The AI assistant that answers to you. Not to a US provider.
Built for EU financial institutions. Lucy uses your applications, remembers how your institution works and carries out routine tasks, on Mistral models.
- Runs in our EU cloud, your cloud or your data centre
- Zero data retention by default
- Every action on record
Made in Luxembourg, the LU in Lucy. Built on Mistral.
Interactive replica of the Ask Lucy app. Pick a task, or type one, to watch Lucy work and fill the audit trail.
DORA register, Q4 contracts
Mistral, open-weightUpdate our DORA register of information with the ICT contracts signed this quarter. Flag any contract without an exit clause.
Lucy
I'll open the contract repository, read the new ICT contracts and add them to the register. Anything without an exit clause gets flagged.
Computer use: contract repository, read onlyDone
- Open the contract repository
- Read the new ICT contracts
- Extract provider, service and notice period
- Add entries to the register
- Check each contract for an exit clause
Done. I added 14 entries to the register of information. Two contracts have no exit clause: Nordwind Hosting and Kestrel Analytics. They need your decision before the register goes out.
6 actions on record in the audit trail
Update our DORA register of information with the ICT contracts signed this quarter. Flag any contract without an exit clause.
Lucy
I'll open the contract repository, read the new ICT contracts and add them to the register. Anything without an exit clause gets flagged.
Computer use: contract repository, read onlyDone
- Open the contract repository
- Read the new ICT contracts
- Extract provider, service and notice period
- Add entries to the register
- Check each contract for an exit clause
Done. I added 14 entries to the register of information. Two contracts have no exit clause: Nordwind Hosting and Kestrel Analytics. They need your decision before the register goes out.
6 actions on record in the audit trail
Register of information, Q414 new entries
| Provider | Function | Exit clause |
|---|---|---|
| Nordwind Hosting S.A. | Critical | Missing |
| Fjord Payments AB | Critical | Yes |
| Delta Records S.à r.l. | Other | Yes |
| Kestrel Analytics GmbH | Important | Missing |
| Lumen Print S.A. | Other | Yes |
| Orbit Telecom S.A. | Important | Yes |
8 more entries
- Opened contract repository, read only
- Read 14 contracts, 312 pages
- Model call: Mistral, open-weight, on-premises
- Wrote 14 rows to the register
- Flagged 2 contracts with no exit clause
- Review requested from A. Schmit
6 actions on record, kept in your deployment.
Go through the 40 client files due for periodic review and list every expired identity document.
Lucy
I'll work through the files in CoreBank 7, read each identity document and compare its expiry date with today.
Computer use: CoreBank 7, read onlyDone
- Open CoreBank 7
- Open each client file due for review
- Read the identity document details
- Compare expiry dates with today
- Add them to the remediation list
All 40 files checked. Three identity documents have expired. I added them to the remediation list with their client numbers.
6 actions on record in the audit trail
Client file 4471-22File 18 of 40
Remediation list
- 4471-22Maison Lentz S.A.Passport, expired 14.03.2026
- 5120-07J. FeltgenID card, expired 02.08.2026
- 6034-15Atelier Roth S.à r.l.Passport, expired 29.09.2026
- Opened CoreBank 7, read only
- Read 40 client files
- Model call: Mistral, open-weight, on-premises
- Flagged 3 expired identity documents
- Added 3 entries to the remediation list
- Notified L. Weber
6 actions on record, kept in your deployment.
Draft our notification to the CSSF for the new cloud contract, the way we prepared last year's.
Lucy
I'll start from last year's notification in memory, follow outsourcing policy version 7 and read the new contract.
Memory and documentsDone
- Recall last year's notification
- Read outsourcing policy, version 7
- Read the new cloud contract
- Draft the notification
- Mark the points that need a decision
The draft is ready, in the same structure as last year's. Two points need your decision: whether the service supports a critical or important function, and the notice period in the exit plan.
6 actions on record in the audit trail
Notification to the CSSFDraft, 3 pages
1. The arrangement
We plan to move the hosting of our document management system to an EU cloud provider from 1 February 2027.
2. Assessment
Decision needed: does the service support a critical or important function?
