sets that run on every change. Before we lean on checks graded by a model, we calibrate them against human review.

    What we do

    • Golden datasets for each use case, built with your subject experts
    • Separate offline evaluation of retrieval and of generation
    • Red-team testing for prompt injection and data leaks
    • Online evaluation from production feedback and sampled reviews

    What you receive

    • An evaluation suite in CI that acts as a release gate
    • Quality criteria approved by the business owner
    • Red-team findings with the mitigations applied

  4. 04 LLMOps and observability

    Each request is traced from the question through the passages retrieved and the model call to the answer. Prompts and models carry versions just as code does, and budgets are enforced in production.

    What we do

    • Structured logs and traces for every request
    • Versions for prompts, models and indexes
    • Exact and semantic caching where it is safe to use
    • Monitoring and alerts for drift and quality

    What you receive

    • Dashboards covering quality, cost and latency
    • A playbook for incidents specific to AI
    • A runbook for updating models and indexes

  5. 05 Governance designed in

    We design with the EU AI Act and Ireland’s Regulation of Artificial Intelligence Act 2026 in mind: risk classification, whether you act as provider or deployer, logging, human oversight and documentation. The legal assessment belongs to your own advisers.

    What we do

    • Classifying the use case and mapping obligations to your role
    • Input to your data protection impact assessments under the GDPR
    • Design of logging and human oversight
    • System and model documentation stored alongside the code

    What you receive

    • A documentation pack for the system
    • A design for logging and retention
    • An oversight procedure per use case

  6. 06 Fine-tuning and document understanding, only when the tests call for it

    Fine-tuning, distillation and multimodal document understanding fix particular gaps. We reach for them once the evaluation suite shows that retrieval and prompting fall short, not earlier.

    What we do

    • Analysis of the gaps found in evaluation
    • A plan for data preparation and labelling
    • Distilling to smaller models to cut cost or latency
    • Layout-aware extraction from scanned or complex documents

    What you receive

    • Evaluation results before and after, side by side
    • Lineage of the training data
    • A decision to keep, roll back or retire

03 Architecture

Reference architecture, for illustration

Most of the enterprise generative AI systems we build follow one pattern: retrieval over your sources, a model gateway, guardrails before and after the model, and a loop of evaluation and monitoring underneath that decides what reaches production.

We put the permission filter inside retrieval rather than in the user interface. If someone cannot open a document in the source system, none of its passages reach the model when that person asks a question.

Layers in the drawing

Sources
Document stores, wikis and business systems, and the identity provider that holds each person’s access rights.
Retrieval
The permission filter, ingestion, a hybrid index and re-ranking.
Models
A gateway routing between hosted, EU-hosted and self-hosted models, with caching and fallbacks.
Application
Answers with citations, abstention where there is no evidence, and guardrails on what goes in and out.
Operate and improve
Golden sets, regression gates, traces and budgets; whatever production reveals becomes part of the following test set.
Illustrative example

  1. Sources

    • Wikis and document stores
    • Business systems
    • Identity provider

  2. Retrieval

    • Chunking and ingestion
    • Hybrid index
    • Permission filter
    • Re-ranked retrieval

  3. Models

    • Model gateway
    • Hosted, EU-hosted, self-hosted models
    • Guardrails on what goes in and out

  4. Application

    • Application that cites sources

  5. Operate and improve

    • Golden sets, regression gates
    • Traces plus cost and latency budgets
Retrieval, gateway and the evaluation loop

An illustration, not a client’s system.

Read the diagram as text

The main route goes from document stores to ingestion, then to a hybrid index, to retrieval with re-ranking, through the model gateway and on to the application.

Ingestion also takes data from business systems. The identity provider supplies a permission filter that limits what retrieval may return. Guardrails check what goes into and comes out of the application. The gateway sends requests to hosted frontier models, deployments hosted in the EU or open-weight models you run yourself.

Below sit an evaluation suite with golden sets and regression gates, and observability with traces and budgets for cost and latency. Traces from production flow back into the evaluation suite.

04 Considerations and limits

What to weigh up, and where the limits are

  • We measure quality rather than promise it

    How we handle it

    Quality criteria are agreed with your process owners, and every release is tested against them, both before and after it ships.

    We evaluate retrieval separately from generation, so each failure points at its own cause.

    Limits and dependencies

    Generated answers are sometimes wrong. For that reason we build review steps for doubtful cases and let the system abstain when it lacks evidence.

    A test set is only as strong as the experts who help write it, so we need some of their time early on.

  • Access rights travel with the content

    How we handle it

    We capture access rights when content is ingested and check them against your identity provider every time someone asks a question.

    Limits and dependencies

    If a source system keeps rights in a form we cannot read with confidence, its content stays out until that is fixed.

    Content that is over-shared in the source remains over-shared, and retrieval makes it easier to find. Sometimes a tidy-up has to come first.

  • Cost and response time shape the design

    How we handle it

    Every request type has a budget. We tune routing, caching and context size against it, and dashboards make the spending visible.

    Limits and dependencies

    Providers change prices and rate limits without asking you. The gateway gives you room to respond; it cannot undo a price rise.

  • Models shift under your feet

    How we handle it

    We pin each model to a version, and no upgrade reaches users until the full evaluation suite has passed.

    Limits and dependencies

    Hosted models are occasionally withdrawn at short notice. We prepare a fallback for each use case, which the owner signs off.

05 How we work

How we work

Sequence matters: we settle how success will be measured before we settle what to build.

  1. 01

    Define the use case

    Who will use it, which decisions it supports, which sources it may draw on and what a wrong answer would cost.

