Looking back at the way we were deploying AI twelve months ago feels like looking back at technology from the 1980s.
This time last year, putting AI to work in a business meant designing the process first, in full, before the system could run. In a small business that meant a chain of forty steps or more drawn inside an automation platform; in an engineering team it meant the same chain written as code, and the most popular developer framework of the era was named for the shape: chains. Either way a person drew every branch in advance, plugged a model into the steps that needed judgment, and put an API key or credential at every joint. The fragility stayed invisible until something broke. A stray pair of quotation marks inside a single record could break a formula deep in a chain, the run would stop without telling anyone, and the step that marked the record complete would run anyway, so a gap could sit unnoticed until someone went looking.
And the wiring was only part of it. Prompts had to be precise to the comma, and a one-line change that fixed one failure could silently break three others, so we learned to version prompts the way developers version code. Context windows were short, so a long manual had to be cut into pieces before a model could read it, with every piece priced by the token. Models had to be trialled against each other per capability, because each had different blind spots, and the ground moved while you worked: providers had outages mid-run, and a model update could change yesterday's results without anyone touching the build.
We learned a lot in the early days
Public access to generative AI arrived in late 2022, and the early days ran all the way to about twelve months ago. Document-reading projects taught us the era's limits at close range: the models of the day would drop whole rows from a table, ignore colour where colour carried the meaning, and give different answers to the same document on different runs. A build scoped on a handful of sample documents would then meet the full variety of production, where every supplier formats the same information differently. Out of that came the disciplines I now build with everywhere: the evaluation layer comes first, the job is cut into the smallest pieces a model can do reliably, accuracy is measured against an agreed formula before anyone commits to a number, and a person reviews the output before anything relies on it. Those projects also delivered the era's unexpected return: the AI kept finding information buried deep in long documents that experienced people had read more than once, which taught us that the value is often accuracy gained on top of time saved.
What I presented in May 2025
Most of what I presented about AI security fifteen months ago has stopped being true, and every statement was true on the day. In May 2025 I presented at the Australian Superyacht Conference on the levels of security in using AI; the security section of the full presentation is in the Chart Room, and its frame still holds. This is the update.
The spectrum ran seven levels, split between buying AI and building it. On the buying side: public web tools, where anything you type may be stored and used for training; paid tools with do-not-train settings; professional platforms built for business use; and enterprise AI inside a corporate compliance framework, such as Microsoft 365 Copilot. On the building side: private cloud, your own instance inside AWS or Azure; on-premise, models running on hardware you own; and air-gapped systems with no external connection at all, the kind used in classified environments. The higher you climbed, the more control you had and the less capability, because the top models of the day could not be hosted locally and the open models you could download ran slower and behind the frontier.
Then the costs, as my slide had them: consumer tools at $0 to $40 a month, enterprise seats at $20 to $80, professional platforms at $50 to $150, and on-premise self-hosting at USD $10,000 to $100,000 and beyond, covering hardware, engineers and GPU licensing. Of the on-premise tier I said: nothing leaves your walls, ideal for contract reviews, NDAs and owner records, if you could reach it. My advice to the room was to aim for the middle of the spectrum, because the top was out of reach for most businesses.
The out-of-reach tier now sits on a desk
A machine that runs a capable AI model entirely on your premises now costs about USD $600. OpenAI published its own open-weight models in August 2025 under a licence that allows commercial use, and the smaller one runs in 16GB of memory: a base Mac mini. A machine between USD $1,500 and $2,500 runs models in the class I was calling unhostable from the stage. In late July this year the Chinese lab Moonshot AI released the full weights of Kimi K3, a downloadable model within a few points of the best closed systems on the main capability indexes; that one still calls for data-centre hardware, and the whole ladder beneath it moved up with it. Open models are now published by labs in the United States, Europe and China alike. For scale: twelve months ago, running a frontier-class open model on your own equipment meant a maxed-out USD $9,500 workstation or a server rack. Today a useful tier of the same idea costs less than the old estimate's monthly power bill.
What running your own model involves
For most businesses the mainstream subscriptions remain the practical choice, and the paid business tiers carry do-not-train settings and contractual protections that answer most confidentiality questions. Running your own model earns its place when the requirement is structural: a no-AI clause in an NDA, a data-residency obligation, or clients who ask where every byte of their information sits. Then a downloaded model answers the question in a way no contract has to: your documents and your prompts stay on your hardware, because the model has nowhere to send them.
What it involves: a machine sized to the models you want, an afternoon of setup with tools built for people who don't write code, and then the part that decides whether it succeeds. You choose the model for the job, test it against your own documents before relying on it, and build the oversight a hosted platform was providing for you. A downloaded model keeps the safety training its lab built into the weights; the moderation filters, abuse monitoring and automatic updates that sit around a hosted service stay behind, so the checking, logging and updating become yours to run. Local models also sit below the hosted frontier on capability. They hold up well on defined jobs: drafting, summarising, extraction, question-answering over your own files. A team of five to twenty people with intermittent use can share one well-specified machine; a team prompting constantly needs a graphics-card server and ordinary IT support for the machine itself. The model side is a different skill: choosing the model for the job, testing it against your documents, and governing what runs is specialised AI work rather than IT, and it is the help to bring in if nobody inside the business holds it. When a business asks me whether it should run an open model, my first question back is which requirement demands it, because without one, the subscription is still the better tool.
