Cloud vs Local AI

Where should your AI run? For a regulated business the real question isn't which model is smartest — it's where your data goes, who can see it, and what happens if you suddenly lose access. This explainer lays out the full deployment spectrum, from a consumer public cloud through an enterprise API under a data processing agreement, a private VPC, an on-device model, an on-prem server, and finally a fully air-gapped machine — each step trading more control for more operational responsibility. It is written specifically for a regulated firm rather than a general audience: capability and convenience on one side, data control and independence on the other. A side-by-side comparison covers the dimensions that actually decide the question — data location, cost, capability, resilience, control, operations — and a decision list sets out exactly when local wins and when cloud still does. At its centre is a 60-second check: choose one workload, answer three questions about data sensitivity, task type and volume, and the tool recommends a specific deployment tier with the reasoning attached. Like the rest of the page it runs entirely in your browser — nothing you click is sent anywhere.

• The full deployment spectrum — public cloud, enterprise API, private VPC, on-device, on-prem, air-gapped — showing where each one's data actually goes
• A side-by-side cloud-versus-local comparison across the dimensions that matter to a regulated firm
• A 60-second interactive check that recommends a deployment tier for a specific workload, with its reasoning
• The DORA angle made explicit: ICT concentration risk (Art. 29) and exit strategy (Art. 28(8)) as current obligations, not hypotheticals
• The local tiers explained in detail — on-device, on-prem server, air-gapped — with realistic hardware guidance
• Fully browser-based — no account, no upload, nothing transmitted

Most guidance on running AI locally versus in the cloud compares speed and price — the two factors that matter least to a firm handling confidential or regulated data. The questions that actually decide it are where the data is legally located and how exposed the firm is if a single provider raises prices, throttles usage, or removes access. That second question became concrete in 2026, when an export-control order suspended a frontier model worldwide for nineteen days: if it had sat inside a critical process, those were nineteen days of downtime nobody chose. This explainer reframes the decision for a regulated audience and turns it into something actionable. It maps the full spectrum of deployment options, compares them on the dimensions that matter, and offers a 60-second check that recommends a deployment tier for any given workload — while making explicit the DORA concentration-risk and exit-strategy obligations that a cloud-only setup already has to answer for.