WEBVTT

00:00:01.000 --> 00:00:05.450
Private AI needs specific requirements for access, processing and

00:00:05.480 --> 00:00:07.450
storage, rather than a label.

00:00:08.200 --> 00:00:11.690
A fictional company wants staff to ask questions about project

00:00:11.960 --> 00:00:12.530
documents.

00:00:12.680 --> 00:00:14.090
The files are restricted.

00:00:14.520 --> 00:00:18.535
But the application also creates a search index, sends context to

00:00:18.560 --> 00:00:21.370
a model and may retain execution records.

00:00:22.120 --> 00:00:25.930
Identify what each component receives and where information may

00:00:25.960 --> 00:00:26.810
persist.

00:00:27.000 --> 00:00:29.610
Include answers, logs and backups.

00:00:30.280 --> 00:00:34.090
A restricted document folder alone does not establish how the rest

00:00:34.120 --> 00:00:35.450
of the chain is configured.

00:00:35.880 --> 00:00:37.490
Who may read information?

00:00:37.640 --> 00:00:39.450
Which parties process it?

00:00:39.480 --> 00:00:41.810
What storage and retention are allowed?

00:00:42.040 --> 00:00:45.010
Make these questions explicit and separate.

00:00:45.320 --> 00:00:49.290
Hosting your own system does not automatically settle user permissions

00:00:49.400 --> 00:00:50.970
or administrator access.

00:00:51.400 --> 00:00:55.450
A business service, restricted cloud environment and self-hosted model

00:00:55.720 --> 00:00:57.610
may have different conditions.

00:00:57.960 --> 00:01:02.410
Compare the complete data journey, required controls, answer quality

00:01:02.600 --> 00:01:05.530
and maintenance your organisation can support.

00:01:05.880 --> 00:01:08.810
Pass only permitted information into the task.

00:01:09.320 --> 00:01:13.210
Check what enters sessions, search results and logs as well.

00:01:13.400 --> 00:01:16.890
A general instruction to remain confidential does not replace

00:01:16.920 --> 00:01:18.930
technical permission enforcement.

00:01:19.240 --> 00:01:22.090
Try different user roles and revoked permissions.

00:01:22.600 --> 00:01:25.010
Investigate deletion and recovery.

00:01:25.320 --> 00:01:30.015
Also assess quality, speed and maintenance effort with your tasks; a

00:01:30.040 --> 00:01:33.210
restricted environment still needs to work in practice.

00:01:33.880 --> 00:01:36.690
Classify information and assign owners.

00:01:36.920 --> 00:01:39.370
Record data flows and responsibilities.

00:01:39.800 --> 00:01:43.850
Then choose an arrangement that fits those requirements, identifying

00:01:43.880 --> 00:01:45.450
what still needs to be checked.

00:01:46.200 --> 00:01:51.130
Read OXIAE’s guide to assessing private AI across the data journey

00:01:51.320 --> 00:01:53.290
and its maintenance requirements.