Private AI in business: the four levels of control

A private AI in business is not a product you buy: it is a degree of control over what becomes of your data. Behind the words “private AI”, “sovereign AI” or “closed AI”, only one question matters: when an employee or an automation queries a model, where does the data go, and who can access it? This comparison, from our Business AI: private and at the right cost section, sets out four levels, then gives a grid for choosing.

Where your data goes, level by level

We distinguish four levels:

The CNIL (France’s data protection authority) sets out the issue in its questions and answers on generative AI. With an API, “control of the system is then almost exclusively in the hands of the provider”; an on-premises installation, by contrast, makes it possible to “limit the risks of data extraction by a third party”, at the price of operations you have to take on. No level is right for everything, and a single company can use several.

Level 1: the API as is

This is the starting point of most projects: an API key, a model from the market, the provider’s terms and conditions. The big vendors make commitments on their business offering: at Anthropic, the page on data retention states that retained data is never used to train models without the customer’s express permission.

This level does not guarantee where processing happens. On Anthropic’s direct API, as of October 2026, the inference geography can be chosen between “global” (any region) and “us” (the United States), with no European option, and retained data is stored in the United States, the only storage region on offer. For public content (product pages, articles, pages already online), this level is often enough, and it is the cheapest. For personal data, you need at least the next level.

And this level has nothing to do with a consumer subscription opened by an employee with a personal email address. For such services, the CNIL recommends “never sharing confidential information such as personal data or company data”.

Level 2: the API under contract

Same model, same performance, three extra safeguards:

• A data processing agreement. As soon as your requests contain personal data, the provider processes it on your behalf, and Article 28 of the GDPR requires a contract that sets what it may do with it.
• No retention. At Anthropic, the “zero data retention” agreement is requested from the sales team, and it has exceptions.
• A processing region. Through a large cloud (Amazon Bedrock, Google Cloud), you choose a regional endpoint, which guarantees that data is routed through a specific geographic zone; Anthropic’s pricing page says it costs 10% more than a global endpoint. The cloud provider then becomes the processor, and you still need to check that the model you want is offered in the chosen region.

The limit of this level fits in one sentence: a contract governs what the provider does with your data, it does not exempt the provider from the laws of its country. When the infrastructure is outside the European Union or “operated by a non-European provider”, the CNIL also asks that the processing of the data by its recipient be regulated. We detail these obligations in our guide AI, GDPR and the AI Act: what an SME must do.

Level 3: an open model in a private cloud in Europe

Here, you no longer rent a service, you rent a machine. Some vendors publish the “weights” of their models, meaning the model itself: the French company Mistral AI, for instance, publishes several of its own, from Ministral 3 to Mistral Large 3, under the Apache 2.0 licence. They are installed on a server with a GPU rented from a European host, and requests no longer leave that infrastructure. Three things change:

• The bill is paid per machine, whether it is working or not: that is worthwhile at a steady volume, much less so for a few requests a day.
• Quality depends on the model the machine runs. An open model of reasonable size can be enough to sort, extract or summarise; it should be judged on your own examples before you entrust a task to it.
• Operations fall to you: updates, monitoring, backups. This is the real cost of this level, and it appears on no price list.

Level 4: on-premises

The model runs on a machine installed on your premises. When the system is given customer or employee data, or sensitive or strategic documentation (for example for a RAG), the CNIL writes that it “generally seems more appropriate and more secure” to favour this on-site deployment, while noting that the cost of installing and operating it often makes it “easier” to use remote hosting.

And what about RAG?

RAG (retrieval-augmented generation) gives the model, for each question, the extracts of your documents that answer it. The direct consequence: the extracts of your documents go wherever the model runs. A RAG over your contracts connected to a level 1 API sends pieces of contracts to the provider with every question. Two things need checking besides the model:

• the vector database, which stores your documents split up and indexed, must be at the same level of control as the model;
• the computation of embeddings, the numerical fingerprints used to find the right passages, often goes through another API: that is a second data flow to be governed.

The CNIL specifies that a company that “chooses to connect the system to its own knowledge base (RAG)” is responsible for this processing as soon as the base contains personal data. We detail the rest in our article on RAG applied to a company’s documents.

How to choose the right level, task by task

The CNIL recommends “starting from concrete needs to choose the most suitable system and taking into account the risks incurred”. We therefore start from a grid that classifies data, not tools:

This grid is ours, not a standard. A provider’s commitment is checked at the time of choice, the grid is discussed with your data protection officer, and it changes if your customer contracts require specific hosting.

A single application can mix levels: a router sends each request to the level that suits its data, a market model for public data, a local model for anything involving people. The rule must then be written down, tested and logged, because sensitive data sent to level 1 by mistake is an incident to be handled as such.

What these levels do not solve

No level makes a model reliable: a model installed on your premises makes as many mistakes as any other, and its answers need checking in the same way. None replaces usage rules, which the CNIL recommends setting “through internal policies or charters, clearly defining authorised and prohibited uses”. Choosing the level is only one of the five decisions in our guide to integrating AI in your business, along with the task, the model, the cost and these rules. And an in-house server with no updates or backups protects less than a well-run level 2.

Where to start

The starting point comes down to three steps:

1. 01List.

   Note your current uses, the data each one sends and the level at which it runs today.

2. 02Compare.

   Set your uses against the grid: the gap jumps out.

3. 03Cost.

   Before moving a use, work out what the target level would cost: pay-per-use tokens on one side, the machine and its operation on the other.

To get a sensitivity grid for your own data and find out which uses can stay where they are, see our AI at the right cost offer.

Frequently asked questions

Sources

1. Its questions and answers on generative AI (new tab)cnil.fr
2. The page on data retention (new tab)platform.claude.com
3. The inference geography (new tab)platform.claude.com
4. Article 28 of the GDPR (new tab)cnil.fr
5. Anthropic’s pricing page (new tab)platform.claude.com
6. Under the Apache 2.0 licence (new tab)docs.mistral.ai
7. The Cloud Act (new tab)law.cornell.edu