On-premise AI for a small regulated firm: who runs the machine

At a glance

• On-premise AI means the model, the prompts and the documents all sit on a machine in your own office, so no AI company receives what your staff type or read.
• For a CRO, biotech or medtech firm bound by sponsor or client confidentiality terms, the contract has usually settled where the material may go before anyone compares technology.
• A small firm has three realistic choices: public AI assistants, an enterprise cloud tier under a contract, or a machine in the office that a vendor delivers and runs.
• Joint guidance from the NSA, CISA and allied agencies on deploying AI systems lists hardening, patching, access control, protecting the model weights, logging and backup as the operator’s job. On a managed machine the operator is the vendor, so those duties belong in its contract.
• A model that fits one office machine is good at reading, summarizing and drafting from your documents, and weaker than the largest cloud models at hard open-ended reasoning.

On-premise AI is an AI assistant whose model runs on a machine inside your own building, so the prompts your staff type and the documents it reads never go to an AI company. For a small regulated firm it makes sense when sponsor or client contracts keep confidential material away from third parties. Nobody at a 20-person CRO, medtech consultancy or biotech is going to set up a server, a model and a chat screen, or keep them patched for three years. So in practice the choice is between cloud AI under a contract and a machine that a vendor delivers and runs for you, and the questions that matter are what the vendor does, what it can see and what it costs a year.

What on-premise AI means: the model, the prompts and the documents stay in your building

An AI assistant has three parts that matter for confidentiality. The model is a large file of numbers (the “weights”) that turns a question into an answer. The prompts are whatever a member of staff types or pastes in, including whole documents. Your documents are the files the assistant searches to answer questions about your own work.

With a public chatbot, all three meet on the AI company’s servers. With on-premise AI, all three meet on a machine in your office. The prompt travels across your office network and stops there.

Public chatbot     staff browser -> internet -> AI company's servers (model runs here) -> answer
Business tier      staff browser -> internet -> AI company's servers, under business terms -> answer
On-premise         staff browser -> office network -> machine in your office (model + your files) -> answer

On-premise, private cloud and a vendor’s “private” tenant

The word “private” is used for at least three different set-ups.

On-premise. The machine is in your building, on your network, and the model weights sit on its disk. Who can reach it is agreed between you and whoever runs it.

Private cloud. The model runs on servers rented for one customer in a data center. Nobody else shares the machine, but the material still leaves your building and the hosting company becomes part of the chain. It is mostly bought by large companies with their own infrastructure staff.

A vendor’s business tenant. Products such as ChatGPT Business or Enterprise keep your workspace separate from other customers and come with business terms. OpenAI’s enterprise privacy page (as saved on October 20, 2026) says it does not train its models on business data by default and that deleted conversations are removed from its systems within 30 days, with exceptions such as a legal duty to keep them. That is a real improvement on a consumer account. It is still OpenAI’s servers processing your sponsor’s material.

Why regulated firms end up here: the contract decides first

Most small regulated firms do not start out wanting an AI machine in the office. They start with a problem: staff are pasting a sponsor’s protocol, a draft clinical study report or a deviation write-up into public chatbots, and the firm’s contracts say confidential material may not go to third parties without permission.

Sponsor agreements, quality agreements and master service agreements often carry clauses like these: confidential information stays with the contractor, subcontractors need written approval, and the sponsor may audit where its data went. A clause like that does not mention AI. It does not need to. Pasting a sponsor’s protocol into a chatbot sends it to a third party, and an enterprise agreement with the AI company does not change who that third party is.

So the first question is a reading exercise. Pull out your three or four largest sponsor or client contracts and check what they say about disclosure, subcontractors and data location. If they allow named processors with the client’s consent, a cloud business tier may be enough. If they rule out third parties, the material has to stay in your building, and what is left to decide is who runs the machine it stays on.

Your three realistic choices

Public AI assistants. ChatGPT, Copilot, Claude and the rest on free or personal accounts. Staff sign up with their own email, and your firm has no contract with the AI company. These are what most firms already have, because staff use them when nothing else is offered.

An enterprise cloud tier with a contract. ChatGPT Business or Enterprise, Microsoft Copilot under your Microsoft 365 agreement, and similar plans. You get admin controls, a data processing agreement and a no-training default. The AI company still receives and processes every prompt.

A machine in your office, run by a vendor. The vendor delivers the machine, connects it to your documents and runs it remotely: patches, monitoring, backups and replacement if it fails. You plug in power and network. The material stays in your building, and the operating work sits with the vendor.

A firm with its own IT team can also build one from free software and a server with a professional graphics card. That means choosing a model, wiring it to file shares so it respects who may read what, and patching it every month, which is why firms without IT staff hand the job to a vendor.

	Public AI assistant	Enterprise cloud tier	Machine in your office, run by a vendor
Where prompts are processed	The AI company’s servers	The AI company’s servers, under business terms	A machine in your office
Your contract	None. Each employee accepts consumer terms	Business terms and a data processing agreement	A service contract with the vendor
Who patches and monitors it	The AI company	The AI company	The vendor
Who outside the firm handles the material	The AI company, under its consumer terms	The AI company and its subprocessors	Only what the vendor’s access covers, so ask
IT skill you need in-house	None	Someone to manage accounts and settings	None beyond plugging it in
Shape of the cost	Free or a small monthly fee per person	A fee per person, monthly or yearly	A yearly fee for the machine and the service

Running an AI machine is a monthly security job, and on a managed machine it is the vendor’s

The clearest public list of these duties is “Deploying AI Systems Securely”, joint guidance from the NSA, CISA and allied agencies. Its practices are most applicable to organizations deploying and operating externally developed AI systems on premises or in private cloud environments. It says they do not apply to organizations that use AI systems deployed by others. So a cloud tier leaves this work with the AI company, while a machine in your office brings it into your building, and someone has to own it.

