How we help
Which data may go to someone else's model, and which should stay in the company
The AI Business Center Foundation (AIBC) is a think tank and advisory partner that helps the boards of construction, industrial and technical-services companies adopt artificial intelligence so that it delivers measurable results and builds competitive advantage. We help boards decide which processes and data can use public tools and the cloud, and which require a private AI instance.
Choosing a model is no longer a technical decision. It has become a decision about which data stay in the company
Employees use AI tools every day, often before the company has had time to set any rules. At the same time, contracts, cost estimates, customer documentation and know-how that the company has built up over years are going into assistants. The board’s question is no longer “which model should we pick?” but “which processes and data may go out to someone else’s models, and which may not?”
There is rarely one answer for the whole company. A private AI instance does not replace the cloud; it works alongside it. The choice depends on the data, not on fashion.
3 routes to AI in the company
| route | where the data are | how it is charged | what it is good for |
|---|---|---|---|
| public tools | with the provider, on the terms of its user agreement | subscription or per-seat licence | work on public and non-sensitive content, learning, drafts |
| enterprise cloud | in the provider’s environment, under a corporate contract with agreed processing terms | per-seat licences or charging per use | most office work on internal data, within the limits of the contract |
| private AI instance | in infrastructure controlled by the company | mainly a fixed cost of infrastructure and maintenance | processes on data that should not leave the company: contracts, cost estimates, customer documentation, know-how |
A private AI instance is a language model run in an environment controlled by the company, so that data and outputs do not leave its infrastructure. Companies usually use two or three routes at once, each for different processes.
Data security when working with AI
For us, data security when working with AI means governance rules that determine which data may go into which tool. They cover five elements:
- A list of data that must not be processed outside the approved environment. Written down, known to employees and assigned to categories of documents, not just to a general policy.
- Tools used without the company’s approval. So-called shadow AI: an inventory of what employees already use, and a decision on what to approve, what to replace and what to block.
- Agent permissions. An agent acting on an employee’s behalf receives only the access it needs for the task; sensitive decisions remain with a person.
- Place of processing. For every use, it is known where the data are processed and stored.
- Contracts with providers. Ownership of outputs, confidentiality, use of company data to train models and the terms for exiting the service, including return and deletion of data.
What the Foundation does and does not do
We do:
- classify data and processes by sensitivity, together with their owners,
- set criteria for choosing the route for each group of processes: public tools, enterprise cloud or private instance,
- write requirements for the provider and a brief for the IT department, drafted so that the model can be replaced later,
- define the framework for a private-instance pilot: one or two processes, success criteria, a date for reviewing the results with the board, and the scope of AI Act and GDPR compliance agreed with the company’s legal adviser.
We do not:
- implement infrastructure or models,
- sell hardware, licences or cloud services,
- recommend providers in return for working with the Foundation.
The Foundation is vendor-neutral: we do not sell licences or implementations. We act on the board’s side — we help choose the contractor, prepare requirements and criteria, run the procurement procedure or tender, and assess bids and contractor quality. The board makes the decision. Implementation is carried out by the company’s IT department or by a partner it appoints.
Where a private instance makes sense in the real economy
- Contracts and tender specifications: analysis of clauses, risks and inconsistencies without sending documents outside the company.
- Cost estimates from design documentation: bills of quantities, schedules and comparisons with the company’s previous estimates.
- The bid or no-bid decision in a tender: matching the requirements of the procedure against the company’s experience and capacity.
- Company knowledge assistant: procedures, standards and solutions from previous projects available to the team.
- Technical documentation: descriptions, instructions and declarations based on the company’s product data.
- Site diaries and service requests: organising the history of a building, its equipment and its faults.
We state the potential of each use as a range*, and we compare the cost of a private instance with charging per use on the company’s data, not on market examples.
* Values depend on the process; confirmed in the audit.
How this connects with the method
Whether a model can be replaced depends on whether the process description is tied to a single tool. That is the core of semantic transformation, that is, organising a company’s names, processes and data so that people, language models and board reports understand them the same way. A broader view of the subject is given in the analysis Data sovereignty in AI use.
Frequently asked questions
Is a private AI instance cheaper than the cloud?
That depends on scale. A private instance is mainly a fixed cost of infrastructure and maintenance, while cloud tools are charged per seat or per use. At low volume the cloud usually comes out ahead; with high, steady workloads the calculation may reverse. We work this out in the audit using the company's data, not on this page.
Is a private instance meant to replace the cloud?
No. A private AI instance does not replace the cloud; it works alongside it. Most uses can rely on public tools or the enterprise cloud; a private instance makes sense for processes in which the data should not leave the company.
Will the Foundation name a provider?
We do not name a provider, and we do not recommend providers in return for working with the Foundation. We prepare selection criteria, requirements for the provider and a brief for the IT department. Choosing the provider and implementing the solution are for the company and its IT department, or a partner it appoints.
What about GDPR and the AI Act?
Where data are processed and the company's role in relation to the AI system affect the scope of obligations under GDPR and the AI Act. We map uses, data and roles, and agree the scope and interpretation with the company's legal adviser. A private instance does not remove obligations, but it changes who is responsible for what.
Let’s start with an assessment
The first step is to classify the data in one department and list the AI uses already in place. Let’s talk about the assessment.