What is private AI?
Private AI describes an artificial intelligence system whose data processing happens inside a perimeter controlled by the company: on its own hardware, or at an identified host, under contract, without the submitted content being reused to train third-party models. It is a commercial term rather than a technical standard, which makes it necessary to check what it covers in each case.
Definition
Private AI describes an artificial intelligence system whose data processing happens inside a perimeter controlled by the company: on its own hardware, or at an identified host under contract, without the submitted content being used to train third-party models.
It has to be said up front: "private AI" is a commercial term, not a technical standard. No norm defines what it covers. Two vendors can use it to describe very different architectures. The only useful attitude is to ask precisely what is meant in each case.
The degrees, from most open to most closed
Between "everything goes to a cloud giant" and "nothing leaves the building" there are several intermediate levels. Confusing them is the main source of misunderstanding.
| Level | Where processing happens | What to check |
|---|---|---|
| Consumer public API | At the vendor, standard terms | Content may be reused; avoid for client data |
| Business API under contract | At the vendor, negotiated terms | Written non-reuse, retention period, processing region |
| Dedicated instance at a host | On reserved infrastructure, chosen region | Identity of the host, subcontractors, applicable jurisdiction |
| Open model on a rented server | On a server you administer | Who has admin access, how logs are handled |
| Open model on your own hardware | On your premises | Hardware capacity, maintenance, updates, backups |
The last three levels are the ones usually meant by "private AI". The second sometimes is too, and that is not abusive as long as the contract is explicit.
The six points to get in writing
Rather than trusting the term, it is better to ask six questions and get the answers in writing.
- Where does processing physically take place? Country, and where relevant, data centre.
- Who has technical access to the data? The vendor, its subcontractors, the host.
- Is submitted content used to train a model? The answer must be a written no, not a box unticked by default.
- How long is data retained? Including in technical logs, which are often forgotten.
- Which jurisdiction applies if a foreign authority makes a request?
- What happens at the end of the contract? Return, deletion, and proof of deletion.
The Swiss framework
The Federal Act on Data Protection (FADP) applies to the processing of personal data. It does not impose any particular technical architecture and does not forbid using a foreign provider. What it requires is knowing which data is processed, for what purpose, by whom, and having subcontracting properly framed.
In other words: private AI is not a legal obligation, it is one way among others of meeting your obligations — often the easiest to explain when the data is sensitive. The FDPIC publishes guidance on data protection and the NCSC on information security; those are the sources to consult before committing to any legal claim.
Some sectors add their own constraints — legal professional privilege, medical confidentiality, FINMA requirements — which can be stricter than the FADP.
An accounting firm wants to automate the filing of its clients' accounting documents. Those documents contain salaries, bank statements, sometimes personal information.
Two architectures are conceivable. The first uses an online service under a business contract, with written non-reuse and processing in a defined region. The second runs an open model on a dedicated server, where extraction happens without the document leaving the perimeter. The second is more demanding to operate, but it is easier to explain to a client who asks the question. The choice is made on the level of explanation the firm wants to be able to give, as much as on the technology.
What it brings
- A simple answer to a client's question — "where do our documents go?" — which is often worth more than the technical argument itself.
- Control over retention: what is deleted really is, on infrastructure you control.
- Independence from a vendor's changes of terms or pricing.
- Predictable cost at sustained load, without per-use billing.
Limits and risks
- The operating burden changes hands. Updates, monitoring, backups and disaster recovery become your responsibility.
- Locally runnable models are smaller than the largest commercial ones. On well-defined tasks the gap is often negligible; on long reasoning it shows.
- The false sense of security. A badly configured internal server is less safe than a well-contracted professional service. "Private" does not mean "secure": those are two separate subjects.
- The entry cost. Hardware and commissioning are an investment that only makes sense above a certain level of use.
When this approach makes sense
It makes sense when the data processed is covered by professional secrecy, when clients explicitly ask about hosting, when volume is regular and substantial, or when the company wants to stay independent of a single vendor.
It makes less sense for a first low-volume trial on non-sensitive data, or when no operating skills are available. In that case a service under a clear contract, with an abstraction layer allowing a later change, is a reasonable starting point — see local AI or cloud AI.
Frequently asked questions
Does private AI mean nothing leaves the company?
Not necessarily. Depending on the architecture chosen, processing may happen on your own hardware, or at a host under contract. These are two different levels, to be clarified before committing.
Do you need private AI to comply with the Swiss data protection act?
No, the law does not require any particular architecture. It requires knowing which data is processed, by whom, where, and on what basis. Private AI is one way to answer that, not an obligation.
Is private AI less capable?
A model running on local hardware is generally smaller than the largest commercial models. For well-defined tasks — extraction, classification, rewriting — the gap often has no practical consequence.
Related articles
Sources
- Préposé fédéral à la protection des données et à la transparence (PFPDT) — https://www.edoeb.admin.ch/fr
- Loi fédérale sur la protection des données (LPD, RS 235.1) — https://www.fedlex.admin.ch/eli/cc/2022/491/fr