The Pitch Sounds Responsible
Someone — a vendor, a consultant, maybe a well-meaning IT contact — has told you that AI can run on your own hardware or in a private cloud environment you control. Your data never leaves. It's yours. It's safe. It sounds like the grown-up version of AI: no sharing, no risk, total control.
It's a compelling pitch. And for the overwhelming majority of businesses with 5 to 200 people, it is solving a problem you do not have, at a cost you have not been shown.
That's the direct answer. The rest of this article explains what's actually on offer, what it actually costs, and — because this isn't a blanket dismissal — the specific situations where it genuinely makes sense.
What "Private AI" Actually Means
There are three meaningfully different things people call "private AI," and conflating them causes a lot of expensive decisions.
1. Running an open model on your own hardware
Some AI models — Llama (from Meta), Mistral, Phi (from Microsoft), and others — are released as open weights, meaning anyone can download and run them. You can put one on a server in your office, in a data centre you rent, or on a high-powered workstation under someone's desk. Your prompts and data go nowhere except that machine.
This is the most "private" option. It is also the most demanding. You need hardware capable of running the model (anything capable of running a competitive model costs several thousand pounds at minimum), someone who can set it up and keep it running, and a plan for what happens when that model is six months old and noticeably worse than whatever's available from the mainstream vendors.
2. A private deployment inside a cloud infrastructure you control
You rent cloud computing (AWS, Azure, Google Cloud), and run an open model there, or subscribe to a managed private deployment of a commercial model. Your account, your virtual machines, your data boundary. Several enterprise AI providers offer this.
The data stays within your cloud tenancy. But you are still running cloud infrastructure — which means someone has to manage it, patch it, resize it, and pay for it whether you use it or not.
3. Business-tier plans from mainstream vendors
This is the option that most private AI pitches conveniently skip past.
OpenAI, Anthropic, Google, and Microsoft all offer business or enterprise subscription tiers with explicit contractual commitments: your data is not used to train their models, conversations are not retained beyond the session or are deleted on a defined schedule, and usage is covered by data processing agreements that satisfy most standard compliance requirements.
ChatGPT Team and ChatGPT Enterprise. Claude for Work. Microsoft 365 Copilot. Google Workspace with Gemini. These are not free consumer products. They are commercial services with legal commitments behind them.
The Cost You're Not Being Shown
Here is the honest version of the private AI cost calculation.
The hardware or cloud bill is the easy part. What gets left off the estimate, almost every time, is the human cost of maintaining it.
A self-hosted AI system needs someone to:
- Set it up correctly and securely in the first place (this is not a weekend project)
- Apply security patches to the underlying operating system and the software stack around the model
- Monitor it — not just "is it up?" but "is it behaving correctly, has it been accessed in unexpected ways?"
- Upgrade the model when a better one lands — and better ones land every few months, so this is a recurring cost, not a one-time event
- Handle failure when it happens, ideally not at 9am on a Tuesday when your team is trying to work
If you have a capable, available IT person or a managed service provider who already handles your infrastructure, this is an easier argument. But most 5–200 person businesses don't. They have a person who is good with computers, or an IT company that handles their desks and printers. Running an AI inference server is a different category of work.
The mainstream business plans — ChatGPT Team runs around $30 per user per month, Microsoft Copilot around $30, Claude for Work at a similar level — include patching, uptime, security, and model upgrades as part of the service. The model you use today will be replaced by a better one without you doing anything, and without you paying extra.
A private deployment that is under-maintained is not more secure than a well-run vendor's platform. It is less secure. A forgotten server running a six-month-old model with an unpatched vulnerability is not a data protection measure. It is a liability.
When Private AI Actually Makes Sense
This is a fair question, so here is a fair answer. Private AI is a legitimate choice in a small number of specific situations.
A named legal or regulatory obligation about data residency. Some sectors have rules — or client contracts — that specify where data may be processed or stored. If a contract says your data cannot leave a particular jurisdiction, or a regulator has told you it must stay on-premise, that is a real requirement. Most business-tier cloud plans from major vendors already have region-specific options that satisfy common versions of this — but if yours doesn't, you have a genuine case.
