Private AI: the honest guide, from the model on your desk to a thousand user farm

The best open weight models have nearly closed the gap with the closed giants. This changes everything for anyone who wants artificial intelligence that thinks inside their own perimeter: healthcare, finance, public administration, manufacturing, anyone with data that cannot leave. But the narrative talks about benchmarks and stays silent on two things: what it really costs, step by step, and what it takes for an in-house model to be sovereignty rather than a private wild west.

This guide tells both sides, with examples for every organization size, from the solo professional to companies with more than 500 people working at the same time.

What happened in the open world, in three names

Three years ago "open model" meant a toy for enthusiasts. As of July 2026 it means this.

Kimi K3 (Moonshot AI, July 2026): 2.8 trillion parameters in a Mixture-of-Experts architecture, a one-million-token context, native vision, weights downloadable by anyone. On the most-cited independent index in the industry it sits about three points from the world's best closed model, and on agentic coding benchmarks it plays on par with the frontier. It is, simply, the best open model ever released.

DeepSeek V4 (April 2026): MIT license with no commercial-use restrictions, 1.6 trillion parameters in the Pro version with 49 active per token, a one-million-token context, and an API price list that rewrote pricing worldwide. It's the equilibrium point between capability and serving cost: the Pro version runs, at full capacity and without compression, on a single server with 8 latest-generation GPUs.

Qwen (Alibaba): not a single model but a family that covers every size, from small models that run on a phone or a workstation up to datacenter-class siblings. It's proof that the open ecosystem isn't an isolated event: it's a whole supply chain.

The consequence is that the right question has changed. It's no longer "how good is the model": at these distances, for most business use cases, the difference isn't noticeable. The question is: where does your data think?

What "private AI" really means

Private AI means the model's weights live on infrastructure you control: your own datacenter, or a private, sovereign cloud managed by a partner within your legal perimeter. There are four practical consequences. Data doesn't cross borders: prompts, documents and conversations never leave the perimeter, and for a hospital, a bank or a public body this isn't a preference, it's an obligation. No dependency: no third-party rate limits, no models deprecated overnight, no terms of use that change under you. Costs that become structure: depreciable hardware and energy instead of an unpredictable pay-as-you-go bill. And the ability to specialize: fine-tuning on your own data, without that data training someone else's model.

Until recently this choice cost you second-tier quality. The numbers in the previous section say that's no longer true: today sovereignty is no longer paid for with intelligence. It's paid for with infrastructure, and here we need to be honest.

The honest cost scale

"Open" makes it sound free, or nearly so. It isn't, and confusion on this point produces stillborn projects. The real scale has four steps plus one.

Step 1: the individual. About €4,000

A DGX Spark on your desk, or an equivalent setup, runs medium models well: open models in the 20-120 billion parameter range, often quantized. For a professional, a developer, a researcher, it's a small personal lab: prototypes, experiments, day-to-day assistance on data that must not leave the office. What it doesn't do: frontier open models at full capacity. Kimi K3 doesn't fit on a desk, in any honest version of that sentence.

Concrete example: an accountant with an archive of client files can run a medium model locally to summarize, search and classify, with the physical certainty that not a single byte leaves the office. For peaks of complex reasoning, public APIs remain available for non-sensitive content.

Step 2: the office. From €15,000 to €60,000

A serious AI workstation, or a small server with 2-4 professional GPUs, brings important models into the company in quantized form, or medium models at full precision, for an office of 5-20 people who work with AI every day. It's the step for a structured professional practice, a software house, a technical office.

The honesty owed: quantization has a quality cost. Aggressive conversions of frontier models report relative accuracies around 80%: fine for many uses, not for others, and you need to know this before, not after, the first error on an important document.

Step 3: the company. Around $400,000

A server with 8 latest-generation GPUs is the first step where an open frontier model runs at full capacity, uncompressed: DeepSeek V4-Pro at native precision, on a single node, with a prudent sizing around 100-150 concurrently working users. Translated into people: an organization of 500-1,500 employees with widespread daily AI use. On top of this: energy (a node like this draws around 14 kW at peak), cooling, and the item everyone underestimates: the skills needed to run it in production.

