Learn about AI · Self-hosted AI
Can you run your own AI without sending data abroad?
Three ways to run AI
| US cloud service | European provider or EU region | Your own server (self-hosted) | |
|---|---|---|---|
| Where data is processed | At the provider, typically in the US or in an EU region of a US company | At a European company in an EU data centre | On your server, in Denmark or the EU |
| Models | The strongest on the market | Open models and a few European providers' own models | Open models of whatever size the server can run |
| Work on your side | Least: an account and an agreement | Some: agreement, choice of model, set-up | Most: server, operations, updates, monitoring |
| Suits | Tasks with no sensitive data, or where the processing agreement and transfer rules are in place | Most tasks with ordinary business data | Patient data, drawings, contracts, anything that must not leave the building |
The middle column is often overlooked. Several European providers run open models in their own data centres and offer the same thing as the US services: you send a question, get an answer, pay per use. The difference is who sits on the server, and under which law. For most companies without especially sensitive data it is a good compromise between effort and control.
What "open model" means, and what it doesn't
An open model is a file. It was trained by a company or a research group and published so others can download and run it. When it runs on your server it does not phone home. It has no connection to whoever made it, and it does not send your questions anywhere. That is the whole point.
"Open" does not mean free. The model costs nothing, but the server does, and so does the person keeping it running. "Open" does not mean small either: the best open models are on a par with the US services of a year or two ago, and for tasks like looking things up in documents, sorting enquiries and drafting replies that is more than enough. What they are worse at is the hardest tasks: long chains of reasoning, complicated code, the newest languages.
An example: a manufacturer with 20 years of drawings
Take a company that builds special-purpose machines and has done so for 20 years. The archive holds drawings, service reports, warranty cases and e-mails from customers. It is the company's real value, and management has one rule: it does not leave the building. At the same time, the service technicians spend half an hour per job finding the right drawing and the latest reports on a machine before they drive out.
The solution is a lookup tool that answers from the archive and runs on a server the company rents in a data centre in Denmark. The model is open and was chosen because it reads Danish and technical English well enough and runs on a single graphics card. The technician types "what was done on machine 2214 last time, and which drawing applies to the hydraulics" and gets the answer with links to the report and the drawing. None of it has left the data centre.
- Choose the model for the task
The model has to read Danish, understand technical language and run on the server you can afford. We test three candidates on 30 real questions from the archive before choosing.
- Rent before you buy
A graphics card in a data centre is rented by the month. That is the right start; a server in your own building only makes sense once usage is known.
- Build the lookup, not just the chat
The value is in the model looking things up in drawings and reports and showing the source. An open model without lookup is just a chat with access to nothing.
- Monitor it like any other system
The server needs updates, the model needs to be replaceable, and someone needs to see when it answers slowly. That is ordinary operations, and it needs an owner.
What GDPR actually requires
GDPR does not forbid using a US AI service. It sets requirements: a data processing agreement, a lawful basis for the processing, and if data is sent outside the EU, a transfer safeguarded under the rules. The rules for transfers to the US have changed several times in recent years, which is a risk in itself for a small company without a lawyer to keep up.
With patient data, personnel files and other especially sensitive information the requirements are stricter, and most companies choose to keep them in the EU or in-house, not because the law always demands it, but because it is the only solution that is easy to explain. Self-hosted AI turns the transfer question into a non-question. That is often the biggest gain.
What self-hosted AI is good for, and what it is not
Good for
- Data that must not leave the building: patient data, drawings, contracts, personnel files
- Lookups in your own documents, sorting, extraction, drafts; tasks where a mid-sized model is enough
- Predictable costs: the server costs the same however much it is used
- Making the transfer rules irrelevant
Not good for
- The hardest tasks, where only the very largest models are good enough
- Companies with nobody to run a server and no wish to pay for it
- Very uneven usage: a server idle 90 % of the time is expensive per answer
- Being a goal in itself; if there is no sensitive data, it is often a waste
Common misunderstandings
| What we hear | How it actually works |
|---|---|
| Self-hosted is always more secure | It is more secure against transfers. A server nobody updates is less secure than a well-run cloud service. Security comes from operations, not from location alone. |
| Open models are too weak for real work | The best open models are on a par with the commercial services of a year ago. For most tasks in a business that is plenty. |
| GDPR forbids cloud AI | No. It sets requirements for agreements and transfers. The requirements are simply easier to meet when data stays in the EU. |
| It needs a server room | It needs a graphics card, and one can be rented in a Danish or European data centre month by month. |
What we would advise against
We would advise against self-hosting because it sounds right, when there is no sensitive data in the task; you would be paying for operations and getting nothing for it. And we would advise against the opposite: sending patient data or personnel files to a general chat service because it is easy. It is the one thing we see most often, and the one thing that is hardest to explain afterwards.
Frequently asked questions
How big a server does it take?
For document lookup at a company with up to a couple of hundred users, one graphics card in a data centre is typically enough. We measure on your task before recommending anything.
Which models can run self-hosted?
Mistral, Qwen, Llama and Gemma among others, in various sizes. The choice depends on language, task and server, and it should be tested on your own questions.
Can we switch models later?
Yes. The model is a file, and the rest of the solution (lookup, rules, sources) stays the same. A switch typically takes a day plus a new test run.
Can we combine: self-hosted for the sensitive, cloud for the rest?
Yes, and it is often the sensible solution. The rule for what may go where is written down once and built into the tool.
Who runs the server?
We can, or your own IT provider. What matters is that someone owns the job: updates, monitoring, backup.
Read next
Want help getting from explanation to practice?
Have a no-obligation chat with us about where it makes sense to start. We reply within 24 hours.