GUIDE
Private AI for small firms: when a local LLM is worth it, and when a cloud plan is enough
If you run a law office, a clinic or an accounting firm, you have to work out under which conditions client data may be processed by an AI tool at all. This guide explains three common approaches, what each one costs over three years for a five person office, and how to tell which one fits your constraints. It also says who should not buy a local system.
You run a firm of 5 to 50 people and your team wants to use AI. If your work involves client files under professional secrecy, health records or clients' financial data, the first question is not which tool to buy. It is under which conditions that data may be processed by an AI tool at all, and by whom.
The question is not theoretical. In a survey of 501 Spanish office workers (fieldwork May to June 2026, published 31 August 2026), 82% said they use AI at work, and of those, 82% had used tools their company did not provide, without telling it. Whatever a firm decides, its staff are probably already using something.
There are three common approaches: a business cloud plan with a data processing agreement, an open model hosted on EU servers, or a machine in your own office running the model locally. The last one is what people mean by private AI or a local LLM. We install local systems, and our assessment starts from the other two: a local system is the right answer when a firm's data constraints require it, not before.
What is a local AI system, in plain words?
An AI model is a very large file. The companies behind ChatGPT and Claude run their models on their own servers; you type, your text travels to them, the answer travels back. Some models are published openly and can be downloaded. Put one on a powerful computer in your office, add a chat screen your staff open in a browser, connect it to a folder of your documents, and you have a local AI system.
In local mode the model processing happens in your office. That is the core difference. It is not the same as saying nothing ever leaves: remote maintenance, logs, backups and an optional fallback are outside access and data flows, and a serious contract lists every one of them. The rest of this guide is about what it costs, what it cannot do, and who actually needs it.
Why do some firms have to be careful about sending data out?
For many businesses, using a cloud AI tool under a proper contract is fine. Three kinds of data come with stricter conditions.
Lawyers in Spain are bound by professional secrecy under the Estatuto General de la Abogacía (Royal Decree 135/2021). Client files, strategy notes and correspondence are covered. A lawyer has to be able to explain where a client document was processed and by whom.
Health data is a special category under GDPR. Processing it needs a legal basis under Article 6 and, in addition, one of the conditions of Article 9. Spanish Law 41/2002 adds confidentiality duties for clinical information (articles 7 and 16.6). A clinic that pastes a patient report into an AI tool has processed health data through a third party and needs both of those, a contract with the provider, and a risk assessment; where the processing is likely to be high risk, GDPR Article 35 requires a formal data protection impact assessment.
Accounting and tax firms hold their clients' financial records and identifiers. Depending on the service, the firm may act as a processor for its clients in some activities and as a controller in others, and its clients can ask where their books went.
In all three cases the problem is not AI. It is sending data to someone else without being able to say what happens to it.
Are business cloud plans GDPR friendly?
More than many people assume. ChatGPT Business states that business data is not used for training by default. Claude Team states the same, and its data processing addendum, with standard contractual clauses, is part of the commercial terms. Microsoft 365 Copilot for business in Spain is sold with the EU Data Boundary. None of that makes a firm compliant on its own: contract, purpose, who has access, how long data is kept, security measures and transfer conditions are assessed together, and the result depends on the data, not on the logo.
Where it gets harder: where the data is stored and processed. Plan specific data residency options exist and differ between providers and plan levels, storing data in a region is not the same as processing it there, and providers may keep copies elsewhere for security purposes. Some features of a product can route processing outside the EU. Check the provider's current terms for the plan you would actually buy. Transfers to the United States currently rest on the EU-US Data Privacy Framework or on standard contractual clauses. The General Court dismissed the challenge to the Framework on 3 September 2025 (Latombe, T-553/23); an appeal, C-703/25 P, is pending.
If your clients or your professional rules require processing inside the EU, you have more than two options: an enterprise cloud plan with regional processing, an EU hosted open model, or a local system. And one thing no plan fixes: a contract signed by the firm does nothing about staff using personal accounts. Since 2025 the AI Act asks firms that use AI to take measures to support the AI literacy of their staff (Article 4, as amended by Regulation 2026/1744), so a usage policy and training are part of every option, not an extra.
The middle path: open models hosted in the EU
The same open models that run on a local machine can be rented from European cloud providers and billed by the token, the unit of text AI providers charge by. OVHcloud lists gpt-oss-120b at 0.08 EUR per million input tokens and 0.40 EUR per million output tokens; Scaleway lists it at 0.15 and 0.60 EUR. At the OVHcloud rate, a month of 20 million input tokens and 5 million output tokens costs 3.60 EUR for model use alone; the chat interface, document search and operation are extra, and a usable setup is a project in itself.
For a firm that needs EU processing but has no rule against a processor as such, this is often the sensible answer. It costs a fraction of a local system and scales with use. Two cautions: a European provider does not by itself prove that all data flows stay in the EU, the contract has to say so, and it does not satisfy a firm whose rule is that documents must not leave its own premises.
What does each option cost over three years?
