Private AI for business means using AI models on company data without that data being used to train the model, kept where you cannot control it, or handled by a company you have no contract with. There are four ways to get there: a business plan with no-training terms, the same model through your own cloud account, a self-hosted open-weight model, or keeping the model away from the sensitive record. Most companies need the first two.
Search for "private AI" today and six of the first ten organic results come from companies that sell data-centre space, servers or data platforms (our SERP check of 13 October 2026). Their answer is infrastructure you buy. That fits some cases. For most of the businesses we work with, the data that needs protecting is covered by a contract and an admin setting they already pay for, and the real exposure is somewhere else. This guide covers all four options, what each one keeps private, what it costs you in operating effort, and which one we would pick for which kind of data.
What does "private" have to cover?
Before comparing options, decide which of these four questions your data has to pass. Vendor marketing mostly answers the first.
- Training. Will the vendor use your prompts and outputs to improve its models?
- Retention and location. Where is the data stored, for how long, and can you change either?
- Processor. Which company processes the data on your behalf, and is it covered by a contract you have signed?
- Internal access. Who inside your own company can reach the data through the AI tool?
The fourth question gets skipped most often. Microsoft's documentation for its Copilot assistant states that it only surfaces organisational data that a user already has at least view permission for. That is a sensible design, and it also means an over-shared SharePoint folder becomes an over-shared answer. A private model does not fix loose permissions.
The four options compared
| Option | Who processes the data | What you run yourself | Fits when |
|---|---|---|---|
| 1. Business plan with no-training terms | The AI vendor, under its commercial terms | Admin settings, user access, which plans staff may use | Internal documents, email, drafting, analysis of non-regulated data |
| 2. Same model through your cloud account | Your cloud provider, under the agreement you already have | Cloud configuration, region choice, logging | Regulated data where a cloud vendor is already approved |
| 3. Self-hosted open-weight model | You | Hardware or GPU instances, model updates, security, monitoring, quality testing | A contract or regulator rules out any outside processor |
| 4. No model on the sensitive record | Nobody new for that field | The automation and the redaction step | The work is matching, moving and checking, not reading or judging |
Option 1: a business plan with no-training terms
The three vendors most companies already use all exclude business data from model training by default. We checked each one's own pages on 13 October 2026.
- OpenAI states on its enterprise privacy page (updated 8 January 2026) that it does not train its models on business data by default. That covers inputs and outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu and its API platform. Retention controls are listed for Enterprise and Edu, not for Business.
- Anthropic states that by default it does not use inputs or outputs from its commercial products, which include Claude for Work and the API. One exception is worth an admin's attention: when a user rates a response with the thumbs up or down button, the whole conversation is stored for up to five years and may be used for training. Team and Enterprise owners can switch that off in the organisation's data and privacy settings.
- Microsoft states that Copilot prompts, responses and the Microsoft Graph data it reads are not used to train foundation models. EU traffic stays inside its EU Data Boundary, with one stated exception: Anthropic models offered inside Copilot are currently excluded from that boundary.
That last detail shows why "we use Copilot, so we're covered" needs a second look. The same product can carry different terms depending on which model an admin switches on.
The bigger gap is usually staff using a personal account because the business plan has not reached them yet. Anthropic's consumer plans, for example, use chats for model improvement if the user has allowed it in their settings. If you have a business plan, block or discourage personal-plan use for work data and give people the approved tool. Our guide to Claude for business covers how the plans differ.
The operating effort is low. Someone owns the admin console, user access and the settings above. For most internal work, such as drafting, summarising documents and analysing spreadsheets that hold no regulated data, this option is enough.
Option 2: the same model through your own cloud account
Large models are also sold through the big cloud platforms. Running a model this way moves the processor relationship to a cloud vendor your company has usually already reviewed and signed with. For banks, insurers and healthcare providers, that is often the fastest path through procurement.
The tradeoffs are in the detail: which region the requests route to, which model features are missing on the cloud version, and what you have to log yourself. We covered those for Claude in where AI agents can run when the data is sensitive, including who counts as the data processor on each route. Read that before you choose between the vendor's own API and a cloud platform.
The operating effort is moderate. You configure the cloud account, pick regions deliberately and keep logs. You do not run the model.
Option 3: self-hosting an open-weight model
An open-weight model is one whose weights you can download and run on hardware you control. Nothing leaves your network, and no outside company processes the data. It is the only option where that is true, which is why it suits air-gapped environments and contracts that forbid any third-party processor.
Running one is now practical. OpenAI's gpt-oss models are released under the Apache 2.0 licence; its repository says the larger gpt-oss-120b fits on a single 80 GB GPU, and gpt-oss-20b runs within 16 GB of memory. Both can be served with common tools such as Ollama or vLLM. Licences differ between model families, though. Meta's Llama 4 licence, for example, requires companies whose products had more than 700 million monthly active users to request a separate licence. Your legal team should read the licence for the exact model you plan to run.
What you take on:
- Capacity. GPUs bought or rented, sized for your peak load, with a plan for when they fail.
- Updates. New model versions, security patches for the serving software, and re-testing after each change.
