Bare-Metal vs. Cloud AI for Regulated Firms: The Architecture Decision That Defines Your Compliance Posture
There are two ways to deploy AI for a regulated Scottish professional services firm. The first places your client data on a shared, virtualised server operated by a US-headquartered technology corporation, mediated by a hypervisor you do not control, processed alongside workloads from other tenants you cannot identify, and governed by a Data Processing Addendum that runs to forty pages of contractual prose. The second places your client data on a dedicated physical server contracted in your firm’s name, located in a UK data centre operated by a UK-registered company, running an open-weight model you own outright, behind an environment sealed so no outbound path exists for data to take, with no third-party AI vendor in the processing chain.
Both approaches deliver generative AI capability. Only one delivers a compliance posture that does not depend on a vendor’s contractual promise.
This article compares the two architectures across five dimensions that determine whether your firm’s AI deployment survives regulatory scrutiny: data residency, processor liability, egress control, supply chain integrity, and audit readiness. Cloud AI fails at least three. Bare-metal sovereign AI satisfies all five simultaneously.
Dimension 1: Data Residency and Sovereignty
Cloud AI vendors advertise “UK data residency.” This means data is stored at rest in a UK data centre. It does not mean data is processed exclusively in the UK. It does not mean the vendor is a UK entity. It does not mean US extraterritorial legislation cannot reach the data.
Microsoft’s Azure OpenAI Service offers regional deployment options. For deployment types labelled “Global,” prompts and completions may be processed in any Azure OpenAI region globally. For “DataZone” deployments, processing is confined to a defined geographic zone — but that zone may span multiple countries. Microsoft is a US-headquartered corporation. The US CLOUD Act can compel disclosure of data held by US entities regardless of where that data is physically stored.
Bare-metal sovereign AI inverts every variable. The infrastructure provider is a UK-registered company. Its bare-metal nodes are located exclusively within United Kingdom data centres. No US corporate parent exists. No US jurisdictional exposure applies at the compute layer. The firm’s data resides on UK soil, processed by a UK entity under a domestic Article 28 UK GDPR DPA that requires no international transfer mechanism. UK GDPR Article 44 is not engaged.
Data residency tells you where the bytes sit. Data sovereignty tells you who controls them and which legal system governs access. For a Scottish law firm processing client-privileged files, only sovereignty matters.
Dimension 2: Processor Liability
Every cloud AI vendor is a Data Processor under UK GDPR Article 4(8). Microsoft, Google, OpenAI — the moment your client data hits their inference endpoint, they are processing personal data on your behalf. Article 28 obligations attach: mandatory DPA, sub-processor disclosure and approval, international transfer compliance, audit rights.
Since January 2026, Microsoft 365 Copilot’s sub-processor chain includes Anthropic — enabled by default for non-EU/UK tenants, available by opt-in for UK tenants. Anthropic models are excluded from the EU Data Boundary and in-country processing commitments. Every new sub-processor is another entity your Compliance Officer must assess, another jurisdiction to verify, another link in a chain where any failure creates liability for the firm as Data Controller.
Bare-metal sovereign AI under Private AI Ltd’s Zero-Touch Provisioning model eliminates the AI-layer processor entirely. After deployment, Private AI Ltd holds no credentials, no access, and no processor role. The firm’s only Data Processor is the infrastructure provider — a UK entity, contracted directly by the firm under a domestic Article 28 DPA. Single processor. No third party in the access path. No sub-processor chains at the AI layer. No international transfer mechanism required.
The compliance burden is not reduced. It is categorically eliminated at the point where it compounds fastest — the AI vendor relationship.
Dimension 3: Egress Control
Cloud AI is architecturally incapable of zero-egress. The entire model depends on data transiting from the firm’s perimeter to the vendor’s infrastructure. The prompt leaves. The response returns. The vendor processes data in between. That is the service.
The vendor’s security controls — encryption in transit, tenant isolation, access controls — mitigate the risk of the data being intercepted or misused during transit. They do not eliminate the fact that the data left the firm’s control. Mitigation and elimination are different words for a reason.
Bare-metal sovereign AI enforces egress control at the network layer. The environment is built with no outbound connectivity by default — sealed so there is no path for data to reach any external service.
No application on the server can reach api.openai.com. Package installers do not function outside a supervised maintenance window. DNS resolution occurs exclusively over an encrypted channel. The server cannot transmit data to any external AI vendor because the environment provides no outbound route.
This is not a configuration toggle in a vendor’s admin console. It is an architectural property of the environment — enforced at the network layer on dedicated hardware the firm controls.
Dimension 4: Supply Chain Integrity
Cloud AI vendors manage their own software supply chains. The firm has no visibility into which dependencies are deployed, which versions are running, or whether a transitive dependency has been substituted. The vendor publishes security certifications (SOC 2, ISO 27001) that attest to their general practices. The firm trusts those attestations as a proxy for visibility it does not have.
