A law firm pasting contracts into a public chatbot is sending client data to servers it does not control. In regulated industries that habit can end in GDPR fines of up to 20 million EUR or 4 percent of annual global turnover. There is a workable alternative: private AI, on EU private cloud or on-premise, with projects starting at 1,500 EUR and the model fully under your control.
What is private AI and how is it different from a public chatbot?
Private AI means running language models on infrastructure the company controls: its own servers (on-premise) or a private cloud contracted within the European Union. The difference from a public chatbot is not the technology, it is the journey the data takes. With a public API, every document travels to the provider's servers, often outside Europe. With private AI, information never leaves the perimeter the company defines.
That distinction is decisive in four sectors. In legal, professional secrecy prevents sharing case files with unauthorised third parties. In healthcare, medical records are special category data under Article 9 of the GDPR and require reinforced safeguards. In finance, supervisors demand full traceability of every processing operation. And in the public sector, national security frameworks restrict which providers and hosting locations are acceptable.
Which deployment options exist for using AI with sensitive data?
The first option is a public API such as those from OpenAI, Anthropic or Google. It is the cheapest to start with, billed per use, and needs no hardware. In exchange, data leaves the company and compliance depends on the provider's data processing agreements. It is reasonable for non-sensitive content: drafting commercial copy, classifying generic emails or generating internal documentation that contains no personal data.
The second is EU private cloud: open models such as Llama, Mistral or Qwen deployed on dedicated servers inside the EU, contracted in the company's name. Data stays on European soil, encrypted in transit and at rest, and the model vendor never sees a single query. Typical infrastructure costs run at 100-500 EUR per month depending on model size and usage volume.
The third is on-premise deployment: the model runs on the company's own hardware. A server with a 24 GB GPU, from around 2,500 EUR, comfortably runs models of 7 to 14 billion parameters, enough for summarisation, extraction and document classification. Nothing leaves the building. It carries the highest upfront investment and it is the only option that removes third-party data transfers entirely.
Which option suits each regulated sector?
A practical rule that holds up: if a piece of data cannot leave the organisation even encrypted, deploy on-premise; if it can leave encrypted to an EU provider under a data processing agreement, an EU private cloud is enough; if the content carries no personal or confidential data, a public API is defensible. Documenting that classification per data type is also half of your compliance work done.
In practice, law firms and clinics lean towards on-premise or private cloud with prior anonymisation. A mid-sized firm can index 20 years of case files into an internal semantic search engine without a single document leaving its server. Financial entities and public bodies usually choose certified EU private cloud, which combines data residency with a lighter maintenance burden. We cover architectures and use cases in our guide to private AI agents for business automation.
How much does private AI cost for an SME?
The real numbers are lower than most buyers assume. An AI integration with email, ERP or CRM typically costs 1,500 to 4,000 EUR. A mid-sized project, such as an internal document assistant with semantic search, starts at 1,500 EUR and ships in 3 to 6 weeks. A full on-premise system with RAG over thousands of documents starts at 5,000 EUR and takes 2 to 4 months.
On top of that come recurring costs: private cloud infrastructure or hardware amortisation, plus evolutionary maintenance, which starts at 500 EUR per month on a technical retainer. As a general reference, most private AI projects for SMEs land within 1,500 to 15,000 EUR. The key is a fixed price agreed before work starts: paying by the hour on AI projects is an invitation for the scope never to end.
What do the GDPR and the AI Act require in 2026?
The GDPR requires a legal basis for every processing operation, a data processing agreement with any provider touching personal data, and additional safeguards for transfers outside the EU. For health data or financial profiles, a prior impact assessment is advisable. Fines reach 20 million EUR or 4 percent of annual global turnover, whichever is higher.
The EU AI Act applies in stages from 2025 and adds transparency and documentation duties depending on the system's risk level. For most internal SME uses, summarisation, classification and document search, the level is limited or minimal, but you must be able to show which model you run, on which data and with what human oversight. A self-hosted open model makes that traceability straightforward: the company knows exactly which version it runs and what gets logged.
In practice, the compliance file for a private AI project has four parts: an updated record of processing activities, the processing agreement with the infrastructure provider, query logs with a defined retention period, and an anonymisation procedure for the data feeding the system. Building it from day one takes hours; reconstructing it after a regulator's request takes weeks.
How do you start with private AI without risking data or budget?
The lowest-risk path is a contained pilot: one process, low-sensitivity documents and metrics defined before work starts, such as hours saved per week or the percentage of correct answers. Within 3 to 6 weeks you know whether the system delivers value and what scaling it would cost. Through our artificial intelligence services for business, that pilot is quoted at a fixed price.
The supplier criteria matter as much as the technology. At ASD Solutions the same senior engineer who quotes the project delivers it, with no subcontracting, and the code and deployed models belong to the client from day one, with no vendor lock-in. And if the honest conclusion is that you do not need AI, we will say so: a 190 EUR technical audit with an initial diagnosis in 72 hours settles that question before you spend a euro on the project.
Frequently asked questions
Which AI platforms support on-premise or private cloud deployment?
Open models are the main route: Llama, Mistral, Qwen or Gemma, served with tools such as Ollama or vLLM on your own hardware or on dedicated EU servers. A server with a 24 GB GPU, from around 2,500 EUR, runs models of 7 to 14 billion parameters, enough for most document tasks in an SME.
How much does a private AI agent cost for an SME?
A contained integration with email, ERP or CRM costs 1,500 to 4,000 EUR. An internal document assistant starts at 1,500 EUR and ships in 3 to 6 weeks. A full on-premise system with RAG starts at 5,000 EUR. Ongoing maintenance on a technical retainer starts at 500 EUR per month.
Is it legal to use ChatGPT with client data in a regulated industry?
It depends on the data and the contract. Personal data requires a data processing agreement and safeguards for transfers outside the EU. For health records or files under professional secrecy, the regulatory risk is high and the standard advice is not to send them to public APIs. GDPR fines reach 20 million EUR or 4 percent of turnover.
Does a private model perform as well as GPT or other frontier models?
For 80-90 percent of business tasks, yes: summarisation, classification, data extraction and document search work well with open models of 7 to 70 billion parameters. For occasional complex reasoning you can add a hybrid architecture that sends only previously anonymised content to a public API.
How long does it take to get a private AI system running?
A contained pilot ships in 3 to 6 weeks. A full on-premise system with document RAG takes 2 to 4 months. If the starting point is unclear, a 190 EUR technical audit delivers an initial diagnosis within 72 hours and the full report within 5 working days, deductible from the project.
