The short answer
Most AI tools send your prompts to the provider's servers, and for Nigerian organisations those servers are almost always abroad. Business terms from the major providers exclude that data from model training, and several offer zero data retention, but the data is still processed by the provider. Private AI removes that step: an open-weight model runs on GPU servers that you control, on your own hardware, in a Nigerian data centre or in your own cloud account, and nothing is sent to an outside AI provider.
It is a real option because capable open-weight models are now freely available, including Meta's Llama, Alibaba's Qwen, DeepSeek, Z.ai's GLM, Mistral, Google's Gemma and OpenAI's gpt-oss. The trade-offs are that you run the platform yourself, you pay for servers whether they are busy or idle, and the leading commercial models are still ahead on the hardest tasks. Private AI makes most sense when information must stay on infrastructure you control or in Nigeria, or when usage is steady and high.
What "open-weight" means
A trained model is, in essence, a very large file of numbers called weights. When a developer publishes those weights, anyone can download the model and run it on their own hardware. That is an open-weight model.
Open-weight is not the same as open source. The Open Source Initiative's definition of open source AI also requires the training code and detailed information about the training data (Open Source Initiative). Many popular models publish their weights without all of that, and their licences vary:
- Permissive licences, such as Apache 2.0 and MIT, allow commercial use with few conditions.
- Custom licences may add conditions, such as acceptable use rules, attribution, or a separate agreement for large companies or businesses that host the model for others.
- Non-commercial licences do not allow business use without a separate agreement.
Licences can change between versions of the same family, so read the licence of the exact version you plan to use and have your legal adviser review anything unusual.
The main model families
| Family | Developer | What to know |
|---|---|---|
| Llama and Muse | Meta (United States) | Widely supported; most versions use custom licences with conditions, some smaller Muse models are Apache 2.0 |
| Qwen | Alibaba (China) | Many sizes, from small to very large; smaller versions are often Apache 2.0, the largest use custom licences |
| DeepSeek | DeepSeek (China) | MIT licence; the newest versions are very large and need multi-GPU servers |
| GLM | Z.ai, formerly Zhipu AI (China) | Among the leading open-weight families in 2026; some versions MIT, the flagship under a custom licence |
| Mistral | Mistral AI (France) | European developer; several models under Apache 2.0, some limited for large companies |
| Gemma | Google (United States) | Smaller models suited to modest hardware; Gemma 4 is Apache 2.0, earlier versions use Gemma terms |
| gpt-oss | OpenAI (United States) | Apache 2.0; OpenAI states the larger model runs on a single 80 GB GPU |
| Granite and Phi | IBM and Microsoft (United States) | Smaller models under Apache 2.0 and MIT |
Others, such as Moonshot AI's Kimi and MiniMax, use custom licences, some of them non-commercial. New versions appear every few months, so treat this as a map of the field, not a recommendation. The right model is the one that answers your questions well on hardware you can afford.
Where the model can run
| Option | What it looks like | Suits |
|---|---|---|
| GPU servers in your cloud account | GPU virtual machines from providers such as AWS, Microsoft Azure, Google Cloud or DigitalOcean, inside your own account and private network, in a region abroad | Most organisations that can rely on transfer safeguards: fast to start, easy to resize, can be stopped when idle |
| Dedicated or colocated GPU server | A physical GPU server rented from a provider, or your own server colocated in a Nigerian data centre, used only by you | Steady, heavy workloads that keep a server busy, and data that must stay in Nigeria |
| Your own hardware | GPU servers in your data centre or server room, with UPS and backup power | Strict policies, existing facilities, long-term steady use |
| Managed open models in your cloud | Open-weight models deployed through your cloud provider's AI platform, such as Amazon SageMaker AI, Microsoft Foundry or Google Cloud's Model Garden, inside your account | Organisations that want less to operate, within one cloud |
GPU capacity in and near Nigeria. There is no hyperscale cloud region in Nigeria, and GPU options close to home are limited (AWS, AWS, Google Cloud):
- AWS's Lagos Local Zone offers only entry-level NVIDIA T4-class GPU instances, which suit small models.
- AWS Cape Town also lists only T4-class GPUs, and Google Cloud's Johannesburg region lists none. No hyperscaler offers H100-class GPUs in Nigeria.
- Local data centres are adding capacity. Large AI-ready data centres are being commissioned in Lagos, where Kasi Cloud's LOS1 campus entered operational readiness in May 2026, and Cassava Technologies, which runs an NVIDIA AI factory in South Africa, has announced plans for Nigeria.
That leaves two realistic routes. To keep AI processing in Nigeria, run GPU servers on your premises or colocated in a Nigerian data centre, and start small, for example with a single GPU server, scaling as you grow. From 1 January 2027, NITDA's National Cloud Technical Guideline sets data-residency rules for federal public institutions and regulated-sector organisations based on how sensitive the data is (NITDA). Otherwise, use GPU servers abroad in your own cloud account, with transfer safeguards under the Nigeria Data Protection Act 2023 (NDPA) and a data protection impact assessment (DPIA). Cloud GPUs are usually billed in US dollars, so running costs move with the exchange rate. Managed services need the same care: some run only in certain regions, or route requests across regions by default. Amazon Bedrock's custom model import, for example, runs only in a few US and European regions.
What it takes besides the model
The model is only one part of a private AI platform:
- An inference server runs the model efficiently and handles many users at once. Engines such as vLLM and SGLang offer an OpenAI-compatible API (vLLM), and Ollama, popular for workstations, supports a subset of it, so many existing applications and tools can use your private endpoint instead of a public one. Compatible is not identical: chat formats and tool calling differ between models, so test each integration.