Bare-metal sovereign AI with Private AI Ltd’s upgrade model delivers cryptographically verified supply chain integrity. Every application upgrade is executed via a deterministic 10-step script:
- Application dependencies are installed from a fully hashed dependency manifest — every primary and transitive dependency locked by cryptographic hash. The package installer refuses to install any package whose hash deviates from the manifest, eliminating dependency substitution attacks.
- Inference layer and other packages are verified against strict, pre-seeded checksums embedded directly in the upgrade script. No dynamically downloaded GPG keys. No external verification endpoints. If the hash does not match, the script rejects the package and aborts.
- Pre-migration snapshots of the encrypted persistent storage are taken after a confirmed clean process termination, using native database-integrity primitives.
- Forward cryptographic verification — successful completion of the hash-checked install plus a dependency-tree integrity check inherently guarantees a verified environment. No backward reporting from the client is required.
The firm’s IT lead executes the script during an Over-the-Shoulder session. Private AI Ltd supplies the manifest, the checksums, and the guidance. The client’s infrastructure is cryptographically verified at the point of upgrade — not by trusting a vendor’s attestation, but by mathematical proof.
Dimension 5: Audit Readiness
The DUAA 2025 gives the ICO power to compel production of DPIAs, require independent technical reports at the firm’s expense, and demand witness interviews under statutory notice. An audit-ready firm produces technical artefacts, not policy documents.
Cloud AI audit readiness depends on the vendor’s cooperation. The firm can produce its DPA and the vendor’s SOC 2 report. But it cannot produce the vendor’s firewall configuration, the vendor’s access logs for the firm’s specific data, or the vendor’s dependency manifest. The firm’s audit evidence is contractual — it demonstrates that the vendor promised to implement controls, not that the controls existed at the time of the incident.
Bare-metal sovereign AI audit readiness is self-contained. The firm produces:
- Host firewall configuration — independently verifiable by an ICO-appointed expert in 30 seconds
- SSO access logs — identity-correlated, two-factor-verified, timestamped session records for every access event
- Application role-based access audit records — user accounts, role assignments, access scope, configuration change history
- Hashed dependency manifest and checksum records — cryptographic proof of the software supply chain at the most recent upgrade
- Encrypted JIT session recordings — encrypted at rest, tamper-evident, available on request
Every artefact is produced by infrastructure the firm controls, stored on infrastructure the firm owns, and producible without any vendor’s permission or cooperation. The audit narrative is self-contained: the firm can demonstrate what controls were in place, when they were verified, who accessed the system, and what software was running — from its own records, on its own hardware.
The Five-Dimensional Scorecard
| Dimension | Cloud AI | Bare-Metal Sovereign AI |
|---|---|---|
| Data Residency / Sovereignty | UK storage; global processing possible. US corporate parent. CLOUD Act exposure. | UK storage and processing. UK infrastructure provider. No US jurisdictional exposure at the compute layer. |
| Processor Liability | Vendor is processor. Sub-processor chains (incl. Anthropic). Ongoing DPA governance. | No AI-layer processor. Single direct processor (UK entity). No third party in the access path. |
| Egress Control | Data transits to vendor cloud. Mitigated by vendor controls. | Sealed at the network layer. Data never leaves. No outbound path exists. |
| Supply Chain Integrity | Vendor-managed. SOC 2 attestation. No client visibility. | Cryptographically verified binaries. Hashed dependency manifests. Client-observable. |
| Audit Readiness | Contractual evidence (DPA, SOC 2). Vendor cooperation required. | Self-contained technical artefacts. No vendor dependency. |
Cloud AI satisfies Dimension 1 partially (residency but not sovereignty) and Dimension 5 partially (contractual evidence only). It fails Dimensions 2, 3, and 4.
Bare-metal sovereign AI satisfies all five. Simultaneously. By architecture.
What to Do Next
Step 1: Read our analysis of why UK data residency alone does not equal data sovereignty to understand the critical distinction most vendors obscure.
Step 2: Read our supply chain integrity deep-dive, SHA256 or Nothing: How We Verify Every Binary Before It Touches Your AI Server, to see the cryptographic controls in detail.
Step 3: Talk to our team. We will walk your team through the five-dimensional comparison using your organisation’s specific regulatory exposure to demonstrate why the architecture decision defines the compliance posture.
Private AI Ltd (SC881079) acts as a Standing Data Processor under Article 4(8) UK GDPR, operating a Zero Standing Privileges architecture. We deploy sovereign, zero-egress AI environments for regulated professional services. In the Default Operating State, we hold no active connection and no credentials to client systems.