The gap between a business leader and a developer has narrowed
The distance between you and the highest level of this technology is shrinking. Deployment now starts from a goal stated in your own words, and the process is designed in the conversation: you say where you're trying to get to, the system proposes how, and you iterate on the process itself rather than drawing it box by box. On one client system recently, a one-sentence instruction about how a piece of standard wording should read was carried out in a day: the workflow corrected, a utility built to fix more than two thousand database records with its own verification pass, and every published page checked with zero failures. A job of that shape used to mean days of wiring and manual checking.
On the largest AI app-building platforms, around four in five builders have no technical background, and the biggest single group is founders: domain experts building the thing they understand (Lovable, 2026). I build client systems on platforms like these and stay agnostic across platforms and providers: each is one option, and the right one depends on the job. I've watched the shift happen around me this year. Several business owners I know have put an operations manager into the day-to-day and now spend their evenings deep in this transition, going back to the goal and letting the process be rebuilt around it. The research backs their instinct: McKinsey (2025) finds the organisations getting material returns are three times more likely to have fundamentally redesigned workflows around AI than to have bolted it onto the existing process. Those owners will compound their advantage for years. If your evenings are already spoken for, closing that gap is the job I do.
The numbers to plan with
On-premise self-hosting ran USD $10,000 to $100,000 on my 2025 slide; the bottom of that range now buys the computer several times over. The per-seat route runs $20 to $80 per user per month for the mainstream tools, with agent usage metered on top in the enterprise platforms. The API route, where a build calls a model as it needs one, typically comes to tens or hundreds of dollars a month for a modest internal workload. The on-premise route is a one-off machine between roughly $600 and $2,500 plus electricity, with the investment shifting to setup, testing and the governance around it.
Adoption is near-universal. Value capture is rare. MIT's Project NANDA (2025) reported that 95 percent of enterprise generative AI pilots showed no measurable profit-and-loss impact across $30 to 40 billion of spend, and the same study shows where the failures concentrate: organisations that skip integration and staff learning, budgets aimed at visible front-of-house uses while the measurable value sits in back-office processes, and internal builds reaching deployment at half the rate of purchased tools. McKinsey (2025) puts adoption at 88 percent of organisations and material earnings impact at about six percent of them.
Five hours of training is the measured difference between a tool sitting in the subscription line and a tool changing how a week runs. BCG (2025) surveyed more than ten thousand employees and found regular AI use rises from 67 to 79 percent once a person has had five or more hours of training, climbing further with in-person coaching, and only about a third of employees get that.
The accountability that makes it hold
Owning the model relocates the accountability. A downloaded model on your own hardware has no vendor logging behind it, so the oversight has to be yours, and what that looks like depends on where your business already lives.
If you run on Microsoft 365 and SharePoint, the accountability layer now comes with the tenancy. Since April 2026, Microsoft gives every AI agent its own identity in your directory, the way a staff member has one: a named human sponsor, access rules, and an audit trail of what the agent touched, held in the same place your email and files are already governed (Microsoft, 2026). For a business inside that environment, it is the shortest path to AI with evidence.
Plenty of businesses in our industry run their own server instead, and I'm currently working with clients with specific security requirements, including businesses doing projects for the Australian Defence Force, where the standard is a well-run IT environment with proof: every control configured, logged, and someone named to read the logs and act. The same shape scales down to a local AI deployment anywhere. Keep a record of every prompt and response with who, when and which model; limit access by role; name the accountable person; put human sign-off at the points where output reaches a client or a system; and write the policy your team works to. Australia's Guidance for AI Adoption (National AI Centre, 2025) sets out six practices covering exactly this, sized for small organisations, and ISO 42001 is the certifiable version for the day a client or insurer asks for proof.
The spectrum I presented in May 2025 still holds as a way to choose: match the sensitivity of your data to the security of the environment it enters. What changed is where the top of it sits. The tier I told our industry was out of reach now fits on a desk, deployment starts with a goal stated in your own words, and the three disciplines that decide whether any of it pays are all buildable: the process redesigned, the team trained, the system governed. If you're weighing what the first build would be in your operation, that conversation is what I do.
Further Reading
- -Boston Consulting Group (2025). AI at Work 2025: Momentum Builds, but Gaps Remain. bcg.com
- -National AI Centre (2025). Guidance for AI Adoption: Implementation Guidance. ai.gov.au
- -McKinsey & Company (2025). The State of AI. mckinsey.com
- -MIT Media Lab, Project NANDA (2025). The GenAI Divide: State of AI in Business 2025. mlq.ai
- -Microsoft (2026). What is Microsoft Entra Agent ID? learn.microsoft.com
- -MacRumors (2025). Apple's M3 Ultra Runs DeepSeek R1 Efficiently. macrumors.com
- -OpenAI (2025). Introducing gpt-oss. openai.com
- -Stanford Institute for Human-Centered AI (2026). The AI Index Report 2026. hai.stanford.edu
- -VentureBeat (2026). Moonshot AI Releases Kimi K3. venturebeat.com
