Private AI for business: three meanings, and the one your contracts need
Private AI means three different things. Only one changes the answer when sponsor or client contracts bar public AI: a model in your office, run by a vendor.
At a glance
- “Private AI” is sold as three different things: a promise not to train on your data, a dedicated setup in someone else’s cloud, and a model on a machine in your own office.
- In the first two, a vendor’s server still reads every prompt and the vendor still administers the system. Only the third keeps the prompt inside your own walls.
- If a sponsor or client contract bars public AI tools or disclosure to third parties, the useful test is whose server reads the prompt and who holds admin rights. The privacy policy doesn’t settle it.
- Under the GDPR, a vendor that processes personal data for you is a processor, and Article 28 requires a written contract with set terms, including your approval before it brings in other processors.
- A small firm realistically chooses between a per-seat cloud subscription and a machine in the office that a vendor runs for an annual fee. The middle tier is built for companies with their own infrastructure staff.
For a firm whose sponsor or client contracts bar public AI, only one kind of private AI changes the answer: a model running on a machine in your office, run by a vendor you name. The other two kinds improve the terms but still send every prompt to someone else’s server. That matters for a CRO, a medtech consultancy or a biotech quality team, because those contracts were written with one worry in mind: confidential documents leaving your control.
Why “private AI” means three different things
Each tier answers a different question. Tier 1 answers “will the vendor use my data to improve its models?” Tier 2 answers “will my data share infrastructure with other customers?” Tier 3 answers “does my data leave the building at all?”
| Tier 1: no-training promise | Tier 2: private tenant or private cloud | Tier 3: model on a machine in your office | |
|---|---|---|---|
| Who sees the prompt | The vendor’s servers process it, and named vendor staff can access it in set cases | The hosting provider’s servers process it, inside an environment set aside for you | The machine in your office |
| Who administers it | The vendor | The provider, or an engineer you hire, on the provider’s platform | The vendor you appoint to run it |
| What you sign | The vendor’s terms and data processing addendum | A hosting contract, plus an AI software licence or build contract | A service contract with that vendor |
| Typical cost shape | Per person, per month | Cloud capacity by the hour or month, plus engineering time | An annual fee for the machine and the service |
Tier 1: the no-training promise (your data still goes to the vendor)
This is the business plan of a mainstream AI service. You get the same public product, with different terms. The vendor promises not to train its models on your conversations, gives you an admin console, and signs a data processing addendum.
ChatGPT Business is the clearest example, and OpenAI’s enterprise privacy page (updated January 8, 2026, read October 20, 2026) sets out its terms:
- OpenAI says it does not use business data from ChatGPT Business to train its models by default.
- Workspace admins choose how long conversations are kept. Deleted or unsaved conversations are removed from OpenAI’s systems within 30 days, unless the law or the protection of its services requires longer.
- OpenAI’s access to stored conversations is limited to authorized employees for engineering support, abuse investigations and legal compliance, and to specialized third-party contractors who review for abuse and misuse.
- OpenAI offers a data processing addendum for ChatGPT Business, ChatGPT Enterprise and its API.
Two points matter for a firm under a confidentiality clause. First, every prompt and every pasted protocol is processed on OpenAI’s servers, so the text is disclosed to OpenAI even though it is not used for training. Second, OpenAI’s help center says it does not offer a HIPAA business associate agreement for ChatGPT Business (as of October 2026), so a US firm handling protected health information needs a different plan or a different tool.
Microsoft 365 Copilot, which Microsoft has renamed Microsoft Copilot, follows the same pattern. As of October 2026, Microsoft’s documentation says prompts, responses and data accessed through Microsoft Graph aren’t used to train its foundation models, and that this data is processed and stored under the same contractual commitments as your other Microsoft 365 content. It also says Copilot can offer models from Anthropic and OpenAI as subprocessors, and that Anthropic’s models are currently excluded from the EU Data Boundary. Your documents are still processed in Microsoft’s cloud, and in some configurations by companies Microsoft engages.
Tier 1 is a reasonable choice when your contracts allow approved cloud processors. It just isn’t private in the sense most confidentiality clauses mean.
Tier 2: a private tenant or private cloud (dedicated, but someone else administers it)
Here the model runs in an environment set aside for you: a dedicated server rented from a hosting company, a private cloud account, or an enterprise AI platform installed in a data centre. You may choose the model. No other customer shares the machine.
What doesn’t change is who operates the hardware. The hosting company runs the data centre, has physical and administrative access to the servers, and is a third party processing your data. If you hire an engineer or agency to build and run the setup, they hold admin rights too. Tier 2 takes other customers out of the picture and leaves the provider in it.
Enterprise private AI platforms sit at the large end of this tier. They are built for organizations that already run their own data centres and have the infrastructure staff to operate them, which rarely describes a 20-person firm.
Tier 3: a model on a machine in your office (the prompt stays in your building)
The model sits on a machine in your office, and a vendor delivers, connects and runs it. Prompts, documents and answers are processed on that machine. No AI company receives anything, because there is no AI company in the path.
This is the only tier where the answer to “who else saw this document?” can be limited to your own staff and the one vendor that administers the machine. Someone still has to run it securely. Joint guidance from the NSA, CISA and allied agencies on deploying AI systems securely says its practices are most applicable to organizations deploying externally developed AI systems on premises or in private cloud environments. It also says they do not apply to organizations that use AI systems deployed by others. So with a Tier 1 service that work stays with the AI company, and with a machine in your office it belongs to the vendor that runs it, written into its contract. What the work involves, and what to ask that vendor, is covered in on-premise AI.