Step 4: the large enterprise. Millions

Kimi K3 at full capacity, or thousands of concurrent users on V4, live in a multi-node farm: dozens of interconnected GPUs with dedicated networks, disaggregated prefill and decode, specialized orchestration. For 500 concurrent users on K3 you're talking about 7-8 top-tier nodes; for 1,000, about 14-16, with electrical loads above 200 kW and liquid cooling. This is datacenter territory, with investments of $4 to $10 million in hardware alone and a team able to manage distributed inference of mixture-of-experts models. Large organizations that make this choice do so for a precise strategic reason: freeing themselves from any external constraint and treating intelligence as an owned asset, not a supply.

The cross cutting step: rented sovereign capacity

And then there's the truth everyone else needs: below certain volumes, public APIs cost less than iron, and anyone who tells you otherwise is selling something. But between "I buy the APIs" and "I buy the farm" there's the path the cloud already invented thirty years ago: rented capacity, on private, sovereign infrastructure managed by a partner. With a difference in unit of measure we consider decisive: not per token, per person. A token isn't a business unit: no CFO knows how many they'll need, so no CFO signs off. "A hundred people working concurrently on the model, inside the perimeter, with an SLA" is a sentence that fits into a budget. It's the way we learned to buy cloud, applied to intelligence.

The private wild west: why the model alone isn't enough

Here comes the part people talk about less, and it's the reason our work exists. A hugely powerful model at home, without governance, isn't sovereignty: it's a private wild west. The questions that prove it are concrete. Who can query the model, and with what data? Can the agent that answers sales staff see salary data? What identity does an agent act under when working on behalf of a person? Who answers for what agents built on top of the model decide to do at 4am, when they run their autonomous tasks? And when something goes wrong, is there a log of what was changed, by whom, and the ability to roll back?

The model answers none of these questions, because it isn't its job. It's the job of the governance layer, and that's exactly what we built with AIsuru: verified identities on every sensitive power (an authentication token, never a declared email), default-deny permissions (until the owner decides who sees what, no one sees anything), encrypted credentials that never pass through the model, an audit trail for every change with the diff recorded and the ability to undo, and agents that know the environment they live in: they know which capabilities are active, which rules apply, what they're allowed to do. The persistence of autonomous agents, governed, becomes a craft; without governance, it becomes improvisation.

The certifications: what they really mean, one by one

"We're certified" is a sentence you read everywhere and that says nothing. It's worth explaining what certifies what, because for a company that has to choose an AI provider, these acronyms are the difference between a promise and a third-party audit.

ISO/IEC 27001 is the standard for information security management systems: it certifies that the organization has a structured, verified process to identify security risks, treat them, and improve over time. It's not "we have a firewall": it's "an independent body has verified how we manage security, every year."

ISO/IEC 27017 and 27018 are its cloud extensions: the first adds cloud-specific controls (shared responsibilities between provider and customer, environment segregation), the second specifically protects personal data processed in the cloud, with verified commitments on how it's used, where it resides, how it's deleted. For a European customer carrying the GDPR on their shoulders, these are the acronyms that turn "trust us" into "verified."

ISO 9001 is quality management: documented processes, not artisanal non-repeatability. It seems the most obvious one, and it's the one enterprise customers check first with small suppliers, because it measures whether the company survives its own key people.

ISO/IEC 42001 is the newest and the most important for this article: it's the first international standard on artificial intelligence management systems. It certifies that the organization governs the lifecycle of its AI systems with a verifiable process: assessment of AI risks and impacts, defined roles and responsibilities, control of data and models, continuous monitoring, incident management. In a market where everyone declares themselves "AI-first," 42001 is the way to prove with an independent audit that AI isn't just used but governed. It's also the natural bridge to the accountability obligations of the European AI Act: whoever has a 42001 management system already has the structure to demonstrate compliance.

