The short answer
Most AI tools send prompts to the provider, usually abroad. Business terms exclude that data from training, and several offer zero data retention, but the provider still processes it. Private AI runs an open-weight model on GPU servers you control: your hardware, a Nigerian data centre or your cloud. Trade-offs: you run the platform, pay for idle servers, and top commercial models still lead on the hardest tasks.
What "open-weight" means
A trained model is essentially a huge file of numbers called weights; once published, anyone can download and run it. That is open-weight, not open source: the Open Source Initiative's definition of open source AI also requires the training code and detailed information about the training data (Open Source Initiative). Licences vary:
| Licence | What it allows |
|---|---|
| Permissive (Apache 2.0, MIT) | Commercial use with few conditions |
| Custom | May add acceptable use rules, attribution, or a separate agreement for large companies or businesses hosting the model for others |
| Non-commercial | No business use without a separate agreement |
Licences can change between versions of one family: read the licence of the exact version you plan to use, and have your legal adviser review anything unusual.
The main model families
| Family | Developer | What to know |
|---|---|---|
| Llama and Muse | Meta (United States) | Widely supported; mostly custom licences with conditions, some smaller Muse models Apache 2.0 |
| Qwen | Alibaba (China) | Many sizes; smaller versions often Apache 2.0, the largest custom licences |
| DeepSeek | DeepSeek (China) | MIT licence; the newest versions are very large, needing multi-GPU servers |
| GLM | Z.ai, formerly Zhipu AI (China) | Among the leading open-weight families in 2026; some versions MIT, the flagship custom |
| Mistral | Mistral AI (France) | European developer; several models Apache 2.0, some limited for large companies |
| Gemma | Google (United States) | Smaller models for modest hardware; Gemma 4 Apache 2.0, earlier versions Gemma terms |
| gpt-oss | OpenAI (United States) | Apache 2.0; OpenAI states the larger model runs on a single 80 GB GPU |
| Granite and Phi | IBM and Microsoft (United States) | Smaller models under Apache 2.0 and MIT |
Others, such as Moonshot AI's Kimi and MiniMax, use custom licences, some non-commercial. New versions arrive every few months: this is a map, not a recommendation. The right model answers your questions well on affordable hardware.
Where the model can run
| Option | What it looks like | Suits |
|---|---|---|
| GPU servers in your cloud account | GPU virtual machines (AWS, Microsoft Azure, Google Cloud, DigitalOcean) in your account and private network, in a region abroad | Most organisations that can rely on transfer safeguards: quick to start, resizable, stoppable when idle |
| Dedicated or colocated GPU server | A rented GPU server used only by you, or your own server colocated in a Nigerian data centre | Steady, heavy workloads; data that must stay in Nigeria |
| Your own hardware | GPU servers in your data centre or server room, with UPS and backup power | Strict policies, existing facilities, long-term steady use |
| Managed open models in your cloud | Amazon SageMaker AI, Microsoft Foundry or Google Cloud's Model Garden, in your account | Less to operate, within one cloud |
GPU capacity in and near Nigeria is limited, and there is no hyperscale cloud region in Nigeria (AWS, AWS, Google Cloud):
| Location | GPUs |
|---|---|
| AWS Lagos Local Zone | Only entry-level NVIDIA T4-class instances, for small models |
| AWS Cape Town | Only T4-class GPUs listed |
| Google Cloud Johannesburg | None listed; no hyperscaler offers H100-class GPUs in Nigeria |
| Local data centres | Adding capacity: Kasi Cloud's LOS1 campus in Lagos entered operational readiness in May 2026; Cassava Technologies (NVIDIA AI factory in South Africa) has announced Nigerian plans |
That leaves two realistic routes:
Keep it in Nigeria
GPU servers on your premises or colocated locally; start with one, scale as you grow.
Use servers abroad
In your own cloud account, with NDPA transfer safeguards and a data protection impact assessment.
From 1 January 2027, NITDA's National Cloud Technical Guideline sets sensitivity-based data-residency rules for federal public institutions and regulated-sector organisations (NITDA). Cloud GPUs are usually billed in US dollars, so running costs move with the exchange rate. Check managed services too: some run only in certain regions or route requests across regions by default (Amazon Bedrock's custom model import runs only in a few US and European regions).
What it takes besides the model
An inference server
Serves many users at once; vLLM and SGLang offer an OpenAI-compatible API, Ollama a subset.
