A common pattern in current AI procurement: an operator commissions a "private AI deployment" that turns out, on inspection, to be a proxy server in front of a public model. The terminology has degraded enough that this is often described in good faith. It is not malicious. It is, however, structurally different from what the operator usually needed.

What "private" actually means

A private cognitive system has three structural properties.

Inference runs on operator-controlled compute. Not a proxy, not a routed endpoint, not a contractually private SaaS tenant. The actual matrix multiplication happens on hardware the operator can audit.
Data does not leave the operator's network boundary. Prompts, retrieval results, model outputs, and logs all remain inside the network perimeter defined by the operator.
Model versions are frozen by the operator. Identical inputs produce identical outputs across time, until the operator decides to roll forward.

Most "private AI" offerings in the current market satisfy zero of those three. Some satisfy one. Very few satisfy all three.

The proxy-server pattern

The most common confusion is the proxy server. An operator hires a vendor to "deploy private AI." The vendor sets up a hardened gateway, applies authentication, and routes requests to a major public LLM endpoint with a private contract. The operator gets billed monthly. The vendor calls this a private deployment.

This is not private. It is a SaaS integration with extra steps. The model still runs on infrastructure outside the operator's perimeter. The prompts still cross the network boundary. The operator still has no version control over the model. Whether the contract permits the vendor to train on the prompts is irrelevant to the architectural question, which is: what does the operator actually own?

The sovereign-deployment alternative

A sovereign cognitive system runs an open-weight or custom-trained model on operator hardware. There are three plausible configurations.

On-premises. The hardware sits in operator-controlled space. Maximum sovereignty, highest fixed cost, slowest to spin up new capability.
Operator-controlled private cloud. Dedicated infrastructure inside a hyperscaler tenancy that the operator administers. Compromises on physical sovereignty for operational flexibility.
Operator-controlled bare-metal hosting. Dedicated hardware in a colocation facility under an operator-controlled access policy. Practical middle ground for most engagements we run.

All three preserve the three structural properties: operator-controlled inference, no data egress, frozen model versions.

When the difference matters

For most operators, it does not. A marketing team running summarization across public press releases does not need a sovereign cognitive system. A logistics company optimizing routes does not need one. A retail operator generating product descriptions does not need one.

The difference becomes structurally important when one of these is true:

The prompts themselves are confidential, not just the data they reference.
The operator is in a regulated industry where data-flow auditing is required.
The operator's competitive position depends on patterns in their internal documents that they cannot allow even an aggregated leak of.
The operator has counterparty obligations that require demonstrating a closed information loop.
The operator faces strategic-positioning risk if it became public knowledge that they were using AI in a specific way.

For most operators, public AI with sensible governance is sufficient. For some operators, sovereign cognitive systems are the only defensible architecture. The distinction is not preference, it is structural.

What to ask a vendor

If you are considering a "private AI" vendor, three questions are diagnostic.

Where, physically, does the matrix multiplication happen during inference?
What is the network boundary inside which prompt and output data remains?
Who controls the model version, and how is a version change governed?

A vendor that cannot answer those questions concretely is selling you proxy-server private AI. That may be exactly what you need. But you should know which architecture you are actually buying.