Skip to content

Background

Why local AI?

Cloud AI is convenient. For confidential and personal data, it has costs that appear on no invoice.

What happens to your data with cloud AI

When you give a task to a cloud AI service, you send the full text to the provider's servers: the document, the question and everything in them. There it is processed, often logged and, depending on the contract, kept for a while.

  • Transfer. Many large AI providers are based in the United States. Under the US CLOUD Act, US authorities can require such companies to hand over data, even when it is stored in Europe.
  • Retention and training. Whether inputs are kept or used for training is set by contract terms. Those terms can change.
  • More parties. Every service in the chain is another processor you have to vet, bind by contract and explain to your clients, patients or customers.

What it means for professionals bound by secrecy

In Germany, lawyers, doctors, tax advisers and other professionals bound by secrecy may involve service providers only under strict conditions (section 203 of the Criminal Code, for lawyers also section 43e of the Federal Lawyers' Act). Cloud AI adds questions about transfers to third countries under GDPR Articles 44 ff. Information that never leaves the building needs none of these safeguards.

What local AI can do today

Language models with a few billion parameters run on a workstation with a graphics card or on a server in your own building. Specialised models for recognition and classification often need no graphics card at all. For tasks such as finding names in documents, sorting incoming letters or summarising texts, that is enough in many cases.

  • No transfer and no processing agreement for the AI.
  • Fixed costs instead of a price per request.
  • Works without an internet connection.
  • Same model, same result: a new model arrives only when you install it.

Where local AI reaches its limits

The largest language models run only in data centres. Local hardware costs money and needs maintenance. That is why NOCIP has three tiers: where cloud AI is needed, it should see no personal data (Silver) or only pseudonymised data (Bronze).

How to recognise good software

Ask your vendor where each model runs and what data it sees. The ten questions for your software vendor help with that. A NOCIP label answers them for you, technically audited: Gold, Silver and Bronze.

This page gives an overview and is not legal advice.