Your hardware,
your building.
Full control of the physical and network boundary. The strongest statement available about where data sits, and the largest operational commitment.
Private inference.
Explicit boundaries.
Private AI is the practice of running capable models inside infrastructure you control. Deployment is part of the research problem, not an afterthought to it.
READ THE DEFINITION ↓LOCAL · BOUNDED · CONTROLLED
01 / DEFINITION
The short answer first.What is private AI?
Private AI is the deployment of AI models so that prompts, documents and outputs stay inside infrastructure the organisation controls. It covers on-premise hardware, private cloud tenancy and air-gapped environments, and it is chosen when the data cannot be transmitted to a third party.
Privacy here is a property of where computation happens, not a feature of a product. A model running on a server in your data centre, reading documents from your storage, writing results to your systems, with no outbound network path, has a data boundary that can be described in one sentence. That sentence is often the whole reason the deployment is possible.
Open-weight models have made this a practical choice rather than a compromise. A well-chosen 8B-class model, fine-tuned for a specific task, can outperform a much larger general model on that task — which is what Privilege AI's own supervision work demonstrates, with MKC2 running entirely offline.
02 / WHAT CHANGES
The honest trade.| Dimension | Hosted inference | Private inference |
|---|---|---|
| Data boundary | Prompts and documents reach a third party | Material stays inside infrastructure you operate |
| Model version | Can change without notice | Changes when you decide; reproducible indefinitely |
| Frontier capability | Access to the largest models | Limited to what you can host, which narrows the gap each year |
| Cost shape | Per token; scales with usage | Capital and operations; scales with capacity |
| Latency | Network round trip, variable under load | Local, predictable, no shared queue |
| Operational burden | Carried by the provider | Yours: hardware, patching, capacity, on-call |
The operational row is the one most often underweighted. Private AI is infrastructure, and it brings the ordinary obligations of infrastructure: capacity planning, driver and firmware compatibility, monitoring, upgrades and someone available when a GPU fails at an inconvenient time. Organisations that already run their own systems absorb this easily; those that do not should count it honestly before committing.
03 / THREE DEPLOYMENT SHAPES
Choosing the boundary that matches the requirement.Your hardware,
Your cloud,
your account.
Models running on dedicated infrastructure in your own cloud environment. Removes third-party model providers while keeping cloud operations.
No outbound
path at all.
No network route out of the environment. The only architecture in which exfiltration is structurally impossible rather than controlled.
The third shape is worth considering even where it seems excessive, because it converts a set of controls into a property. An environment with no outbound route cannot leak through a generated URL, a misconfigured tool or a compromised dependency — the class of failure described in AI agent access control simply does not apply. The cost is that updates, monitoring and support all become deliberate, scheduled activities.
04 / WHAT PRIVATE AI DOES NOT SOLVE
Where private deployment is not the answer.Access control inside the boundary.
A private system with an unpermissioned index still lets anyone read everything. Private and access-controlled are different properties.
Agent risk.
Injection, excessive scope and unintended actions are architectural and unaffected by where the weights run.
Frontier-scale reasoning.
Some tasks genuinely need the largest available models. Where the data permits it, hosted inference is the right choice for those.
Privilege AI's position is that deployment is part of the research problem: data access, model authority and operational constraints shape how AI behaves outside a benchmark. Private inference answers the first of those and leaves the others to be designed — which is why the private systems work runs alongside the evaluation and supervision work rather than separately from it. See AI access control and AI model supervision.
05 / QUESTIONS
Asked when deciding where inference should run.Is private AI less capable than hosted AI?
+
For general open-ended reasoning, the largest hosted models still lead. For a specific, well-defined task, a smaller model fine-tuned on that task frequently wins — MKC2 is an 8B-class fine-tune that substantially outperforms its own stock base on legal supervision. Capability should be measured on your task, not assumed from model size.
What hardware does private AI need?
+
It depends entirely on model size, context length and concurrency. Models in the 7B to 13B range with moderate concurrency run on a single modern GPU; larger models or higher throughput need more. The sizing method is set out in private AI infrastructure.
Is private AI more expensive?
+
The shape differs: capital and operations rather than per-token. At low volume hosted inference is usually cheaper; at sustained high volume local inference often wins, because the hardware is already paid for. Where the data cannot leave, the comparison is against not doing the work at all.
Can private AI be air-gapped?
+
Yes, and it is the strongest version of the boundary. Model weights and updates arrive through a controlled process, and there is no outbound route for anything to leave. MKC2 runs entirely offline for this reason.
Who needs private AI?
+
Organisations whose material is confidential by default or subject to professional obligations — legal practices being the clearest case — and any organisation that needs a model version to remain reproducible for years. See private legal AI.
Draw the boundary
on purpose.
Privilege AI works on local inference, application integration and on-premise infrastructure, with security boundaries considered throughout the system.