NIS2, finally, isn't a certification but a European cybersecurity directive, with stringent obligations for essential and important entities and, crucially, for their supply chains. If your company falls under NIS2, your digital suppliers become part of your risk: an NIS2-compliant AI provider is one you can add to your supply chain without creating a hole in your own compliance.

Memori's compliance path includes the ISO certifications mentioned, including ISO/IEC 42001, and NIS2 compliance. We don't tell this story as medals: we tell it because it's the documented answer to the questions in the previous section. The wild west isn't closed with promises, it's closed with audits.

The examples, size by size

The solo professional

A consultant, a lawyer, a doctor. The right step: medium models locally for sensitive data, or an AIsuru agent on sovereign cloud with its own knowledge. What they build: the case archive with Persistence, the deadline tracker that prepares the day's list every morning with Scheduler, the summary of incoming documents. An example already in production with this shape: the personal archive with cards and covers uploaded via forms, born in conversation with the Vibe Coder. Order of magnitude of the spend: from a few hundred euros a year in service mode, to the €4,000 of the local lab.

The office: 10-50 people

A structured practice, an SME, an agency. The right step: a tenant on private sovereign cloud, with capacity sized on concurrently working people (typically 10-25 for an office like this). What they build: team calendar coordination with the collective dashboard and a personal view for each person; the hours log with forms and timesheet; ticketing with the public layout for customers. These are, literally, three applications already born in production with the AIsuru Suite, in conversation and without a single line of code. Governance here is simple but not optional: who sees whose hours, who can build, who administers.

The company: 100-250 concurrent people

A manufacturer, a services group, an organization of 500-1,500 employees. The right step: a dedicated node (owned or on private cloud) with an open frontier model at full capacity, plus the governance layer. What they run: real agentified processes. Invoice approval for attachments arriving in a shared mailbox, with text extraction from PDFs and a tracked approval flow. ISO document review that works twice a day on the oldest pending document and publishes the updated catalog: 82 documents under an agent's care, in our real case. Analysis of machinery logs from huge Excel extracts, with numbers calculated rather than estimated. Here the provider's certifications stop being a spec-sheet detail and become the prerequisite: this is the size where procurement asks for 27001 and the DPO asks for 27018, and where 42001 makes the difference between two similar offers.

The large enterprise: 500+ concurrent people

A banking group, a utility, a regional healthcare system, a large industrial group. Here the numbers on the scale speak for themselves: multi-node farms, millions in investment or a sovereign-capacity contract with a datacenter partner, loads of 200 kW and up. But the real difference at this size isn't the hardware: it's the model portfolio and its governance. An organization like this won't have one model: it will have several, for cost, language and use-case reasons, and it will change them over time, because something better comes out every six months. It will have agents that talk to the ERP and to supply-chain systems, identities that travel across chains of agents without bypassing permissions, an audit trail that survives an inspection. This is AIsuru's architectural bet: being the layer that governs whichever model sits underneath, so that swapping the engine never requires rewriting the rules. The model gets replaced; the governance, the knowledge and the agents' applications remain.

How to choose your step: five questions

Before asking for quotes, answer these. Which data must stay within the perimeter, by obligation or by strategy? How many people will use AI concurrently at peak hour (not how many employees you have: how many together)? Do you have the skills in-house to manage distributed inference, or will you buy them with the service? Do your customers or regulators ask for supply-chain certifications (27001, NIS2) that your providers must meet? And finally: does your use case really need the absolute maximum, or would a model one step down, well governed, do the job at a fifth of the cost? The last question is the one no salesperson will ask you, and it's the one worth the most.

Where to start

The fastest way to understand your own step isn't a spec sheet: it's seeing your own processes inside this architecture. Write to us at demo@memori.ai with subject DEMO SUITE: we'll build the demo on your own cases, with your own sovereignty constraints, and out of it comes the honest answer to the question of which step you're on too — including the possibility that, for you, today, the right step is smaller than you thought.

Intelligence can be downloaded. Trust is built. And certified.