Local LLM vs Claude: Which Fits Your Business?
Self-hosting an open-weight model and using a hosted service like Claude solve different problems. What each one actually requires, and where EU AI Act and GDPR obligations really attach.
3 min readVoice of Business
Self-hosting an open-weight model and calling a hosted service like Claude are not two versions of the same decision. They solve different problems, and confusing “which is more compliant” with “which is more capable” is where this choice usually goes wrong.
Key takeaways
- Self-hosted models keep processing on infrastructure the organisation controls directly. Claude runs as a service on Anthropic’s infrastructure, under whichever agreement the account sits inside.
- Anthropic’s default consumer policy allows inputs to train future models unless a user opts out, but Business and Enterprise accounts sit outside that default policy under a separate agreement.
- The EU AI Act’s obligations attach to the system and its risk classification, not to where it happens to run. Moving a workload onto local infrastructure does not exempt it from the Act.
- A local deployment trades ongoing infrastructure and ML-ops effort for direct control. A hosted model trades that control for capability and speed of deployment.
- The right choice depends on what is actually being processed and who is accountable for it, not on a blanket assumption that one option is automatically the compliant one.
What “local” actually means
A self-hosted deployment runs an open-weight model on infrastructure the organisation provisions itself: on premises, or in a private cloud environment it controls. Nothing sent to the model leaves that environment. That is the whole appeal, and it comes with the whole cost: GPU hardware sized to the model, plus the ongoing work of patching, scaling and monitoring it. It is a capability an organisation builds and keeps, not a subscription it switches on.
What using Claude actually means
Using Claude means calling a hosted model over an API or a product built on one. There is no infrastructure to provision, and model updates and scaling are the provider’s problem, not the customer’s. What changes is where the data goes: it is processed on Anthropic’s infrastructure, under the terms of whichever agreement the account is on. Anthropic’s own privacy policy states that a standard account’s inputs and outputs may be used to train future models unless the user opts out, and separately states that Business and Enterprise accounts are governed by their own customer agreement rather than that consumer policy.
Data control and the compliance picture
Neither option is a shortcut around EU AI Act or GDPR obligations. The Act’s requirements scale with the risk classification of the system, not with where it is hosted: a high-risk system still needs a risk management process and documentation whether it runs on a server down the corridor or behind an API. What actually changes between the two options is who is directly accountable for the data path, and how much of that path an organisation can see and control itself. That is a real, practical difference. It is not the same question as “which one is compliant.”
Comparison at a glance
| Aspect | Self-hosted (local) model | Claude (hosted) |
|---|---|---|
| Where data is processed | The organisation’s own infrastructure | Anthropic’s infrastructure, under the account’s agreement |
| Default data handling | Entirely within the organisation’s control | Governed by the account’s agreement; Business and Enterprise accounts sit outside the consumer privacy policy |
| EU AI Act obligations | Still apply, based on the system’s risk classification | Still apply, based on the system’s risk classification |
| Infrastructure required | GPU hardware or private cloud compute, provisioned and maintained | None; accessed as a service |
| Ongoing effort | Model updates, scaling, security patching, ML-ops staff | Handled by the provider |
| Capability available today | Open-weight models, improving but generally behind frontier hosted models | Frontier-level capability without infrastructure investment |
Which fits your organisation
This is exactly the question an audit’s Identify step is built to answer, weighed against what the process actually handles and what a candidate workflow actually needs, rather than decided in the abstract. How we audit sets out how that gets worked through in full.
Frequently asked questions
Does running a model locally automatically make it GDPR or EU AI Act compliant?
No. Both attach to what the system does and what data it processes, not to where the software happens to run. A poorly governed local deployment can breach either just as easily as a poorly governed hosted one.
Is data sent to Claude used to train future models?
Under Anthropic's own privacy policy, inputs and outputs from standard accounts may be used to train future models unless the user opts out. Business and Enterprise accounts are explicitly excluded from that default policy and are instead governed by their own customer agreement, which is worth reading directly rather than assumed either way.
What does running a model locally actually require?
GPU infrastructure sized to the model in use, and the ongoing work of keeping it patched, scaled and monitored. In practice that means an in-house ML-ops capability, not a one-off setup.
Can an organisation use both approaches?
Yes. A common pattern routes sensitive or regulated workloads to a local deployment and less sensitive tasks to a hosted model, rather than treating it as an all-or-nothing choice.