The paper starts with accountability: it says the person responsible and accountable for the AI system’s cybersecurity should be the same person who is responsible for the organization’s cybersecurity in general. In a firm without an IT department nobody fits that description, so the duty has to be written into the vendor’s contract instead.

Two more of its points show why the work is ongoing. For patching, it tells operators to review hardware vendor guidance and notifications for GPUs, CPUs and memory and to apply software patches and updates. A patch released in March has to be applied in March. On logging, the UK NCSC’s guidelines on secure AI development say logs should be treated as sensitive data. On an AI machine the logs hold copies of the protocols and reports staff asked about, so ask the vendor where they are kept and who can read them.

The same guidance suggests considering deployment environment security requirements when developing contracts for AI products or services. For a small firm that is the practical step: you do not do this work, you check that the contract names who does it and how fast.

What an on-premise model can and cannot do compared with the largest cloud models

The models that run on one office machine are open-weight models, meaning published model files anyone may run. They are smaller than the largest models behind the leading cloud chatbots, and the gap shows up in some tasks and not others.

Where an on-premise model does well: summarizing a monitoring report, drafting a first version of a standard document from your templates, answering “where does our SOP say we do X” with a link to the file, comparing two versions of a protocol, rewriting text for a different reader. These tasks depend mostly on the documents the model can see, and a model that can read your files handles them well.

Where cloud models are stronger: long chains of hard reasoning, very broad general knowledge, and any task where you want the single most capable model available this month. If your work needs that and your contracts allow it, the cloud is the better tool.

Be wary of anyone who claims a single office machine matches the best cloud models on everything. It does not. For most document work in a regulated firm it does not have to, and an assistant that can read your own procedures is often more useful than a bigger one that can read nothing of yours. The way to judge is a trial on your own SOPs and reports.

Cost: seats against a yearly fee

Cloud tiers charge per person, so the bill grows with every hire. Take the vendor’s current price per seat and multiply it by the number of people who will use it, for twelve months.

A managed machine is a yearly fee that covers the machine, its set-up and the operating work, with no hardware to buy and no staff hours to add. Everyone in the firm can use it, so the cost per person falls as the firm grows. Compare the two totals, then compare what each includes: the cloud tier gives you the strongest models, and the machine in your office keeps the material in the building.

Questions to settle before you sign

1. What do our sponsor and client contracts allow? If third-party processing is permitted with consent, a business cloud tier may be enough. If it is not, the material has to stay in your building.
2. Who outside the firm can see our prompts and documents, and under what contract?
3. Who applies patches and reads the alerts, how fast, and is that in writing?
4. Where are conversation logs kept, and who can read them?
5. Is the model good enough for our documents? Run a trial on your own SOPs and reports, and judge the answers yourself.

Where IntraMuros fits, and when it does not

IntraMuros is the third choice: the machine sits in your office and Mayet runs it. Mayet is a British company that builds software for pharma, biotech, medical devices, clinical research and other regulated industries. It delivers the machine and connects it to your documents, email and software such as your eQMS, eTMF, CTMS or ERP, whether those sit in your office or in the cloud. After that it patches, monitors and backs the machine up, and replaces it if it fails. Shipping takes a couple of days, you plug it in, and Mayet configures it remotely in a few hours, so it is usually running within a week of signing. That puts a named vendor against question 3.

Staff use the assistant, MURO, from a browser and have no admin access. The model runs on the machine itself, so prompts, documents and answers do not go to an AI company. People sign in with the Microsoft or Google work account they already have, and MURO works with that person’s permissions: a coordinator who cannot open sponsor B’s study folder, or sponsor B’s records in the CTMS, gets no answers drawn from them. Every answer shows the document it came from. What that looks like for study teams is on the clinical operations page.

On question 2: Mayet connects to the machine to update, monitor and back it up, and sees system health, not your prompts, documents or conversations. Mayet is the one outside party that administers it, so it is the name to add to your vendor list and, where a sponsor asks, to your contracts.

The tiers are set by how many people use it at the same time, not by headcount, because everyone in the firm gets access. Standard (£8,900 a year) suits one or two people at once, such as a team of about ten asking now and then. Advanced (£21,900 a year) has five times that capacity, about five to ten people at once, and is the usual fit for a firm of 20 people or more. For 25 people that works out at £876 a person a year, about £73 a month. Enterprise is quoted and adds machines where the work needs them. There is no per-person charge and no set-up fee. Nobody is turned away when it is busy: questions wait their turn, so those numbers are a guide. See how it works and pricing.

It is the wrong choice if you want to run and tinker with the machine yourself, or if you want to train or fine-tune your own models. If your contracts allow a cloud tier and you need the strongest model available, the cloud tier is the simpler choice.

Sources

• Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems — NSA AISC, CISA, FBI and Five Eyes partners, v1.0 (April 2024)
• Guidelines for Secure AI System Development — UK NCSC, CISA and international partners (November 2023)