London Worked from Barcelona UK GDPR and EU GDPR One hour ahead of us

London.
UK GDPR settled first.

We are based in Barcelona and work with London companies constantly — close enough to be in your office when it matters, far enough that we will not pretend a video call is a site visit. The genuinely London-specific part of the work is not the accent: it is that your data now sits on the far side of an adequacy decision from ours.

Last reviewed 5 September 2026 · Engineering guidance, not legal advice.

WHAT IS ACTUALLY DIFFERENT HERE

Two regimes, not one

A London company runs under the UK GDPR and the Data Protection Act 2018, supervised by the ICO. If any part of your business or your customer base sits in the EU, you are operating under both regimes at once, and the architecture has to hold for the stricter of the two rather than for whichever is convenient. We design on that basis by default.

The adequacy question

Data moving between the UK and the EEA currently rests on adequacy decisions that are reviewed periodically rather than granted permanently. We do not treat that as settled: where a system can be designed so it does not depend on the decision surviving, we design it that way, because rebuilding a data path under time pressure is the expensive version of this conversation. Your counsel owns the legal call; we own not making it harder.

London-region compute is right there

The major providers all run UK regions in and around London, so keeping inference and storage physically in the UK is an ordinary configuration choice rather than a project. For a regulated client that usually removes the transfer question from the AI layer entirely, which is the cheapest way to win the argument.

Sector-specific supervision on top

Financial services adds the FCA, insurance adds Lloyd's market expectations, and legal work adds privilege. None of these prohibits AI. What they do is decide where a human sits in the loop and what evidence you have to be able to produce afterwards — which is a design input, and cheaper to accept at the start.

THE WORK THAT COMES OUT OF THIS CITY

London's concentration is financial services, insurance, law, media and professional services — which means the AI problems that arrive from it are overwhelmingly document and decision problems rather than manufacturing or sensor problems.

Banks, insurers and asset managers arrive with a process where a person reads a long document and then makes a judgement that has to be defensible months later. The interesting engineering is almost never the model; it is the trace — what the system saw, which policy clause it relied on, who approved it. Our risk and compliance architecture is that pattern written down.

Law firms and in-house legal teams arrive with contract review, discovery and research, and with a hard constraint that client material cannot go anywhere it might be retained or trained on. That usually resolves to a deployment inside their own perimeter, which we cover under legal and compliance.

Media and publishing groups arrive with archives — decades of material that is technically online and practically unreachable. Retrieval over that is the most reliably valuable AI project in the sector, and the least glamorous.

Scale-ups arrive needing AI capability inside the product itself, where the constraint is unit economics rather than compliance. That is a different engagement shape, and it is covered under startups.

HOW A LONDON PROJECT ACTUALLY RUNS

We come over for discovery

The first workshop is worth doing in a room. Barcelona to London is a short flight and we do not charge it as a line item on a normal engagement.

Then remote, with a full day of overlap

We are one hour ahead. A question asked at 09:00 in London is answered the same morning, which sounds trivial until you have run a project against a team eight hours away.

And back for handover

The session where your engineers take ownership goes better in person too. After that the system is yours, in your repositories and your cloud accounts.

QUESTIONS

QUESTIONS — 5

No. We have one office and it is in Barcelona. We travel to London for discovery, for handover and for anything where being in the room genuinely changes the outcome. A team our size claiming a London office would be describing a mailbox.

Yes. The major cloud providers all run UK regions, and open-weight models can be self-hosted inside your own perimeter, so a system where no personal data leaves the UK is an ordinary configuration rather than a special build. Where a hosted model is used we document its retention and training terms at the time of writing, and you should confirm them against the provider's current terms.

For contracting, no — we invoice in GBP or EUR and work under a normal services agreement. For data, it is a real question and worth being straight about: we are an EU company, so if we process personal data on your behalf that is a UK-to-EEA transfer needing the appropriate mechanism. In practice most of our engagements avoid it entirely, because the system runs in your cloud accounts and we never hold the data.

Not in itself. Financial services regulators have been consistent that existing rules on governance, accountability and outsourcing apply to AI rather than being replaced by it. What that means practically is a named accountable person, a human decision point where the output affects a customer, and records that reconstruct a decision after the fact. We build for that; your compliance function owns whether it is sufficient.

The same as anywhere else — our ranges are on the pricing page, in euros and exclusive of VAT. We do not price by postcode.

Keep reading

Industry

AI for Financial Services

→

Trust

Data Residency & Sovereignty

30-minute technical call · no deck