What do companies use for AI when the data is sensitive, local models or cloud?

Enterprise cloud services are one option, especially when the data is already in the same provider's environment. The key distinction is an approved enterprise setup, not just letting people paste confidential material into any AI tool.

Check the agreement and service settings for data handling and training terms. A security review, a list of approved tools, and monitoring for unauthorized use can be part of the policy too.

Local makes sense when keeping the data off external services is the priority. You can run a self-hosted model without internet access, but that doesn't make the infrastructure free.

GPU capacity is only part of the bill. Memory, storage, deployment, maintenance, and enough capacity for simultaneous requests all matter. A small model might handle a narrow task such as invoice processing, while a larger model serving several users can be much harder to run well.

It doesn't have to be one or the other. A company could use a cloud model for demanding work and a smaller local model for bulk jobs that don't need the same capabilities.

Another option is to remove sensitive fields before sending a request out, then put them back afterward. That depends on being able to identify the sensitive information reliably, though, so it needs careful testing.

Capability is a real part of the tradeoff. Some tasks may need a stronger hosted model, and getting a local model close enough can take significant hardware and tuning work. On the other hand, not every job needs the most capable model available. The task and the implementation matter more than a blanket rule about local models.

There's also the option of not using AI for a particular sensitive workflow. If the data handling terms or the risks aren't acceptable, keeping that information out of the model entirely is a valid decision.