- Quality testing. Open-weight models vary in how well they handle your specific tasks. Test on your own examples before committing, and compare against a hosted model on the same examples.
- Everything around the model. Access control, logging, retention and monitoring are now yours to build.
The operating effort is high. You need someone who can run GPU infrastructure in production. We have not priced hardware here because costs depend on load and region; get a quote for your own volume.
Option 4: keep the model away from the sensitive record
Much of what gets called AI automation in regulated work is retrieval, matching, formatting and chasing. Those steps can run inside your own systems with no model involved. When a step does need a model, it can receive a redacted version, or an ID instead of the record itself.
This is often the fastest way to get a first workflow live while the legal review of options 1 to 3 is still running.
Can you run private AI for customer service?
Yes. The pattern that works keeps customer data out of the prompt, so less depends on where the model runs. A private customer service assistant receives the customer's question and an identifier. It looks up order status, account details or policy terms through tools that run inside your own systems, and only the fields needed for the answer go to the model. Card numbers, health details and passwords are removed before the prompt is built. Conversation logs are stored in your own database under your own retention rules.
Built this way, the assistant can run on option 1 or 2 and still keep sensitive data out. Self-hosted AI for customer service is possible too, but the answers are customer-facing, so uptime and answer quality become your problem at the hours customers write in. We would only self-host a customer service model when a contract requires it. Our guide to agentic RAG for customer service covers the retrieval side of this design.
What should an IT consultant deploy for clients?
An IT consultant or managed service provider deploying private AI for clients should set it up in each client's own accounts. The client signs the AI vendor's or cloud provider's terms, holds the admin role, and owns the logs. The consultant gets delegated access.
The setup to avoid is one consultant account that processes several clients' data. It puts the consultant in the processor chain, mixes client data in one place, and makes the client's privacy depend on a contract the client never saw. For each client, write down where data goes, which settings are switched off, who can see the logs, and who reviews them. That document is what the client's auditor will ask for.
When is private AI overkill?
Self-hosting is overkill when the data is already covered by a business plan's terms and nothing in your contracts rules out an outside processor. In that case it adds GPU, patching and testing work without making the data more private than it already is.
Signs you do need more than option 1:
- A client contract or regulator names where data must be processed, or forbids third-party processors.
- The data is health, financial or legal records covered by sector rules.
- Your systems run in an environment with no outside network access.
- The vendor cannot offer the retention or residency terms your contracts require.
If none of these apply, spend the effort where data leaks in practice. That means personal plans used for work, over-shared folders, and the logs, caches and exports your own automations write.
Which option we would pick for which data
This is how we would map it at ATI. Use it as a starting point for your own legal review.
- Public and marketing content: option 1. There is nothing to protect beyond normal account security.
- Internal documents and email: option 1, inside the suite you already use, after a permissions clean-up.
- Customer personal data in support or sales: option 1 or 2, with the lookup-and-redact pattern from the customer service section.
- Regulated records: option 2 or 4, with the processor question settled before the build starts.
- Data under a contract that forbids outside processing: option 3, or option 4 if the task does not need a model to read the record.
Most companies end up with two options running side by side: a business plan for everyday work and either a cloud route or a no-model workflow for the regulated process. If you want help choosing and building it, our AI automation service typically takes 6 to 12 weeks from scoping call to the first workflow live. If cost is part of the decision, our breakdown of Claude API pricing for business shows how usage-based billing compares with seat plans.
Frequently asked questions
Is ChatGPT private enough for business use?
ChatGPT Business, Enterprise and Edu, and OpenAI's API, are excluded from model training by default according to OpenAI's enterprise privacy page. Personal ChatGPT accounts are not covered by those commitments, so staff should use the company workspace for work data.
Does Claude train on business data?
Not by default. Anthropic states that it does not use inputs or outputs from its commercial products, including Claude for Work and the API, to train models. Conversations a user rates with the feedback buttons are the exception, and Team and Enterprise owners can turn that rating feature off.
Is Microsoft Copilot private AI?
Microsoft states that Copilot prompts, responses and the Microsoft Graph data it reads are not used to train foundation models, and that EU traffic stays within its EU Data Boundary. Anthropic models inside Copilot are currently excluded from that boundary, so check which models your admin has enabled.
Do you need your own GPUs to have private AI?
Only if you self-host. Options 1, 2 and 4 in this guide need no hardware of your own.
What is the best AI for a business that cares about privacy?
The one your staff will use on an approved account with training switched off and permissions cleaned up. For most companies that is a business plan from the vendor whose tools they already run. Regulated workflows then get a cloud route or a no-model design on top.
Can a small business afford private AI?
Yes, if private means option 1 or 4. A business plan and an admin who owns the settings cover most small-business data. Self-hosting is the expensive option because of the hardware and the skills needed to run it, and small businesses rarely need it.
Vendor terms for OpenAI, Anthropic and Microsoft, the gpt-oss repository and the Llama 4 licence were checked on each vendor's own pages on 13 October 2026. Terms change, so confirm them against your own contract. The search-result count comes from our SERP check of the same day. This article was drafted with AI assistance and edited and checked by the ATI team.