Private AI for your org: buy, build & govern

2.1 Map AI setups onto a data‑residency spectrum

The data‑residency spectrum lets you place any AI deployment on a line from fully local to fully external, highlighting where the data lives and which governance rules apply.

Position four typical AI configurations on the spectrum to compare their trade‑offs

Enter the prompt in the private‑ai‑governance interface and hit Generate. Verify that each setup appears positioned along a single line from fully local on the left to public cloud on the right.

1. Identify the Laptop‑local configuration and record its characteristics
2. Identify the Self‑hosted GPU configuration and record its characteristics
3. Identify the EU‑managed SaaS configuration and record its characteristics
4. Identify the Public API configuration and record its characteristics

• You'll see Four distinct setups displayed side by side, each showing where the data resides
• Takeaway Convenience rises and control falls as you move from laptop‑local to public API
• Check Which end of the spectrum would you place a free ChatGPT account on and why?

2.2 Map your organization’s AI deployment options onto the data‑residency spectrum

A simple spreadsheet that places each possible AI setup on a scale from fully local to public cloud.

You will produce a visual map showing where laptop‑local, self‑hosted GPU, EU‑managed workspaces and public APIs sit relative to data residency.

1. Open a new spreadsheet and create four columns labeled: “Setup”, “Physical location of data”, “Control over hardware”, “Compliance implications”.
2. Enter the four setups described in the chapter – laptop‑local, self‑hosted GPU, EU‑managed workspace (e.g., Langdock, Mistral Le Chat Enterprise, Aleph Alpha PhariaAI), and public API.
3. For each row fill the columns using information from the material: e.g., “Physical location of data” is “your device”, “your own server”, “EU data centre”, or “provider’s cloud”.
4. Add a fifth column “Risk level (GDPR/EU AI Act)” and mark “low”, “medium”, or “high” based on whether the setup requires a Data Processing Agreement, GDPR audit, or falls under high‑risk AI provisions in the AI Act.

• You'll see A completed table that clearly positions each deployment option along the residency spectrum and highlights its compliance burden.
• Takeaway Visualizing data residency helps you quickly compare technical control with regulatory exposure.

2.3 Run a governance checklist on an AI tool

The governance checklist comprises five key questions that data‑protection offices use to decide whether an AI service can be used under GDPR and the EU AI Act.

Do this first Map AI setups onto a data‑residency spectrum

Apply the five‑point checklist to an AI tool your team already uses

Paste the prompt into the Command Input field on the main dashboard of private‑ai‑governance, then press Enter. Watch for any unanswered items in the generated report—they indicate red flags.

1. Determine who acts as the data controller for the AI service
2. Verify that a signed Data Processing Agreement or AVV is in place
3. Confirm compliance with both GDPR and the EU AI Act requirements
4. Locate the exact physical data storage region of the service
5. Check that access logs can be audited and retention periods are documented

• You'll see A concise list of yes/no answers for each of the five items, ready in under ten minutes
• Takeaway Check controller, DPA, GDPR + EU AI Act compliance, data location and auditability before any tool handles institutional data
• Check Which of the five checklist items is hardest to answer for a free consumer chatbot account and why?
• Cost Running this checklist costs nothing but the ten minutes it takes to read a vendor's security/DPA page — far cheaper than the compliance review after a bad rollout.

2.4 Run the EU AI Act compliance checker on a chosen AI setup

An online questionnaire that returns a quick assessment of obligations under the EU AI Act.

You will obtain a summary of which articles of the AI Act apply to your selected deployment option.

1. Visit the AI Act website (artificialintelligenceact.eu) and locate the “Compliance Checker” link mentioned in the homepage description.
2. Start the checker and answer the ten‑question survey with details from the spreadsheet you built in Lesson 1 (e.g., data location, risk category).
3. Submit the answers and record the resulting list of obligations – note any references to high‑risk system requirements or GPAI provisions.
4. Copy the output into a new sheet tab titled “Compliance results” and annotate which items will need further action (e.g., DPA, impact assessment).

• You'll see A concise report listing relevant AI Act articles (such as Chapter III high‑risk rules or Chapter V GPAI obligations) for the chosen setup.
• Takeaway The checker turns abstract legal text into concrete action items tied to your deployment choice.

2.5 Choose between buying or building a private AI solution

Do this first Map AI setups onto a data‑residency spectrum·Run a governance checklist on an AI tool

Select the deployment approach that satisfies your organisation's compliance checklist

Paste the command into the private-ai-governance console and press Run. Verify that the output shows a completed five‑point checklist for both options, with each item marked as passed.

1. Map the data controller and processor roles for each option
2. Compare the Data Processing Agreements and compliance evidence against internal policies
3. Evaluate deployment location, audit capabilities and total cost for both the hosted service and a self‑hosted stack

• You'll see A chosen option that meets all five checklist items for data residency and governance
• Takeaway Buy reduces setup effort while adding vendor reliance; build gives full control but requires ongoing maintenance
• Check For a small lab with no dedicated IT staff, which path clears the governance checklist faster and what does it give up to get there?

2.6 Complete a GDPR governance checklist for the selected AI tool

A step‑by‑step list of GDPR artefacts required before deploying an AI system that processes personal data.

You will produce a set of documented GDPR controls ready for audit, including a Data Processing Agreement and a rights‑exercise procedure.

1. Open the “GDPR compliance checklist” page on gdpr.eu and copy its bullet list into a new document titled “GDPR Checklist – ”.
2. For each item (e.g., DPA, privacy notice, record of processing activities) indicate whether it is already satisfied by your deployment choice or needs creation.
3. Draft a simple Data Processing Agreement template using the example provided on gdpr.eu and fill in the parties (your organization and the AI provider).
4. Create a one‑page “Right to Erasure” procedure that describes how you will delete personal data from the AI system upon request, referencing the GDPR right to be forgotten.
5. Save all artefacts in a folder named “Governance‑”.

• You'll see A complete folder containing a filled DPA, a privacy notice draft, and a documented erasure workflow ready for internal review.
• Takeaway Systematically ticking GDPR items ensures that data‑privacy obligations are met before any AI model is put into service.

2.7 Choose between buying an EU‑managed SaaS or building a self‑hosted Open WebUI solution

A decision matrix that weighs the governance results, cost, and technical effort of two concrete private‑AI options.

You will produce a short recommendation report stating which option best satisfies your organization’s residency and compliance requirements.

1. Create a new spreadsheet tab called “Buy vs Build”. List the two alternatives: “EU‑managed SaaS (e.g., Langdock)” and “Self‑hosted Open WebUI”.
2. Add rows for criteria derived from previous lessons: data residency, GDPR/DPA need, AI Act high‑risk obligations, hardware control, maintenance effort, and auditability.
3. Populate each cell with the findings you recorded in Lessons 1‑4 (e.g., SaaS scores “EU data centre” and already provides a DPA; self‑hosted scores “your server” but requires you to draft a DPA).
4. Score each criterion on a 1–5 scale, sum the totals, and write a one‑paragraph recommendation explaining why the higher‑scoring option aligns with your governance checklist.
5. Export the sheet as PDF and name it “Private‑AI Decision Report”.

• You'll see A quantified comparison table and a concise report recommending either the EU‑managed SaaS or the self‑hosted solution based on concrete compliance evidence.
• Takeaway Structured decision matrices turn governance checklists into actionable procurement choices.