What are the risks associated with using cloud-based AI assistants?

Cloud AI assistants pose a data protection risk because your inputs are processed on the provider’s servers, potentially exposing your data. Additionally, access rights of US authorities may apply, regardless of the server location, and language models themselves can contain personal data.

What is ‘local AI’ and how does it differ from cloud AI?

Local AI, also known as offline AI, runs on your own hardware or with a German provider, keeping your data under your control. This avoids data transfers to third parties and eliminates concerns about US authorities’ access, offering greater security and privacy.

Why is it recommended to use local AI with company knowledge?

Using local AI with your own documents through semantic search provides more reliable results than general-purpose chatbots. This approach allows the AI to accurately answer questions based on your specific company data, ensuring better accuracy and reducing reliance on external models.

What hardware considerations are important for running local AI?

The necessary hardware depends on the size of the AI model and the number of users. Smaller models can run on standard computers, while models requiring multiple simultaneous users necessitate a server equipped with a powerful graphics card or a provider offering German-based solutions.

Can Microsoft Copilot be used in a GDPR-compliant manner?

Using Microsoft Copilot with sensitive data is complex and cannot be answered with a simple yes. Because data is processed at Microsoft, which is subject to US law, and initial tests have shown weak results, careful evaluation of the specific use case and exploration of alternative solutions are crucial.

Local AI in Business: Data Protection and Practice

AI assistants save time, but anyone who enters contracts, customer data or design drawings into ChatGPT, Copilot or similar cloud services gives up control over that data. The alternative is an AI that runs in your own house or with a provider in Germany. This overview shows when local AI pays off, how it works with company knowledge, which language model fits and what data protection officers should check.

The key points in brief

With cloud AI, your inputs leave the company. With US providers, access rights of US authorities come on top, regardless of where the server is located.
Local AI runs on your own hardware or with a provider of your choice. Data stays under your control, and many questions about data processing agreements and third-country transfers fall away.
Open language models are good enough for many business tasks, and for narrowly defined tasks often even better than large general-purpose models.
The greatest benefit comes when the AI knows your own documents. This works with a semantic search over company knowledge, not with long prompts.
Start with one clearly defined task and measure the result before you expand.

Why cloud AI is a data protection risk

Whatever is entered into an AI chatbot is processed by the provider on its servers. AI and data protection: How much does your assistant know about you? describes the traces this leaves. In addition, language models can themselves contain personal data. How do AI language models store data? and Personal data in AI models explain how to understand this technically. Whether and when training with such data is permitted is covered in AI training and the GDPR: What is allowed?.

Even products advertised as secure do not always live up to their promises. Practical tests show this:

What local AI is and what it can do

Local or offline AI runs without a connection to a third-party service. The data stays in your own network, and the costs do not depend on the number of requests. Offline AI as an opportunity for companies of every size and the frequently asked questions about offline AI offer an introduction. The advantages of company-owned systems over cloud services are shown in The advantages of company-owned AI systems, with a practical example.

Personalized AI explains why an AI that learns from your data achieves more in the long run than a general cloud service. For chatbots on your own website or in customer service, AI chatbots: Opportunities and risks for companies sums up the trade-offs. More basics:

AI with your own documents and company knowledge

Cloud assistants do not really know your company documents, even if you upload them. The reasons are limited context length, cost and the lack of analysis across many documents: Why Claude or ChatGPT does not really know your company documents. A better approach is an AI that opens up your documents through a semantic search and backs its answers with sources.

The step-by-step guide Extending local AI with your own data shows how to build such an AI yourself. Ready-made applications and examples:

Choosing the right language model

For running your own system, open models are an option: you download them and use them without a connection to the vendor. AI: Which language model is the best? explains which size and which model fit which task. What matters for German texts is shown in German texts in AI language models.

Models from China can also be used safely if they run locally instead of through the vendor's app: DeepSeek: The AI revolution from China, also as a secure variant. More model comparisons:

Read full article now via free Dr. GDPR newsletter.

More extras for subscribers:
Offline-AI · Free contingent+ for Website-Checks

Already a subscriber? Click on the link in the newsletter & refresh this page.

↓

Subscribe to Newsletter