Open-Weight Models Explained: Why We Run Them — Not OpenAI — On Your Server
When a Managing Partner hears “we use AI,” the immediate mental model is ChatGPT — a product owned by OpenAI, accessed through the internet, running on someone else’s hardware. Every prompt you submit is transmitted to OpenAI’s servers. OpenAI processes it. OpenAI is a Data Processor. Your firm inherits a forty-page DPA, a global sub-processor chain, and US jurisdictional exposure.
Private AI Ltd does not use OpenAI. We do not use Anthropic. We do not use Google. We run open-weight models directly on your firm’s own contracted bare-metal server. No API call leaves the building. No vendor processes your prompt. No sub-processor chain exists.
This article explains what “open-weight” actually means, why it matters for your firm’s data sovereignty, and what the practical difference is between a model you own and a model you rent.
For an introduction to zero-egress AI architecture, read our companion article.
What “Open-Weight” Means — In Plain Terms
A large language model is, at its core, a very large mathematical file. It contains billions of numerical parameters — “weights” — that encode patterns learned during training. When you submit a prompt, the model reads the weights, performs calculations, and generates a response. The weights are the model.
Proprietary models (GPT-4, Claude, Gemini) are owned by their respective companies. The weights are secret. You cannot download them. You cannot inspect them. You cannot run them on your own hardware. The only way to use them is to send your data to the company’s servers, where the model runs, and receive the response back. Your data leaves your control for the duration of every interaction.
Open-weight models — a category including production-grade model families released publicly under permissive licences — are downloadable. The weights are downloadable. Any organisation with appropriate hardware can run them locally — on its own server, in its own data centre, behind its own firewall. No internet connection required during inference. No data transmitted to the model’s creator. No ongoing relationship with the company that trained the model.
The distinction is not primarily about quality. Modern open-weight models in the 20B–70B parameter range are enterprise-capable for sophisticated document analysis, legal research synthesis, contract review, and drafting assistance. The distinction is about where the model runs and who controls the data that flows through it.
Five Properties That Change Everything for Compliance
1. The Firm Owns the Model Weights
When Private AI Ltd deploys an open-weight language model on your encrypted persistent storage, the model weights are files on your server’s encrypted drive. You own those files. No licence key governs their use. No subscription fee maintains access. No vendor can remotely disable them, throttle them, or revoke them.
If the company that originally released the model ceased to exist tomorrow, your model would continue to function. The weights are static data. They do not phone home. They do not require an internet connection. They are as permanent as any file on your hard drive.
With a proprietary model, your access exists at the vendor’s discretion. OpenAI can change pricing, deprecate models, alter terms of service, or discontinue products. Your firm’s AI capability depends on a third party’s commercial decisions. That is vendor lock-in at the model layer.
2. No API Call Leaves the Server
When a member of staff submits a prompt to the firm’s sovereign AI, the prompt travels from their browser through the firm’s own authenticated access layer to the bare-metal server. The inference layer receives the prompt and runs inference locally — on the server’s own compute. The response is generated on the same machine and returned through the same connection.
At no point does the prompt exit the server’s perimeter. The sealed network architecture ensures that no application on the server can establish an outbound connection to any external AI endpoint. The model cannot call OpenAI. It cannot call Google. It cannot transmit data to any third party — because the environment provides no outbound route.
With a proprietary API model, every prompt is an HTTPS request to the vendor’s inference endpoint. Every response is an HTTPS response from that endpoint. Your client data transits the public internet, passes through the vendor’s infrastructure, and is processed on the vendor’s hardware. The vendor is a Data Processor for every interaction.
3. No Vendor Is a Data Processor at the AI Layer
This is the compliance consequence of the previous two properties. If no API call leaves the server, no third party processes the data. If no third party processes the data, no Data Processor exists at the inference layer. No DPA is required with any AI model vendor. No sub-processor chain extends beyond the firm’s own infrastructure.
The firm’s complete processor map at the AI layer: a UK bare-metal infrastructure provider — directly contracted by the firm. Single processor. Not an AI vendor. No third party in the access path.
4. Client Data Does Not Train the Model
Open-weight models deployed locally are static. The weights are fixed at the time of installation. Client inputs — prompts, documents, queries — are processed during inference and discarded after the response is generated. They do not modify the model weights. They do not enter a training pipeline. They do not contribute to any future version of the model.
This is an architectural guarantee, not a vendor’s contractual promise. The model file on the encrypted drive has a cryptographic hash. That hash does not change between the first prompt and the millionth. The weights are immutable.
With proprietary API models, the vendor’s terms of service govern whether input data is used for training. OpenAI’s consumer terms historically reserved training rights unless users opted out. Enterprise terms are more protective — but the protection is contractual, not architectural. The firm trusts the vendor’s promise. With open-weight models, the firm trusts mathematics.
5. No Vendor Can Revoke Access
The original publishers of an open-weight model cannot remotely disable a model running on your server. The weights are local files under your firm’s exclusive control. No API key expires. No licence server validates your entitlement. No vendor has a kill switch.
This is vendor independence at the model layer — the deepest form of AI sovereignty. The firm does not depend on any AI company’s continued existence, commercial decisions, or geopolitical exposure to maintain its AI capability.
What the Managing Partner Needs to Know
Open-weight does not mean inferior. Modern open-weight models in the enterprise size range perform competitively with proprietary models on legal document analysis, summarisation, and drafting tasks. The firm is not sacrificing capability for compliance. It is acquiring both simultaneously.
Open-weight means the firm’s AI runs on its own hardware, processes data within its own perimeter, creates no third-party processor relationship, contributes no data to model training, and cannot be revoked by any vendor. The compliance posture is structural. The data sovereignty is architectural. The vendor independence is permanent.
That is the difference between a model you own and a model you rent.
Talk to our team to see an open-weight model running in a live environment and evaluate the capability against your organisation’s specific use cases.
Private AI Ltd (SC881079)