3. Exit strategy
Decision needed: notice period for the exit plan, 6 or 12 months.
Sources
- Outsourcing policy, version 7
- Notification to the CSSF, 2025, from memory
- Recalled CSSF notification 2025 from memory
- Opened outsourcing policy, version 7
- Read new cloud contract, 64 pages
- Model call: Mistral, open-weight, on-premises
- Marked 2 points for a decision
- Draft sent to M. Hoffmann
6 actions on record, kept in your deployment.
What should Lucy work on?
She runs on Mistral in your data centre. The model keeps nothing, and every step is on record.
Lucy's result and the audit trail appear here while she works.
Lucy
This demo runs three tasks: the DORA register, KYC files and a CSSF notification. Pick one below, or book a demo and we will show you Lucy on your own work.
Illustrative example. Names and figures are fictional.
Your teams want AI. Your obligations still apply.
The best-known AI assistants come from US companies and run closed models. Here are the questions your outsourcing review will ask, answered for both.
| What your review asks | An assistant from a US provider | Ask Lucy |
|---|---|---|
| Who is the provider? | A US company | A Luxembourg company |
| Which law reaches the provider? | US law, including the CLOUD Act, wherever the data is stored | EU and Luxembourg law |
| Where does it run? | The provider's cloud, which may be in the EU | Our EU cloud, your private cloud, or your own data centre with no outbound connections |
| Which model, and can you host it? | A closed model the provider updates on its own schedule | Mistral. Confidential work runs on open-weight models you can host yourself |
| What does the provider keep? | Set by the provider's terms | Nothing by default. Lucy's memory and audit trail stay in your deployment |
| What can your auditors see? | The logs and exports the provider offers | Every prompt, tool call and agent action |
Zero data retention means prompts and outputs are not kept after processing. What Lucy remembers and records stays in your deployment.
A general comparison. Terms vary by product and contract, so check each provider's current terms.
Mistral supplies the model. We build the harness around it.
Where Lucy runs, what she may access, what is kept and what is recorded, built for EU financial institutions and the rules they work under.
Lucy does the work. Every step is on record.
Beyond drafting and summarising, Lucy can use your applications, remember how your institution works and carry out multi-step tasks.
Uses your applicationsComputer use
Lucy reads the screen, clicks and types in the software your staff use. This can include older systems without an API.
Watch her check KYC filesRemembers your contextMemory
Lucy keeps your policies, templates and earlier work in mind, so each task starts from how your institution already works.
Watch her draft a CSSF notificationRuns multi-step tasksManaged agents
Lucy works through a task step by step and puts each step on record in the audit trail.
Watch her update the DORA register
The tasks in the app above are illustrative. Names and figures are fictional.
Choose where Lucy runs.
Three deployment options, side by side. Pick one to see how far your data travels.
- Your premises
- Your private cloud
- Ask Lucy EU cloud
How Lucy supports your obligations.
Ask Lucy supports these frameworks. Your institution remains responsible for its own compliance.
| Framework | What it asks of you | How Ask Lucy supports it |
|---|---|---|
| DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 | Manage ICT third-party risk, keep a register of information, and plan exits for services that support critical or important functions. | Deployment inside your own perimeter, open-weight models you can host yourself, and an audit trail you can use as evidence. |
| EBA outsourcing guidelinesEBA/GL/2019/02 | Keep access and audit rights, know where data is processed, and stay in control of outsourced functions. | You choose where Lucy runs. Every action is on record for your auditors. |
| CSSF outsourcing rulesCircular CSSF 22/806, as amended | Assess and document outsourcing arrangements, cloud included, and notify the CSSF where required. | We tell you where Lucy runs and where data is processed, for your assessment and any notification. |
| GDPRRegulation (EU) 2016/679 | Process personal data lawfully and control transfers outside the EU. | Processing stays where you deploy Lucy: our EU cloud, your cloud or your premises. Zero data retention by default. |
See Lucy at work.
We show Lucy on work like the examples above, then answer your questions on deployment, data and the audit trail. Bring the colleagues who will review it.
Or write to hello@asklucy.eu.