Choosing an AI model is not a technical decision. It is a strategic one. Get it wrong and the consequences show up two years later: in a compliance review, in a governance audit, in a system that no longer behaves the way it did when it was signed off. We help clients make that decision with full visibility of what is at stake.
THREE TIERS. THREE DIFFERENT REALITIES.
Every AI deployment sits in one of three tiers. Each tier has a different profile: different control, different compliance implications, different cost and different risk. Understanding which tier is right for a given situation is the first decision that needs to be made well.
TIER 1 · API
The model is hosted by the provider. Every call goes over the public internet. Fast to deploy, low infrastructure overhead, and the broadest access to frontier models. The right choice for many use cases. Not the right choice when data leaving your perimeter is a compliance, contractual or governance concern.
Data leaves the client perimeter on every call.
TIER 2 · CLOUD-HOSTED DEPLOYMENT
Enterprise AI services like Azure OpenAI Service, AWS Bedrock and Google Vertex AI give organisations access to the same frontier models as Tier 1, but under fundamentally different terms. The cloud provider hosts the model within the client's designated region, including EU-based hosting for European organisations. The model provider itself never sees or processes the data. What is processed stays within the enterprise cloud boundary the organisation already has in place, under the strict data processing agreement already negotiated with that cloud provider.
For many European organisations operating under GDPR, this is the tier that makes frontier AI viable. The model capability is the same. The data governance is not.
The model runs inside the cloud provider's infrastructure, in the client's designated region. The existing enterprise DPA covers everything inside that boundary.
TIER 3 · OPEN-WEIGHT, ON-PREMISE OR SOVEREIGN CLOUD
Open-weight models deployed on infrastructure the client controls entirely. On-premise or on a sovereign cloud. The model runs inside the client's own perimeter. The data never leaves. No third-party terms apply to the inference. Maximum control, maximum compliance surface. The answer when Tier 1 and Tier 2 do not meet the regulatory, operational or risk requirements of the engagement.
The model runs entirely within the client's own infrastructure. Data never leaves. Plus many others from the broader open-weight ecosystem.
HOW WE SELECT THE RIGHT TIER
Task fit and output quality are the starting point. They are not the whole picture. The criteria that get skipped at the selection stage are usually the ones that cause problems later. We evaluate all seven, every time, so the client makes an informed decision before the deployment, not two years into it.
Equal weight. No hierarchy. All seven evaluated every time.
01 · Objective
What does the model need to do? How well does it do it on the specific task, in the specific language, at the required quality level?
02 · Compliance
What are the data residency requirements? What does the EU AI Act require for this use case? What does GDPR say about where this data can go and who can process it?
03 · Branding and image
How will this model choice be perceived by the organisation's stakeholders, clients and regulators? Model provenance matters. Some choices carry reputational weight that has nothing to do with technical performance.
04 · Output consistency
Does the model behave consistently across versions and API updates? A model that silently changes its output behaviour after an update is a governance risk in any environment where the output drives decisions or feeds regulated processes.
05 · Continuity
What is the long-term trajectory of this model? Is it actively maintained and developed? A model that is abandoned creates a rebuild cost that was entirely avoidable at the selection stage.
06 · Adaptability
Can the model be fine-tuned, extended and integrated into the broader architecture? What does it take to make it work the way the organisation needs it to work over time?
07 · Licensing and IP
Who owns the output? What are the usage rights? What happens to the data used for inference? These questions are rarely asked at the selection stage. They are frequently the source of commercial and legal complications later.
The right tier is a strategic decision. We help you make it with confidence.
One conversation. Full visibility on what is possible, what is compliant, and what is right for your organisation.