    OutputUse-case brief with a risk classification

  2. 02

    Assemble the golden set

    Real questions with the answers you expect, gathered with your subject experts, including those the system should decline.

    OutputTest set under version control

  3. 03

    Get retrieval right first

    Ingestion, index and permission filter, tuned until retrieval reaches the agreed standard.

    OutputReport on retrieval quality

  4. 04

    Release only through gates

    Generation, guardrails and the gateway go into production only after CI shows the evaluation suite passing.

    OutputA release backed by evaluation evidence

  5. 05

    Run and improve

    What traces, sampled reviews and user feedback reveal goes into the following release and its test set.

    OutputA monthly review of quality, cost and latency

06 Human control

Where your people keep control

Generative AI retrieves, drafts and suggests. Your people decide what it may see, what good looks like and what it does when it is not sure.

  • Owners approve quality

    For each use case, the business owner approves the quality criteria and the release evidence; the delivery team never signs off alone.

  • Doubtful answers go to a person

    Below a confidence level you agree, the system declines to answer or passes the question to a named team.

  • Access is decided at the source

    Whether someone may read a document is settled in the source system and your identity provider, never in the AI layer.

  • Flags lead to fixes

    Users can flag an answer. People review each flag, and every confirmed failure becomes a new test case.

07 Technologies

Technology we use

Retrieval
  • OpenSearch and Elasticsearch
  • PostgreSQL with pgvector
  • Azure AI Search
  • Cross-encoder re-rankers
Models
  • Hosted frontier models
  • Managed model services in EU regions
  • Open-weight models on vLLM
  • Embedding models chosen per language
Evaluation and ops
  • OpenTelemetry tracing
  • Evaluation suites run in CI
  • Registries for prompts and models
  • Langfuse or a similar tool
Application
  • Services in TypeScript and Python
  • Streaming APIs
  • Existing portals and front ends on SAP, Salesforce or Odoo

A technology on this list reflects our engineering experience with it, not a partnership with its vendor or an endorsement by them.

08 Example

An example, for illustration

Illustrative example

A guidance assistant for a State agency

01The situation
Staff at a State agency answer queries from the public using circulars, guidance notes and internal procedures spread over several document stores. The same query gets different answers depending on who picks it up, and new staff take months to learn where everything is.
02What we would put in place
Retrieval over circulars and guidance with access rights taken from each store, answers that cite the governing document and its date, and a route to an experienced colleague when the evidence is thin.
03Where staff decide
The owner of each guidance area approves the test set for that area and signs off any release that changes its answers.
04How we would judge it
Share of answers citing the correct and current document, how often the assistant declines queries outside its scope, and cost per answer.

09 Sector lens

By sector

  • Public Service & Government

    Assistants for public servants and members of the public that cite the source document, can work in Irish and English where the Official Languages Act calls for both, and keep a record of which passages each person was shown.

  • Financial Services

    Policy and procedure assistants for banks, insurers and fund administrators, with tight entitlements, full traceability and model risk documentation that your second line can check.

  • Healthcare & Life Sciences

    Retrieval over protocols, SOPs and product documentation within firm boundaries: no clinical decisions, and sensitive data held only where it has been approved.

Ireland

The AI Act in Ireland now has its own Act

The Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026. Under S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, the AI Office of Ireland is the central coordinating authority and single point of contact, while sector authorities, among them the Data Protection Commission, the HPRA, the CCPC and the Central Bank of Ireland, oversee AI in their own fields. Obligations for the high-risk uses listed in Annex III apply from 2 December 2027.

We build for that from discovery onwards: a risk classification and data residency choice for each use case, logging and documentation that answer the questions the DPC or a sector authority may put to you, and evaluation in English, and in Irish where a public body publishes in both. For public bodies this sits well with the secure-by-design principle of Connecting Government 2030.

Questions we hear about AI engineering

Which model would you recommend for us?

That depends on the task, the data it touches and where it must be hosted. Usually we combine several: a strong model for steps that need reasoning, smaller or self-hosted ones for classification and extraction, and deployments hosted in the EU where the data has to stay there.

Because the gateway keeps that choice reversible, the answer can change as models and prices move.

How accurate will the system be?

We will not put a figure on accuracy until we have measured it on your own data. We agree quality criteria, build a test set together and report against it before launch and after every change.

Models get things wrong, so the design always covers what happens next: abstaining, a review step, and a route to a person.

Could our data end up training another company’s model?

Not in the architectures we design. We choose model services whose terms rule out training on your inputs, or we host models in your own environment, and your security team signs off that choice for each use case.

Does the AI Act apply to our use case in Ireland?

In Ireland, national supervision of the EU AI Act rests on the Regulation of Artificial Intelligence Act 2026 and on S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026: the AI Office of Ireland coordinates, and sector authorities such as the DPC, the HPRA and the Central Bank of Ireland cover their own fields. We help you work out which obligations may apply, given the use case and whether you are provider or deployer, and we shape logging, oversight and documentation to fit, so your legal advisers have the facts to reach a view.

How do you protect security and sensitive data?

FromNine is certified to ISO/IEC 27001. We settle access boundaries, data residency and retention before building, and the release process we put in place includes red-team testing for prompt injection and data leaks.

Where should we begin?

With one use case that has a clear owner, a small set of sources and a test set built with your experts. You end up with a working system and real evidence on quality, cost and latency, which is what the next funding decision needs.

Bring one use case and the questions it struggles with

Before any talk of building, we will show you how its quality could be measured.

Talk to us about your projectExplore enterprise knowledge