The table below compares five ways to equip a five person office. The figures are list prices in October 2026, converted at the ECB rate of 12 October 2026 (1 EUR = 1.1181 USD), excluding VAT. The local system rows use the price ranges we quote for a small office; other providers will differ.
| OPTION | 3 YEAR COST (EUR, EXCL. VAT) | WHERE MODEL PROCESSING HAPPENS | MODEL QUALITY |
|---|---|---|---|
| A. Five standard business seats (ChatGPT Business or Claude Team, annual billing) | about 3,220 | Provider cloud, under the plan's commercial terms and DPA, no training by default | Frontier models |
| B. Five Claude Max 20x seats | about 32,200 | Provider cloud. Max is a consumer plan: not under the Team commercial DPA; training settings and exceptions differ, check current terms | Frontier models, high usage limits |
| C. Local small office system, setup and hardware supplied by us, no paid care after the first month | 7,200 to 11,500 | Your office; outside access listed in the contract | Open model, small office class |
| D. C plus Care Basic for the remaining 35 months | 20,850 to 25,150 | Your office; remote maintenance under written agreements | Open model, small office class |
| E. Hybrid: D plus five standard business seats | 24,070 to 28,370 | Routine work in your office; hard tasks in the cloud by a person's choice, confidential documents are not sent there automatically | Both |
- ·Assumptions: 36 months, list prices of October 2026, seat prices at annual billing (20 USD per seat per month), Max 20x at 200 USD per seat per month, second hand value of the machine counted as zero. This is not a total cost of ownership: electricity, backups, failures, staff time and API use are not included. Hardware prices and availability are changing, see below.
In this scenario a standard cloud subscription is cheaper: option A is roughly 28 to 45 percent of option C and 13 to 15 percent of option D. The reason to choose a local system is control over where model processing happens and who can reach it. That control has a price, and you should know it before you decide.
A comparison people often make, a local machine against premium seats at 200 USD a month, needs care. Max 20x is built for people who code with AI all day or run agents for hours. A local office system does not replace that work. Whether someone in your firm needs that plan depends on what they do, not on their profession; if they do, keep that seat and run the rest of the office another way. That is the hybrid row.
Is a local model as good as ChatGPT?
No. On the Artificial Analysis Intelligence Index the top model, Claude Opus 5.5, scores 58. Qwen3.8 27B, a model of the class that fits on a small office machine, scores 34 in the setting listed there. Scores differ by model and setting, so 34 is not every small model's number, but the gap is real. The Arena text leaderboard of 8 October 2026 has proprietary models in all of its top 15 places, which says something about general capability and nothing about fit for your tasks.
In practice a local model handles the routine work of an office: summarising a file, finding the clause you need across a folder of contracts, classifying incoming documents, drafting a standard letter, translating. It is weaker at long chains of reasoning, at unusual legal arguments and at writing software. We evaluate the chosen model on your documents before you buy, and its outputs need human review, the same as a cloud model's.
I already pay a lot for AI. Should I buy a machine?
Usually not first. The order that saves money is the opposite of what the hardware market suggests.
First, look at which model does which job. Most providers sell cheaper models that handle classification, extraction, triage and translation well. Routing routine work to them is the largest saving available.
Second, if you need EU processing, move routine volume to an EU hosted open model. At the rates above, model use for tens of millions of tokens a month costs single digit euros; the setup around it is where the cost sits.
Third, and only if your data constraints require that documents are processed on your premises, a local system. At that point the cost is justified by the constraint, not by the bill.
What happens when the machine in the office fails?
This is the question to ask before buying, because the answer decides whether a local system is realistic for a firm with an external IT provider and no technical staff of its own. A local AI system is a computer. It will need updates, it can stop, and a part can fail. Somebody has to own each of those cases, in writing, before the machine is switched on.
| SITUATION | WHO ACTS | HOW |
|---|---|---|
| The AI stops answering or answers badly | Your provider, remotely | Remote access under the written agreements in your contract, within the agreed first response time |
| A part fails | The manufacturer, under the device warranty | Warranty terms are checked per device before purchase and written into the quote; on site repair is never assumed |
| Network, firewall, power | Your IT provider | Agreed before installation; a UPS, a battery that keeps the machine running through a short power cut, is assessed for every installation |
| Your documents | You, through your existing backups | The AI system reads your documents; it is not their backup |
| Staff questions | The process owner in your firm, then your provider | Training and a usage policy at handover |
Two points follow from that table. Roles under GDPR depend on the actual service: where a provider processes personal data on your behalf during maintenance, it needs an Article 28 agreement, and if your firm is itself a processor for its clients, that provider becomes a sub processor, which your client contracts may require you to notify. And a local system does not make your firm GDPR compliant by itself. It changes where model processing happens and who can reach it. It does not replace your legal basis, your security measures, your records, your data subject rights, or an impact assessment where one is required.
Hardware prices and availability are changing
The machines that run these models need a lot of memory, and memory is scarce. TrendForce forecast server DRAM contract prices up 13 to 18 percent quarter on quarter for the third quarter of 2026 and expects shortages into 2027; that is a forecast, not a realised figure. NVIDIA's DGX Spark, a desktop AI machine, launched at 3,999 USD in October 2025 and listed at 6,950 USD a year later. Apple removed the 512 GB memory option from the Mac Studio in March 2026 and raised its memory upgrade prices, and its options have changed again since. Any price you read today, including ours, is fixed only in a written quote.