A gateway
Sign-in through your identity provider, usage limits, logging under your own retention rules.
Retrieval
Answers from your policies, files and records, with sources (how it works).
Monitoring and updates
Keep the platform healthy; test and adopt better models as they appear.
An OpenAI-compatible API (vLLM) lets many existing tools use your private endpoint. Compatible is not identical: chat formats and tool calling differ, so test each integration.
How big a server do you need?
GPU memory is the main constraint. Weights need about parameters times bytes per parameter: about two bytes at 16-bit precision, roughly a half or a quarter of that when quantised to 8 or 4 bits.
| A 70-billion-parameter model | 16-bit | 8-bit | 4-bit |
|---|---|---|---|
| Memory for weights alone | about 140 GB | about 70 GB | about 35 GB |
Small and mid-sized
One data-centre GPU, the smallest a workstation; often good at document questions, summaries, extraction.
The largest
Several high-end GPUs; usually worth it only for heavy, demanding workloads.
Quantisation
Shrinks memory needs with a small quality loss: measure it on your own questions.
Size for peak use and your response-time target, and test before buying or reserving hardware. Plan power and cooling too: a GPU server draws far more than an ordinary one, so size UPS, inverter and generator or solar capacity for it.
More detail: conversations and mixture-of-experts
- On top of the weights, the server needs memory for the conversations it handles at once, which grows with the number of users and the length of documents, plus some working overhead.
- Many large open-weight models use a mixture-of-experts design, using only part of the model for each word. That makes them faster, but memory still depends on the total number of parameters, not the active ones.
Security: treat models like software from the internet
Researchers have found malicious models on public model hubs, and Hugging Face warns its own scanning is not foolproof (Hugging Face).
Download from the source
The developer's official repository, publisher name checked, exact version and file hashes recorded.
Use safetensors
Pickle-based files can run code on load; safetensors stores only numbers. Review any shipped code.
Keep the endpoint private
No public access, sign-in required, approved apps only, no outbound internet where possible.
Test like any AI app
Prompt injection still works, and data can leak between users if permissions are not enforced.
"Is it safe to run a Chinese model?"
Three separate questions are often mixed up:
| Question | Answer |
|---|---|
| Where does your data go? | A self-hosted model runs on your servers and sends nothing to its developer, whatever its country. The developer's own app or API is different: data goes to its service, under its terms and laws. |
| Do your policies allow it? | We are not aware of any Nigerian rule specific to DeepSeek or other Chinese-developed models. Some foreign governments have restricted the DeepSeek app on official devices, and public bodies, their suppliers, international clients and funders may have their own rules: check yours and your clients'. |
| How does the model behave? | Models can reflect their training's views or restrictions, and robustness varies. A 2025 NIST evaluation found DeepSeek agents far more likely than leading US models to follow malicious instructions (NIST). Test on your own security scenarios and topics; if in doubt, pick another family (strong options include US and French ones). |
When private AI is worth it
It makes most sense when information must stay on infrastructure you control or in Nigeria, or usage is steady and high.
- Policies, clients or regulators bar confidential or personal data from outside AI or abroad
- Zero-retention business terms would not satisfy your DPO or clients
- Tasks named, and candidates testable on real questions
- Usage keeps a server reasonably busy, or privacy justifies the cost
- Someone, your team or a partner, will patch, monitor and update it
- Server location known (Nigeria if data must stay here)
- GPU capacity and reliable power confirmed there
Most boxes ticked: a private model deserves a proof of concept. Few: a business AI service with strong terms is probably the better start. Our comparison of self-hosted models and AI services walks through the decision.
When to bring in help
A small model on a workstation is an easy way to learn. Bring in help when the model will see confidential or personal information, many people will rely on it, or you must show clients, auditors or regulators how it is controlled.
Our private AI and self-hosted models service shortlists and tests models on your questions, designs and secures the hosting, connects your documents and systems, and can run the platform after launch.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- The Open Source AI Definition 1.0, Open Source Initiative
- Online serving (OpenAI-compatible server), vLLM documentation
- Pickle scanning, Hugging Face
- AWS Local Zones features, Amazon Web Services
- Amazon EC2 instance types by Region, Amazon Web Services
- GPU regions and zones, Google Cloud
- CAISI evaluation of DeepSeek AI models finds shortcomings and risks, National Institute of Standards and Technology
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Cloud Technical Guideline 2026, National Information Technology Development Agency
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.