"Should we do private AI deployment?" The most common question we've fielded since 2025.

Short answer: not every enterprise needs it. Private AI deployment is not a trend — it's a compliance move. Fit isn't decided by company size or the owner's technical interest. It's decided by the intersection of five things: compliance requirements, IT maturity, scenario readiness, budget scale, team capability.

This piece is a practical checklist — 5 types of enterprises that fit, 4 types that don't, and 6 pre-launch checks.

1. Five kinds of enterprises that fit private deployment

Type 1: Central SOEs, state-owned enterprises, government-adjacent units

The clearest case. Compliance requirements leave no choice — SaaS AI physically fails against MLPS, domestic-stack mandates, classified data rules, and cross-border data restrictions.

Typical scenarios:

  • Energy central SOE: large volumes of classified documents, scheduling systems disconnected from the internet, full audit chain required. Private is the only path.
  • Government platform: smart drafting of official documents, policy knowledge QA. Data cannot leave the government internal network. Must be private.
  • Regional bank: AI calls must be auditable, models must run on the internal network, decisions must be replayable. Private is regulator-mandated.

For these organizations, the question isn't "should we go private", it's "which flavor of private" — full in-house build, commercial private product, or external team custom build.

Type 2: Financial institutions

Banks, brokerages, insurers, asset managers. Regulation on data, models, and algorithmic audit rivals central SOEs'.

Special requirement: finance has additional demands for model explainability and decision traceability. If AI participated in a credit decision, you need to explain why this loan was declined, and replay the entire decision chain during a regulator audit. SaaS AI can't do that.

Type 3: Energy, chemical, power, heavy manufacturing

These industries' production systems often run on separate OT networks (industrial control networks), physically isolated from the internet. Any AI that enters production decisions must deploy onto the OT network — that's private by definition.

These enterprises also hold domain knowledge built up over a decade or more (process documents, repair manuals, fault case libraries). That knowledge has commercial value, cannot leak, and can only sit on private AI.

Type 4: International / export-oriented companies with cross-border compliance

Typical: Chinese B2B companies serving Europe or the US. GDPR, CCPA, HIPAA, and similar laws enforce strict rules on "data not used to train models" and "AI processing of personal data must be disclosed".

These companies choose between: use strict-compliance SaaS AI (ChatGPT Enterprise + DPA), or self-deploy. Companies especially sensitive about customer data or competitive intelligence (e.g., Chinese suppliers in US defense supply chains) have private as the only path.

Type 5: Mid-to-large private companies with mature IT and large annual AI usage

No hard compliance requirement, but the math works:

  • Annual AI usage is large (say ¥500k+/month in API spend)
  • 20+ person IT team capable of long-term private operations
  • Clear multi-scenario, cross-system agent needs that SaaS can't meet

For these companies, private wins on TCO, customization depth, and response latency. Usually breaks even in year 2-3.

Common thread: these five types either have to go private or have the math working. If you don't fit any of them, read the next section.

2. Four kinds of enterprises that don't fit

Type 1: Small businesses under 50 employees

At this size, private costs can't amortize.

Rough math: basic private AI (hardware + software + deployment + year-one ops) totals ¥800k-1.5M TCO. If only 30 employees use it 5-10 times a day, per-call cost is dozens of times higher than SaaS.

Right path: buy enterprise SaaS AI (in China: Doubao Enterprise, Zhipu, or a compliance-vetted OpenAI proxy). ¥50-200k/year solves it. Don't chase the vanity of "we have private AI".

Type 2: No dedicated IT team

Private AI needs ongoing operations — monitoring, updates, incident handling, periodic scaling. At minimum: 1 full-time AI ops engineer + 1 part-time data administrator.

Many companies underestimate this. Contract signed without clarity on who holds ops, six months post-delivery the system breaks, no one can fix it, it becomes "installed and unused".

If your IT team is 2-3 people doing daily office support, with no Linux-plus-Python engineers, don't go private yet. Build experience on SaaS, and train/hire AI ops capability in parallel.

Type 3: All data already on public cloud, no compliance constraint

If your ERP, CRM, finance, HR all run on Alibaba Cloud, Tencent Cloud, or AWS, and you have no special compliance requirement — private offers limited upside.

You've already picked a cloud path. AI models can deploy into the same cloud (Alibaba Tongyi enterprise, Tencent Hunyuan enterprise). You don't need to re-host. The cost and experience of co-location with your data beats pulling everything back on-premise.

"Must be in the internal network" only holds when data hasn't moved to cloud or can't move to cloud. That's where private shines.

Type 4: Single simple scenario, low usage

A 200-person company that wants AI for "auto-writing sales emails" — 50 emails a day.