- A gateway adds sign-in through your identity provider, usage limits and logging under your own retention rules.
- Retrieval over your documents lets the model answer from your policies, files and records, with sources (see how AI assistants answer from your documents).
- Monitoring and updates keep the platform healthy and let you test and adopt better models as they appear.
How big a server do you need?
GPU memory is the main constraint. As a rule of thumb, the model's weights need about the number of parameters times the bytes per parameter: a model stored at 16-bit precision needs about two bytes per parameter, and quantised versions at 8 or 4 bits need roughly a half or a quarter of that. A 70-billion-parameter model, for example, needs about 140 GB at 16 bits, 70 GB at 8 bits and 35 GB at 4 bits for its weights alone. On top of the weights, the server needs memory for the conversations it is handling at once, which grows with the number of users and the length of documents, plus some working overhead.
Many large open-weight models use a mixture-of-experts design, which uses only part of the model for each word. That makes them faster, but memory still depends on the total number of parameters, not the active ones.
In practice:
- Small and mid-sized models can run on a single data-centre GPU, and the smallest on a workstation. They often handle document questions, summaries and extraction well. OpenAI, for example, states that the larger gpt-oss model runs on a single 80 GB GPU.
- The largest open-weight models need servers with several high-end GPUs and are usually only worth it for heavy, demanding workloads.
- Quantisation shrinks memory needs with a small loss of quality, which you should measure on your own questions.
Size for your peak use and response time target, and test before you buy or reserve hardware. For servers in Nigeria, plan power and cooling with the hardware: a GPU server draws far more than an ordinary one, so size your UPS, inverter and generator or solar capacity for it.
Security: treat models like software from the internet
- Download from the source. Security researchers have found malicious models uploaded to public model hubs, and Hugging Face warns that its own scanning is not foolproof (Hugging Face). Use the developer's official repository, check the publisher's name carefully, and record the exact version and file hashes you deploy.
- Use safetensors. Older model files based on Python's pickle format can run code when they load; the safetensors format stores only the model's numbers. Avoid options that run code shipped with a model unless you have reviewed it.
- Keep the endpoint private. No public internet access, sign-in required, only approved applications allowed, and no outbound internet access for the model server where possible.
- Test like any AI application. Private models are still vulnerable to prompt injection and can still leak information between users if permissions are not enforced.
"Is it safe to run a Chinese model?"
Three separate questions are often mixed up:
- Where your data goes. A self-hosted model runs entirely on your servers and does not send prompts to its developer, whichever country the developer is in. Using the developer's own app or API is different: then your data goes to the developer's service under its terms and laws.
- Whether your policies allow it. We are not aware of any Nigerian rule specific to DeepSeek or other Chinese-developed models. Some foreign governments have restricted the DeepSeek app on official devices, and public bodies, their suppliers, international clients and funders may have their own rules about which developers' models can be used, so check your own policies and your clients' requirements before you choose.
- How the model behaves. Models can reflect the views or restrictions of their training, and robustness varies. A 2025 evaluation by the US National Institute of Standards and Technology found DeepSeek agents far more likely than leading US models to follow malicious instructions (NIST). Test any model on your own security scenarios and on topics that matter to you, and choose another family if in doubt. There are strong options from several countries, including the United States and France.
When private AI is worth it
- Policies, clients or regulators do not allow confidential or personal information to go to an outside AI provider or abroad
- Business terms with zero data retention would not satisfy your data protection officer or your clients
- You can name the tasks the model must do, and test candidates on real questions
- Usage will be steady enough to keep a server reasonably busy, or privacy justifies the cost anyway
- Someone, your team or a partner, will patch, monitor and update the platform
- You know where the servers will run, in Nigeria if the data must stay here, and that GPU capacity and reliable power are available there
If most boxes are ticked, a private model deserves a proof of concept. If few are, a business AI service with strong terms is probably the better start. Our comparison of self-hosted models and AI services goes through the decision in detail.
When to bring in help
Running a small model on a workstation to learn is easy and worthwhile. Bring in help when the model will see confidential or personal information, when many people will rely on it, or when you need to show clients, auditors or regulators how it is controlled. The NDPA still applies to personal data used in a private AI system, and the NDPC's GAID 2025 expects organisations deploying AI on personal data to carry out a DPIA and document their technical and organisational safeguards, including how cross-border data flows are handled (NDPC). Neither requires self-hosting, but a private deployment in Nigeria reduces how much data has to cross borders and gives you direct control over each of those safeguards. Our guide to AI and the NDPA sets out the rules. This is general information, not legal advice.
Our private AI and self-hosted models service shortlists and tests models on your own questions, designs and secures the hosting, connects the model to your documents and systems, and can run the platform for you after launch.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- The Open Source AI Definition 1.0, Open Source Initiative
- Online serving (OpenAI-compatible server), vLLM documentation
- Pickle scanning, Hugging Face
- AWS Local Zones features, Amazon Web Services
- Amazon EC2 instance types by Region, Amazon Web Services
- GPU regions and zones, Google Cloud
- CAISI evaluation of DeepSeek AI models finds shortcomings and risks, National Institute of Standards and Technology
- General Application and Implementation Directive (GAID) 2025, Nigeria Data Protection Commission
- National Cloud Technical Guideline 2026, National Information Technology Development Agency
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.