Situation
A private institution has a defined AI use case and must choose a hosted service, a locally controlled deployment or no model at all.
Hosted service
Best when capability quality, speed and managed operations matter more than complete infrastructure control; inputs can be minimised; contractual terms are credible; and exit is practical.
Primary risks: provider retention, changing terms, subprocessors, account compromise, opaque model updates and dependency.
Local or dedicated deployment
Best when information sensitivity is high, workload is stable, the institution can operate the stack and model performance is sufficient. Local does not mean safe by default. Weak patching, broad administrator access and poor evaluation can create a private failure.
Primary risks: false confidence, operational burden, stale models, hardware dependency and inadequate evidence.
No model
Best when the job is poorly defined, the consequence of error is intolerable, lawful use is unclear, source evidence cannot be preserved or the institution cannot supervise the system. “No model” may mean using deterministic search, rules or human expertise instead.
Decision rule
- Use hosted when data can be bounded and provider risk is lower than operating risk.
- Use local when control materially changes consequence and operating competence is real.
- Use no model when neither architecture can make the use case accountable and reversible.
Recommendation
Run the decision against one concrete dataset and workflow. Score confidentiality, consequence, model quality, operator competence, evidence, cost of exit and manual fallback. Revisit when the data, model or decision changes.
The architecture is not a statement of sophistication. It is a choice about where failure, dependence and proof will live.