SaaS AI at a few hundred yuan a month is enough. Investing ¥500k in a private system for one low-volume scenario is uneconomic.

Principle: private's value stacks with multi-scenario, cross-system, high-frequency usage. For one low-frequency scenario, SaaS wins.

3. Six pre-launch checks

If your initial judgment is "fit", run these six checks before starting a project. Significant gaps on any item should be closed before launch.

Check 1: Is the compliance objective explicit?

Write it out: "Why are we going private? Which regulation, which contract, which regulator requirement does this satisfy?"

Vague answers — "data security concerns", "the owner said so", "industry trend" — mean the objective is unclear. Unclear objective → drifting acceptance criteria → no one satisfied at delivery.

Check 2: Is hardware infrastructure ready?

Private AI needs GPU servers. Depending on scenario scale, from 2-4 A100/H100 cards to dozens.

  • Procurement lead time: domestic cards 1-2 months; imported cards under export controls 3-6 months
  • Data center conditions: rack space, power (A100 peaks 400W+), cooling
  • Network: gigabit internal is usually enough, 10G better; firewall policy on external ingress/egress

Hardware is not within the AI consultancy's delivery — it must be client-provided. Many projects stall here — contract signed, then the rack has no power, the slots are taken, procurement takes 3 months. Project delays.

Check 3: Is data governance done?

Private AI's most valuable scenarios query internal data. But the quality of that data is the prerequisite:

  • Are key data field definitions unified?
  • Is master data aligned across systems? (Customer IDs, product IDs, employee IDs)
  • Is the permission model clear? Which role sees what data?
  • Has historical data been cleaned? What share of old data has wrong fields or messy formats?

Without these, AI sitting on top can't reach good data. Data governance first, then AI. Order matters.

If your data governance scores under 60/100 (e.g., master data codes still partly reconciled by hand), do a governance phase first, not AI. An inconvenient truth most stakeholders prefer to avoid.

Check 4: Have scenarios been prioritized?

Don't launch multiple scenarios in Phase 1. Pick 1-2 with highest ROI, cleanest data, and clearest pain.

Prioritization dimensions:

  • Pain intensity: how much labor/cost/opportunity is this scenario wasting annually? (Quantified)
  • Data maturity: is the data this scenario needs available and clean?
  • Org acceptance: is the business team supportive or resistant? Resistance-heavy scenarios fail even if technically solvable
  • Technical difficulty: is model capability sufficient? Is engineering complexity manageable?

Score on four dimensions; pick the top 1-2 for Phase 1. Others go on the roadmap — don't pile them into Phase 1.

Check 5: Is accountability clear?

The project involves multiple parties — CIO, business lead, consultancy, hardware vendor, client IT. Each party's delivery responsibility and incident-handling responsibility must be in the contract.

Common gray zones:

  • Hardware arrives late; who absorbs the schedule slip?
  • Data governance incomplete and AI results fall short; is that the consultancy's or client's responsibility?
  • Post-launch incidents — 24-hour response or 4-hour? Is the SLA explicit?

Vague clauses = fights later. Writing it out is tedious but saves ten times the pain.

Check 6: Is there an exit mechanism?

A neglected but important question: if the project fails, or we need to change vendors, how do we exit?

  • Are model weights owned by you or the consultancy?
  • Who owns the knowledge base data?
  • Are all deployment scripts, configs, and ops documents fully handed over?
  • Do you have rights to modify core code?

If these aren't contracted, a vendor relationship going bad or the vendor going out of business leaves you stuck. Insist on contract language specifying IP ownership of all deliverables, full source code handover, and no vendor lock-in.

4. If you're not sure whether you fit

Two low-cost ways to decide:

Option 1: Free AI maturity audit — 15-minute questionnaire + half-day on-site. We'll assess your industry, size, IT base, and compliance posture, and tell you: stay on SaaS, do a hybrid, or go straight to private. No fee, no commitment to further work.

Option 2: Small-scope POC — don't launch a full private project. Spend 2-4 weeks and ¥100-200k on a single-scenario proof-of-concept. Use a simplified private deployment (single machine, one Skill). If it works, evaluate scaling to full project.

We offer a "transformation diagnosis + POC" package specifically for companies still deciding.

5. Closing

Private AI deployment is not a hat everyone needs to wear. It's a specific choice under specific conditions.

If you fit a compliance-heavy industry / mature IT / multi-scenario agent need — private is the right path. Earlier is better.

If not — keep using SaaS AI for the basics and watch your compliance and scale situation. When the conditions align, launching private will cost far less and succeed far more reliably.

Don't go private because "other companies are going private". Whether it fits is known only to your compliance officer, IT lead, and frontline business team. For a neutral third-party judgment, we're always available for a free audit.