Which tier your obligations require
What a confidentiality clause or “no public AI” clause is really ruling out
We can’t read your contract for you, and the wording varies. Most clauses of this kind work in one of two ways. Some forbid disclosing confidential information to any third party without consent. Others name AI directly and forbid entering sponsor or client material into public or third-party AI tools.
Read either kind against the three tiers:
- A Tier 1 service is a third party. A no-training promise changes what the vendor does with your data after it arrives. The vendor has still received it.
- A Tier 2 setup is still run on a third party’s servers, so the same question applies, with fewer parties involved.
- A Tier 3 machine in your office involves no AI company. The vendor that maintains it is still an outside party, so ask what its admin access lets it see, and whether that access is covered by your contract with it.
If your clause allows approved subprocessors with a written agreement, Tier 1 may be enough, and it is the cheapest route. If it forbids disclosure outright, or your sponsor has told you plainly that study documents may not go into cloud AI, only Tier 3 changes the answer. When in doubt, ask the sponsor in writing which of the three tiers they accept. That turns a vague clause into a clear instruction.
Where GDPR’s processor rules come in (EU and UK readers)
Sponsor and client documents often hold personal data: patient details in a safety narrative, names in an audit report, investigator CVs in a feasibility pack. When a vendor’s AI service processes that data for you, the GDPR treats the vendor as your processor. Article 28(3) requires a contract that sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects. Article 28(2) says a processor may not engage another processor without your prior specific or general written authorisation. That is why Microsoft’s list of model subprocessors matters: every AI company in the chain is another processor your agreement has to cover.
A Tier 3 machine in your office takes the AI company out of the processing for that step. It does not take the GDPR away: you remain the controller, and your own security duties still apply.
Six questions to ask any private AI vendor
These questions work for every tier. A vendor who answers them plainly is easier to approve. A vendor who answers with a certification badge has not answered them.
| Question | What it tells you | A straight answer looks like |
|---|---|---|
| Whose server reads the prompt? | Decides whether material is disclosed to a third party at all | ”Ours, in this region” or “Your machine, in your office” |
| Who has admin access, and to what? | Admins can usually read logs, conversations or the documents connected to the system | Named roles, and what each can see |
| What is logged, and for how long? | Logs of prompts and answers are copies of your confidential material | A retention period you can set, and what happens on deletion |
| Which subprocessors handle my data? | Each one is another party your contract and the GDPR must cover | A published list, and notice before it changes |
| Who outside our firm can reach the system, and what can they see? | Remote maintenance is a form of access your sponsor may ask about | A named party and a plain list of what their access covers |
| Who patches it, and how often? | An unpatched AI system is a security hole on your network or in your data | A named party, a schedule, and what happens when a fix is urgent |
The last two questions matter most for Tier 3, where the system is on your own network. The same joint guidance asks deployers to apply software patches and updates to reduce the risk of vulnerabilities being exploited. For a machine in your office, the answer should be the vendor, with the timing in writing. The guidance also suggests considering deployment environment security requirements when developing contracts for AI products or services, so these questions belong in the contract as well as the sales call.
What each tier costs to run
Prices change often, so this section gives the shape of each tier rather than quotes.
- Tier 1 is billed per person, per month, on the vendor’s published price list. It is the cheapest way to start and scales with headcount: every new hire adds a seat.
- Tier 2 is billed for cloud capacity, usually dedicated servers by the hour or month, plus the engineering time to install, connect and maintain the model. The engineering time often costs more than the servers, which is why this tier suits companies with their own engineers.
- Tier 3, for a firm without IT staff, is an annual fee to a vendor that delivers, runs and replaces the machine. Everyone in the firm can use it, so the cost per person falls as the firm grows, where a per-seat bill rises with every hire.
Where IntraMuros fits, and where it doesn’t
IntraMuros is a Tier 3 option for firms without IT staff, with a specific answer to the admin question. Mayet, a British company that builds software for pharma, biotech, medical devices, clinical research and other regulated industries, ships the machine to your office in a couple of days, configures it remotely in a few hours once it is plugged in, and connects it to your documents, email and software (an eQMS, eTMF, CTMS or ERP, in your office or in the cloud). From then on Mayet patches, monitors and backs it up, and replaces it if it fails. It is usually running within a week of signing.
The model runs on the machine, so prompts, documents and answers stay there and no AI company receives them. Your documents and conversations are never used to train any AI model, by Mayet or anyone else, which answers the Tier 1 question as well. Staff sign in to the assistant, MURO, from a browser with their existing Microsoft or Google work account, and it works with each person’s permissions: if someone can’t open the sponsor A folder today, the assistant won’t answer from it for them. Every answer shows the document it came from, so a reviewer can check it against the source.
Your staff have no admin access. Mayet connects to the machine to update, monitor and back it up, and sees system health, not your prompts, documents or conversations. In the table above, Mayet is “the vendor you appoint”: the one outside party that administers the machine, and the name to give a sponsor whose clause is strict.
Pricing is per year and depends on how many people use it at once, since everyone in the firm has access. Standard, £8,900, is for one or two people at a time, which suits a small QA or regulatory team asking now and then. Advanced, £21,900, has five times the capacity (about five to ten people at once) and is the tier a 30-person CRO with several people working through sponsor documents at the same time would need. For 30 people that is £730 a person a year, about £61 a month. Enterprise is quoted, with more machines where the work needs them. There is no per-person charge and no set-up fee, and when the machine is busy, questions wait their turn rather than being refused. See how it works and pricing.
If your contracts allow approved cloud processors and a Tier 1 business plan already satisfies your sponsors, that is cheaper for a small team. IntraMuros is also the wrong choice if you want to run and tinker with the machine yourself, or to train or fine-tune your own models.