Blog
Regulation, architecture and practice.
Articles for teams running AI where data can’t leave the building, split evenly across Europe, the United States and India.
Europe
Europe.
DORA and AI vendors: what banks must ask of an ICT provider
DORA has applied since 17 January 2025. The questions EU financial entities should ask before adopting an AI service, from exit plans to the register of information.
Read →EU AI Act: is your internal knowledge assistant high-risk?
After the Digital Omnibus, Annex III high-risk obligations apply from 2 December 2027. How to classify an internal AI knowledge assistant and when it crosses the line.
Read →On-premise AI and §203 StGB: what German law firms and doctors need to know
§203 StGB makes unauthorised disclosure of client and patient secrets a crime. Why a GDPR processing agreement isn't enough for cloud AI, and how self-hosting avoids the problem.
Read →United States
United States.
All-party consent states and AI voice agents
Some US states require every party to consent to call recording. How to design AI voice agents with notices, opt-outs and consent logs that work across states.
Read →HIPAA-compliant AI assistants: why self-hosting simplifies the BAA question
When an AI service processes PHI it is usually a business associate. How running AI inside your own environment keeps PHI away from AI vendors and simplifies HIPAA.
Read →Private AI for law firms: protecting attorney–client privilege
How law firms can use AI for research, contract review and drafting without disclosing client confidences to an AI vendor: self-hosting, ethical walls and audit.
Read →India
India.
DPDP Rules 2025: what changes for AI chatbots and voice agents
India's DPDP Rules phase in until May 2027. What notice, consent, security, retention and 72-hour breach reporting mean for AI chatbots and voice agents.
Read →RBI payment data localisation and AI: what can and can't leave India
RBI requires payment system data to be stored only in India. What that means for AI assistants, document processing and voice agents that touch payment data.
Read →SEBI CSCRF and on-premise AI for regulated entities
SEBI's CSCRF binds regulated entities; its data-localisation control is in abeyance since 31 December 2024. How to run AI that meets the framework today and if localisation returns.
Read →All markets
Architecture and comparisons.
Glean vs self-hosted retrieval: total cost at 150 and 500 users
Per-seat AI search costs scale with headcount. A worked comparison of licence cost at 150 and 500 users against a fixed-scope, self-hosted build.
Read →RAG or a fine-tuned small model? How we decide in discovery
Retrieval keeps answers current and cited; fine-tuned small models learn tasks and vocabulary and run fast. The evidence-based way to choose, and why it is often both.
Read →When Microsoft Copilot is enough, and when it isn't
An honest guide: Microsoft 365 Copilot suits organisations whose knowledge and data live in Microsoft's cloud. Five situations where a self-hosted system fits better.
Read →Start with two weeks of evidence, not a sales call.
A fixed-price discovery sprint, credited against whatever comes next. Or write to sales@deepvox.ai.