the ai that never leaves the building

if you work somewhere with patient data, trial data, financial records, or anything covered by an agreement you did not write, you have probably lived a version of this. a pilot works on a safe example. then somebody tries chatgpt or claude on a real draft, and the project stalls in a review when a person asks where those words went and nobody can answer in a sentence.

almost all of the ai people reach for first works the same way. you type something, it travels to a company's servers, a model there produces an answer, and the answer travels back. that is a cloud model: a service you rent, and your words are what you send it. chatgpt, claude, gemini. same shape.

a local model is the other shape. it runs on hardware you control. a laptop, a phone, a server in your own building. the words never leave. there is no third party in the middle, because there is no middle.

local models are usually sold on cost, which is the smaller reason a regulated company wants one. the bigger reason is that for a certain class of work, "where does the data go" stops being a hard question.

for most of the last 3 years that was a hobbyist answer. the models small enough to run that way were not good enough to bother with. in june 2026 apple published a family of foundation models built to run on the phone, and on sealed servers apple calls private cloud compute for the heavier jobs, and tied a new siri to them¹. a company does not put weak models in that position.

why legal keeps saying no

the capability was never the blocker. legal was, and legal was right to be.

the usual answer is contractual. the vendor promises not to train on your inputs, to delete them on a schedule, to keep them in a named region. companies accept that every day, and it is a promise you cannot inspect: a policy, an audit report, and a remedy that only helps after the damage.

it is worth knowing what that audit report is, because it is what a vendor will hand you. a soc 2 is a report from an outside examiner saying a company's security process works the way the company said it does. that is real. it is independent. it is still a statement about a process, not about a system you can look at yourself.

a local model changes what you are trusting. the data did not go anywhere, so there is no transfer to govern, no region to name, and no retention schedule to take on faith. for a certain class of work, that turns the longest question in the review into a short one.

when the work is too big for the device

a phone cannot do everything. the promise in the title runs out right about here, because the heavy work does leave the building. what you can check about where it lands is what has moved.

apple built that tier to be checked rather than believed. it publishes the actual software running on those servers so outside researchers can take it apart, and keeps a public record of which versions are live. a researcher can compare what they inspected against that record and confirm the servers are running the same thing, rather than a modified copy².

the servers keep your data only until the answer is returned, and keep none of it afterwards. there is no general-purpose logging on those machines at all². compare that with the usual contract. a retention promise asks you to trust that someone will delete later. here the claim is stronger: after the answer comes back, nothing remains to delete, and the machines are built so a setting change cannot keep a copy.

one limit, because this piece would be hypocritical without it. all of that is machinery for being checked. we went looking for the result and did not find a published report from an independent researcher who took those images apart and said what they found. an auditor has examined the controls, and apple publishes those reports quarterly³. that is better than a policy page. it is not proof.

what local does not fix

so much for the case in favour. now the part that turns it into a bad project if nobody says it.

running a model locally removes 1 risk: the transfer to a third party. it leaves the others where they were. who can reach the machine. what gets written to a log and how long it stays. and whether a person can reconstruct, 2 years later, how a decision was reached. in practice that means an inspector sitting across from someone in your company, asking why the system said what it said about a particular patient on a particular tuesday. and that person being able to answer. a laptop under a desk does not help with that.

it also does not answer consent. processing on the device answers the question your legal team asked. it leaves open the question the other person in the room would ask if they knew to.

apple is about to put that gap in front of everyone who wears a watch. later in 2026, apple watch series 12 and ultra 4 get audio intelligence features. one of them, siri recap, is what apple describes as taking notes ambiently on conversations you opt into, then turning those notes into short summaries you can review later⁴. the privacy setup for deletion is specific, and public: the raw audio is handled inside a sealed part of the chip and deleted right after processing; summaries auto-delete after 7 days unless you save them; and when a heavier step needs private cloud compute, that server keeps nothing after it returns the answer²⁴. you can look those claims up in apple's own support page. none of that settles whether a physician, or anyone else in the room, agreed to be summarized. where the audio is processed and whether people consented are different questions⁵.

and there is a procurement question people trip on. many of the strongest small models are published free for anyone to download and run, and a number of them come from chinese labs. greg isenberg, who makes a show about building software businesses, separates 2 things people run together. downloading such a model and running it on your own hardware is a different act from sending your data to a service hosted in another country⁶. your security team may still have a view on the first. ask them before you build on it.

the workflow to start with

start with the piece of work rather than the model. isenberg's filter is a good short one: look for a workflow with sensitive data, repeated review, expensive mistakes, and work that happens close to the device⁶.

in a life-sciences company that fits a lot of unglamorous things. the notes somebody writes after a site visit. the first read of a document before it goes to a reviewer who costs real money. the repeated check that a form is complete before it enters a system where an error becomes a correction.

most answers end up hybrid rather than pure. local for the private, repetitive, high-volume passes, and the cloud for deep reasoning and long context, with a person approving anything that matters⁶. a local first pass, escalation when the job earns it. which is the same shape apple built, arrived at from your side of the table.

so pick 1 workflow where the reason you have not started is legal rather than technical. people can usually name it in a few seconds, because it has been sitting there. take it to whoever owns data governance where you work. that conversation goes better when you arrive with 1 named workflow instead of a general question about ai. and ask your vendors the question this whole piece turns on. when our data goes to you, what can we check for ourselves, and what are we taking on trust?

for years the thing standing between a regulated company and useful ai was capability. a good part of it is now a question of how the system is built, and that is something you can change.