A client whose own security review requires it. If you're working with a client — often in government, defence, finance, or healthcare — whose infosec team will not approve third-party SaaS AI tools, and that client is important enough to justify the infrastructure cost, that's a legitimate driver. The key word is "requires," not "prefers."
Volume high enough that usage-based pricing stops making sense. If you're running tens of thousands of AI calls a day — document processing at scale, high-volume automation — there's a point where the economics of per-token pricing tip in favour of running your own compute. For most businesses in the 5–200 person range, you are nowhere near that volume. If you think you might be, run the numbers with someone who will show their working.
A genuine need to work offline or air-gapped. Field operations, secure facilities, locations without reliable internet. Real use case. Rare.
Note what's missing from that list: "we handle sensitive information" as a general statement. Most businesses do handle sensitive information. That's why the business-tier agreements exist. Sensitivity of data is not by itself a reason for private infrastructure; it's a reason to read the contract carefully — which is a very different exercise, and a much cheaper one.
The Questions to Ask Anyone Proposing This
If someone is recommending a private AI deployment to your business, these are the questions that will tell you whether it's a real recommendation or a product pitch dressed up as risk management.
What specific obligation does this satisfy? There should be an answer that names a regulation, a contract clause, or a client requirement. "It's safer" or "your data stays private" are not answers — they are feelings. The business-tier plans already address data privacy; what they're proposing needs to be better than that in some specific way.
Who will maintain it, and what does that cost? Get a number. Include patching, monitoring, model upgrades, and what happens when something breaks over a holiday weekend.
What happens when this model is superseded? Because it will be, probably within a year. Who does the upgrade, how much does it cost, and what's the downtime?
What does the same work cost on a business plan from the mainstream vendor? Run the comparison honestly. If no one has done this calculation, that's a signal.
What's the security posture of the proposed setup, and who is responsible for it? A self-hosted server with no dedicated security monitoring is not automatically more secure than a vendor with a full security team and SOC 2 certification.
The Pattern Worth Being Sceptical Of
"Private AI" is increasingly being sold as a feeling of safety — a vague sense that your data is more yours, that you're being responsible, that you're not naively trusting a big tech company.
That feeling is understandable. But it's not the same as actual data protection, and it can lead you to spend significantly more money on a system that is, in practice, less well-maintained and less secure than the platform you were already on.
If you want to understand what data privacy actually looks like when you use mainstream AI tools — what the contracts say, what the risks really are, and what you should actually be careful about — the detail is in what really happens to the data you put into AI tools. The short version: the risk is usually not "the vendor reads your data." The risk is how your team uses these tools, what they paste into them, and whether there are any guardrails. Private infrastructure doesn't fix any of that.
And if the person proposing a private AI setup is an outside vendor, it's worth asking the questions in how to tell a real AI partner from a hype merchant — because "we'll build you a private AI" is exactly the kind of proposal that sounds sophisticated but may be doing more work for the vendor than for your business.
Where to Start Instead
For most businesses reading this, the sensible path is:
- Move your AI usage off free consumer accounts and onto business-tier plans. This solves the real data question contractually, not architecturally.
- Establish a simple policy for how your team uses AI tools — what can go in, what can't, and what accounts to use. This addresses the actual risk.
- If you have a specific contractual or regulatory situation, get a clear answer about whether the mainstream business plans satisfy it before assuming they don't.
Private AI infrastructure is a real thing that real businesses sometimes need. But "someone sold it to me as the safe option" is not the same as "I have a requirement that makes it necessary." The question is whether the proposal answers a named problem you actually have — or whether it's a solution in search of a justification.
If you're being pitched a private AI setup and want a straight answer about whether it makes sense for your business, book a strategy call. We'll look at what you actually need, what it actually costs, and whether there's a simpler answer — because there usually is.