A staffer at lunch opens a new account that costs almost nothing and pastes in one client file to see what the cheap model can do. The work comes back good, maybe better than good. Nobody announced a switch, and I think that’s exactly how AI model data privacy slips. The question nobody asks is where that file sat while the model worked on it.
For an Alberta firm those files usually fall under the Personal Information Protection Act, which expects you to protect personal information against unauthorized access wherever it goes, including into a tool someone signed up for at lunch.
The pull is easy to understand. A new wave of models has landed this year from overseas labs, alongside open-weight releases, models anyone can take and run for themselves. On everyday firm work they sit close to the front, and they cost a fraction of what the tools on your current bill charge. A staffer who finds one is not being careless. They are being thrifty with the firm’s money, the way you taught them to be.
Why is the cheap model suddenly good enough?
Because the front of the field got crowded. The newest releases from overseas labs and the open-weight models now handle the work most firms hand to AI every day. Drafts, summaries, sorting, first passes at research. On that work they land close to the tools you already pay for, and on some of it you would struggle to tell the outputs apart.
The gap that used to protect the expensive seats has narrowed to a crack. Since the model is the part any firm can rent, I’d spend your care on the layer you own on top of a rented model, and your client data sits in that layer.
Good enough stopped being the hard question this year.
None of this makes the cheap model a trap. It makes it a real option, and a real option deserves a real decision, made by an owner, instead of a lunchtime download made by whoever found it first.
Where does your data sit while it works?
That depends on where the model runs, and the cheap options run in different places. An open-weight model can sit on a machine your firm owns, or on a host your firm picks and pays. Nothing leaves the building unless somebody sends it.
A hosted model is the other shape. Your words travel to the maker’s servers and sit under the maker’s terms, in a place your firm did not choose and may not be able to name.
When a staffer pastes a client file into that second shape, the file goes where the account says it goes. The terms of that account were written by the maker, clicked through by one person, and read by nobody. Your trusted tools carry a version of the same risk, but your firm accepted those terms on purpose, after somebody weighed them. The cheap account got weighed by its price alone.
The price tells you what the model costs. It says nothing about where your clients’ files spend the night.
What line do you write before the switch happens?
One line, written while nothing is urgent. Which classes of client data may never leave the tools your firm already trusts, the same classes that belong on your one-page control list. Financial records. Health details. Legal files. Work under a confidentiality promise. Your firm’s version of that list will differ, and that is fine.
Name the classes, not the tools, because the tools change every season and the classes stay put. That’s the line I’d write first.
To write the line you need the map first. List every model your team can open today, the paid seats, the free accounts, the one built into your documents. Beside each one, mark where it runs. On our machines. On a host we picked. Inside a tool we already pay for. On a maker’s servers, under terms nobody here has read. That last mark is the one that matters, and most firms find more of them than they expected.
I argued the same habit for pricing tools, to write your rules first while you are calm, and for the words your firm sends out, which may already be labelled without anyone in the firm choosing it. Your client data deserves the same treatment, decided in advance, in writing.
A rule written in advance holds. A rule written after the paste is an apology.
Mark each tool on the map with one of these four answers.
| Where the model runs | Who controls the data | Client data allowed? |
|---|---|---|
| A machine your firm owns | Your firm | If your rules allow it |
| A host your firm picked and pays | Your firm, under your contract | If your rules allow it |
| A tool you already pay for and reviewed | Shared, under terms you accepted | Per your control list |
| A maker’s servers, terms unread | The maker | No |
My take: price is the first question to ask about a model, never the last.
How do you map your AI tools this week?
Build the map and write the line. One page, every model the team can open, where each one runs marked beside it. Then the sentence about which classes of client data stay inside the trusted tools, put where the team will see it before the next cheap account gets opened.
You are not banning the cheap models. Some of them will earn a place on the map, on work that carries no client data at all. You are deciding in advance which work they may never touch. Drawing that map is one of the first exercises in an AI Strategy Roadmap.
Draw the one-page model map before the next cheap account opens. I go through exercises like that in the AI Newsletter with ZAK.
Common questions about AI model data privacy
Are cheap or open-weight AI models safe for client data?
It depends on where they run. An open-weight model on a machine your firm owns, or a host you pick, keeps data inside your control. A hosted model sends your words to the maker’s servers under the maker’s terms. The price tells you nothing about which one you’re using.
Which client data should never go into an unapproved AI tool?
Name the classes, not the tools. Most firms start with financial records, health details, legal files and any work under a confidentiality promise. Write the list down while nothing is urgent, and keep those classes inside the tools your firm has already reviewed and approved.
How do I find out where my team’s AI tools run?
Build a one-page map. List every model the team can open, paid seats, free accounts and the AI built into your documents. Beside each, mark where it runs: your machines, a host you picked, a tool you already pay for, or a maker’s servers under terms nobody read.
3 Comments