Kyvvu raises €1 million to secure AI agents in regulated sectors

Den Bosch-based Kyvvu closed a €1 million pre-seed funding round on 18 August 2026. Volta Ventures and Brabantse Ontwikkelings Maatschappij (BOM) are jointly investing in the company, which is building a security layer for AI agents operating in heavily regulated sectors such as healthcare, financial services and insurance.

Kyvvu was founded by Jeroen Ghijsen (CEO) and Maurits Kaptein (CTO) and grew out of research at the Jheronimus Academy of Data Science (JADS) in Den Bosch. The system is already running in production at organisations in the Netherlands, in sectors where errors or data breaches have direct legal and operational consequences.

What the Agent Security Kernel does

Kyvvu's core product is the Agent Security Kernel, abbreviated as ASK. It runs as a security layer within an AI agent's own process and evaluates every action before it is executed. The outcome is always one of three results: allow, warn or block. According to the company, the evaluation takes less than one millisecond and all data remains within the user's own environment.

What distinguishes the approach from conventional security tools is that the kernel does not assess each action in isolation, but looks at the full sequence of steps an agent has already taken within a task. An agent that retrieves customer data and then sends a message to an external destination is blocked at that second step, even if that step would ordinarily be considered a routine action. The combination of steps makes the action risky, and the kernel recognises that pattern.

Policy rules are maintained in YAML files under version control in the customer's own git environment. No network connection is required per step, which limits latency and ensures data sovereignty. Kyvvu explicitly positions this as a European product that aligns with data residency requirements.

Alignment with the EU AI Act

Because every agent action is recorded in a chained log file, the system automatically generates the runtime documentation required by the EU AI Act. This covers support for Articles 9 (risk management), 12 (record-keeping), 14 (human oversight) and 15 (accuracy and robustness). Organisations do not need to purchase a separate governance tool for this; the log data flows to the SIEM system they already use.

Kyvvu has published a white paper on agent security at scale, written with input from senior staff at organisations including the Belastingdienst, ING, Rabobank and Arcadis. The approach is also described in a paper on arXiv, titled Runtime Governance for AI Agents: Policies on Paths.

Use of capital

Kyvvu will use the €1 million for three purposes: expanding the engineering team, growing the partner network and supporting implementations elsewhere in Europe. The company is also working towards security accreditations, including ISO 27001 and SOC 2.

The company works with authorised partners, consisting of tier-1 consultancies and AI governance specialists, who handle integration, policy design and ongoing customer support. For organisations in regulated sectors, Kyvvu offers a free proof-of-value engagement, in which the kernel is deployed alongside an existing agent with no commercial commitments.

Robin Hendrickx, Senior Investment Manager and Team Lead Key Technologies at BOM, states in the announcement:

"Every large organisation that takes agents into production will eventually run into the same wall. This team is already on the other side of it, from Den Bosch, with customers running in some of the most heavily regulated sectors in the Netherlands."

Broader context for the Dutch AI scene

Kyvvu is an example of a company focusing on infrastructure for AI agents rather than building models itself. As large organisations in healthcare, financial services and government begin deploying agents in production, demand is growing for tooling that governs and audits that deployment. In regulated sectors, that demand is directly tied to legal obligations, making the market concrete and urgent.

For founders and investors in the Dutch AI scene, this round illustrates that there is room for specialised security and governance tooling alongside the broader infrastructure players. BOM plays a recognisable role here as a regional investor that enters early in companies with an academic background, in this case originating from JADS. Whether Kyvvu can accelerate its European rollout on €1 million pre-seed will depend largely on how quickly large organisations outside the Netherlands scale their agent deployments and develop a need for demonstrable control.