Do you need local AI or a business cloud plan? Ten questions
Answer yes or no. The questions are about your data and your setup, not about your profession.
- ·1. Do you process data under a legal or contractual confidentiality duty every day: professional secrecy, health data, clients' financial records?
- ·2. Has a client, an auditor or a regulator asked you in writing where your data is processed, or do your client contracts restrict it?
- ·3. Have you signed a data processing agreement with the AI tools your firm uses today?
- ·4. Do your staff already use AI tools you did not provide, with work documents?
- ·5. Would most of your AI use be routine: summarising, searching, classifying, drafting and translating from your own documents?
- ·6. Does anyone in your firm depend on the best available model for complex reasoning or writing software?
- ·7. Do you have a ventilated place with controlled physical access where a machine can run all day?
- ·8. Is there one person in the firm who can own the system: approve users, answer first questions, call the provider?
- ·9. Can you accept slower and somewhat less capable answers in exchange for model processing on your premises?
- ·10. Is your AI usage large enough that cost is a question at all, as opposed to a few seats?
How to read your answers. If you said no to question 3, fix that first; it is the cheapest item in this guide and it is where many firms are actually exposed. If you said yes to 1 or 2, and yes to 5, 7, 8 and 9, a local system is worth assessing. If you said yes to 6, plan a hybrid from the start: the local system will not replace that seat. If you said no to 1 and 2, a business cloud plan with a data processing agreement, or an EU hosted model, is very likely the right answer, and the difference is better spent on training your staff.
What we offer
We install and maintain local AI systems for firms that have an external IT provider but no technical staff of their own, and we start every engagement with a fit assessment that can end in a recommendation to buy nothing from us. The service, what it includes, and what it deliberately leaves out are described on the Private AI service page.
Nobody can promise what an AI model will answer, local or cloud. We can tell you where model processing happens, who can reach it, and what it costs to keep it that way.
Sources
- ·OpenAI, ChatGPT Business pricing: https://openai.com/business/chatgpt-pricing/ (checked 12 October 2026)
- ·Anthropic, Claude pricing: https://claude.com/pricing (checked 12 October 2026)
- ·Anthropic, Data Processing Addendum: https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa (checked 12 October 2026)
- ·Microsoft, Microsoft 365 Copilot for business, Spain: https://www.microsoft.com/es-es/microsoft-365/copilot/business (checked 12 October 2026)
- ·OVHcloud, AI Endpoints catalog: https://www.ovhcloud.com/en/public-cloud/ai-endpoints/catalog/ (checked 12 October 2026)
- ·Scaleway, Model as a Service pricing: https://www.scaleway.com/en/pricing/model-as-a-service/ (checked 12 October 2026)
- ·European Central Bank, euro reference rate USD, 12 October 2026: https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/eurofxref-graph-usd.en.html
- ·Artificial Analysis, Intelligence Index v4.3.2: https://artificialanalysis.ai/leaderboards/models and https://artificialanalysis.ai/models/open-source (checked 12 October 2026)
- ·Arena, text leaderboard: https://arena.ai/leaderboard/chat/text (updated 8 October 2026)
- ·TrendForce, server DRAM contract price forecast 3Q26: https://www.trendforce.com/presscenter/news/20260709-13140.html (9 July 2026)
- ·Implicator, NVIDIA DGX Spark pricing: https://www.implicator.ai/nvidia-adds-64gb-dgx-spark-at-4-999-as-128gb-model-climbs-to-6-950/ (4 October 2026)
- ·MacRumors, Mac Studio 512 GB option removed: https://www.macrumors.com/2026/03/05/mac-studio-no-512gb-ram-upgrade/ (5 March 2026)
- ·Regulation (EU) 2016/679 (GDPR), articles 6, 9, 28, 35, 44 to 49: https://eur-lex.europa.eu/eli/reg/2016/679/oj
- ·Appeal notice, C-703/25 P, against the General Court judgment in Latombe v Commission, T-553/23, of 3 September 2025: https://eur-lex.europa.eu/eli/C/2025/6610/oj/eng
- ·Estatuto General de la Abogacía Española, Real Decreto 135/2021: https://www.boe.es/boe/dias/2021/03/24/pdfs/BOE-A-2021-4568.pdf
- ·Ley 41/2002, de autonomía del paciente, articles 7 and 16.6: https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188
- ·Regulation (EU) 2026/1744 (Digital Omnibus), amendment to AI Act Article 4 on AI literacy: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
- ·Cegid and OpinionWay, La IA en la sombra, Spain, press release 31 August 2026: https://www.cegid.com/ib/wp-content/uploads/sites/3/2026/09/ndp-la-ia-en-la-sombra-el-82-por-ciento-de-los-empleados-en-espana-ya-la-utiliza-y-el-mismo-porcentaj-lo-hace-sin-informar-a-su-empresa.pdf