1
00:00:01,000 --> 00:00:05,450
Private AI needs specific requirements for access, processing and

2
00:00:05,480 --> 00:00:07,450
storage, rather than a label.

3
00:00:08,200 --> 00:00:11,690
A fictional company wants staff to ask questions about project

4
00:00:11,960 --> 00:00:12,530
documents.

5
00:00:12,680 --> 00:00:14,090
The files are restricted.

6
00:00:14,520 --> 00:00:18,535
But the application also creates a search index, sends context to

7
00:00:18,560 --> 00:00:21,370
a model and may retain execution records.

8
00:00:22,120 --> 00:00:25,930
Identify what each component receives and where information may

9
00:00:25,960 --> 00:00:26,810
persist.

10
00:00:27,000 --> 00:00:29,610
Include answers, logs and backups.

11
00:00:30,280 --> 00:00:34,090
A restricted document folder alone does not establish how the rest

12
00:00:34,120 --> 00:00:35,450
of the chain is configured.

13
00:00:35,880 --> 00:00:37,490
Who may read information?

14
00:00:37,640 --> 00:00:39,450
Which parties process it?

15
00:00:39,480 --> 00:00:41,810
What storage and retention are allowed?

16
00:00:42,040 --> 00:00:45,010
Make these questions explicit and separate.

17
00:00:45,320 --> 00:00:49,290
Hosting your own system does not automatically settle user permissions

18
00:00:49,400 --> 00:00:50,970
or administrator access.

19
00:00:51,400 --> 00:00:55,450
A business service, restricted cloud environment and self-hosted model

20
00:00:55,720 --> 00:00:57,610
may have different conditions.

21
00:00:57,960 --> 00:01:02,410
Compare the complete data journey, required controls, answer quality

22
00:01:02,600 --> 00:01:05,530
and maintenance your organisation can support.

23
00:01:05,880 --> 00:01:08,810
Pass only permitted information into the task.

24
00:01:09,320 --> 00:01:13,210
Check what enters sessions, search results and logs as well.

25
00:01:13,400 --> 00:01:16,890
A general instruction to remain confidential does not replace

26
00:01:16,920 --> 00:01:18,930
technical permission enforcement.

27
00:01:19,240 --> 00:01:22,090
Try different user roles and revoked permissions.

28
00:01:22,600 --> 00:01:25,010
Investigate deletion and recovery.

29
00:01:25,320 --> 00:01:30,015
Also assess quality, speed and maintenance effort with your tasks; a

30
00:01:30,040 --> 00:01:33,210
restricted environment still needs to work in practice.

31
00:01:33,880 --> 00:01:36,690
Classify information and assign owners.

32
00:01:36,920 --> 00:01:39,370
Record data flows and responsibilities.

33
00:01:39,800 --> 00:01:43,850
Then choose an arrangement that fits those requirements, identifying

34
00:01:43,880 --> 00:01:45,450
what still needs to be checked.

35
00:01:46,200 --> 00:01:51,130
Read OXIAE’s guide to assessing private AI across the data journey

36
00:01:51,320 --> 00:01:53,290
and its maintenance requirements.