First distinction
On-premise versus cloud AI is not the whole decision.
The same activity may need several routes. A contract archive can stay inside the company system; an excerpt without names or confidential terms can be processed by an external model; a decision affecting people or customers can stop in front of a responsible person.
Asking only whether the model is local hides the rest of the processing path: which files are read, what enters prompts, where outputs and logs are stored, which tools can be activated and who may approve the result.
What is the minimum information required for this result, and which part must remain under local control?
Criteria before tools
Purpose, necessity, sensitivity and consequences.
For personal data, the GDPR establishes purpose limitation, data minimisation, storage limitation, integrity, confidentiality and accountability. Data protection should be integrated into design and default settings, before data is connected to a model.
Activity and result
Describe the work and the object the system should prepare. Without that boundary, every field can appear potentially useful.
Purpose and necessity
Connect every item to a specific function. If a field does not change the result, do not include it by habit.
Sensitivity and obligations
Distinguish personal data, contractual information, trade secrets, credentials, intellectual property and public sources.
Access and recipients
Name who can see sources, prompts, outputs and logs, and which providers or subprocessors could receive them.
Effects and responsibility
An internal summary, an update to a business system and a decision about a person require different controls.
Processing architecture
Four possible routes for information.
Data and processing stay inside the controlled system.
This suits context that should not leave or tasks a local function can perform. Device security, access, logs and updates still matter.
The service receives the minimum required.
The provider, purpose, payload, retention and terms have been assessed for that function.
Complete context remains local.
A local function selects, reduces or pseudonymises input; the external service receives only the planned part and the result returns for verification.
The data stays outside the AI workflow.
Uncertainty, sensitivity or consequences require another process, a responsible person or specialist assessment.
These routes can coexist in one project. The goal is to make the relation between information, function and destination readable.
Possible function
What a sensitivity router would do.
A sensitivity router is a local function that receives information and activity context, applies categories and rules, and proposes an allowed route. It can remove identifiers, select excerpts, block a request or require review before an external model is connected.
Automated classification is not an authority. A model can miss a secret, confuse a category or lack knowledge of a contractual restriction. Important decisions need deterministic rules, permissions, tests, outcome records and assigned responsibility.
All-local and local-first hybrid operation belong to the MAIOS architectural direction. This page describes a function to design and test; it does not claim that a verified automatic router is already available.
Practical object
AI Data and Routing Map.
Complete one row for each group of information used by an activity. Missing answers show which decisions must precede integration.
- 01
Activity and result
What work is performed, and what should the system prepare or change?
- 02
Information and source
Which data, documents, messages or applications are needed? Who maintains them?
- 03
Purpose and necessity
Why is each item required? What can be removed without losing the result?
- 04
Classification
Is it public, internal, confidential, personal, contractual, secret or governed by specific conditions?
- 05
People and access
Who may read the source, prepare the prompt, see the output and authorise its use?
- 06
Local processing
Which operations can happen inside the controlled system: search, classification, reduction, pseudonymisation or generation?
- 07
External minimum
Which excerpt may leave, to which service and for what declared function?
- 08
Retention and logs
Where do inputs, outputs and traces remain? For how long, with what access and deletion path?
- 09
Verification and action
Who checks the result, and which effect can occur only after approval?
- 10
Error and recovery
How is the route stopped, a classification corrected and the event reconstructed?
For [activity], we use [information] to produce [result]. [local function] keeps or transforms the context. Only [minimum content] may reach [external service] under [conditions]. [responsible role] verifies before [effect].
Illustrative scenario
Preparing a comparison from contract documents.
A team needs to compare contracts, attachments and internal notes. The local system indexes documents, identifies names, amounts and confidential clauses, and prepares excerpts linked to their sources. An external model receives only approved passages without identifiers that are unnecessary for suggesting a comparison structure.
The draft returns to the company system with source references. A person checks omissions, interpretations and conditions before the content is used. If a document cannot be reduced without losing meaning, it remains in the local route or stays outside AI processing.
This scenario illustrates a possible architecture. It is not a client case or an already available configuration.
Operational security
Controls continue beyond model location.
Devices and storage
Encryption, updates, backups, accounts and separated environments protect local data and models.
Permissions and tools
Reading a file, querying a database, writing to a business system and sending a message are distinct effects.
Prompts, outputs and logs
Governance also covers temporary copies, history, caches, telemetry and observability systems.
Provider and terms
Model, API, region, retention, content use and subprocessors need assessment on the service actually selected.
Quality and attacks
Malicious documents, hidden instructions, incorrect extraction and invented results require filters and verification.
Responsibility and incidents
The organisation needs to know who decides, who can stop the process and how an exposure is reported, reconstructed and corrected.
This map supports architecture work. Legal basis, sector obligations and appropriate safeguards depend on the case and require assessment by the relevant functions in the organisation.
Relation to MAIOS
A hybrid system can preserve context without sending all of it.
MAIOS is pursuing two composable forms: all-local when context, model, tools and work can remain on the user’s system; local-first hybrid when an external function adds capability without automatically receiving complete context or system authority.
The value of a local model is not limited to replacing an external service. It can maintain project continuity, prepare minimum context, apply rules and verify what returns. The external model remains a selected capability for a bounded function.
Public sources
References for further study.
- Regulation (EU) 2016/679: processing principles, data protection by design and security of processing.
- EDPB Opinion 28/2024: personal data, anonymity and the use of AI models.
- NIST AI Risk Management Framework 1.0: governing, mapping, measuring and managing risk in context.
- NIST Generative AI Profile: a cross-sectoral profile for risks specific to generative AI.
Frequently asked questions
Company data, local models and hybrid systems.
Should company data use on-premise or cloud AI?
It depends on the activity, the data required, the constraints and the capabilities needed. One project can keep confidential context on premise, use a cloud service for a bounded function and stop other data for human review.
Does a local AI model automatically keep data secure?
No. It can reduce some exposures, but device access, permissions, storage, logs, connected tools, updates and resulting actions still need governance.
What does a hybrid AI system mean?
It distributes work between local components and external services. Complete context may stay local while only the minimum content required for a declared function is sent outside.
Can a local model classify sensitive data?
It can assist classification, but it can be wrong. Important categories need rules, permissions, tests and human review proportionate to the consequences.
Does pseudonymisation make personal data anonymous?
No. If information can be linked back to a person using additional data, it remains pseudonymised personal data and still requires the relevant safeguards.
Where should a company start defining data routes?
Start with one activity. Name the result, the information required, who may access it, which transformations can happen locally and what minimum content may leave the controlled system.