The new question: what runs where and who is allowed to start it

Three years ago, meetings were about whether to use AI or not. Today nobody asks that question any more, because everyone knows the answer and it is the same. But “we use AI” is about as useful a piece of information as “we use the internet” — nothing follows from it.

The question that actually decides something has two halves.

The first half: where it runs

For every task you entrust to AI, there are three possibilities for where the data will travel:

On your machine. The model runs on your Mac, laptop or a box at home. The text never leaves the network. You pay in electricity and waiting. The quality is sufficient for ordinary tasks and lags behind on the hardest ones.

At the model provider. The data flies off to OpenAI, Anthropic, Google or another vendor. You get the best quality and the fastest response, and you pay per request. The data is with someone else — under terms you have to read.

At the application vendor. The least conspicuous and most common option. You use a tool that has AI built in. The data goes first to the application vendor, who sends it on to the model. So you have two intermediaries, not one — and usually a contract only with the first.

This third case is the one people underestimate most. Meeting minutes uploaded to a transcription tool have passed through two companies before you have read the first sentence.

The second half: who is allowed to start it

The second axis is about authorisation. Here, too, there are three levels:

That third level is the turning point. As long as someone is sitting there, a human is the last safeguard. Once a task is started by an event — an email arrived, a file changed, a ticket was opened — “someone will notice anyway” stops being true.

Four quadrants in which almost everything gets decided

When you cross those two axes and simplify them to two levels (sensitive data yes/no, irreversible action yes/no), you get a grid that answers for you.

Most people have ninety per cent of their work in the fourth quadrant and are afraid to let anything run there, because they confuse it with the first. And the other way round: the first quadrant gets into automation by mistake, because “it's only an email, after all”.

The practical test for irreversibility is simple. Ask: what will it cost me to take it back? A draft you delete costs nothing. An email that has gone out costs an apology. A payment costs money. Sensitive data that has been published cannot be taken back at all.

Why local AI is coming back right now

It has to do with precisely this division. The second quadrant — sensitive data, reversible action — is the largest, the most useful and the hardest to solve with the cloud. A transcript of an internal meeting, a summary of a contract, sorting mail, searching your own notes: all of it work where a model is useful and where at the same time the data is something you do not want to hand out.

This is exactly the gap local models are returning to fill. They do not have to be the best in the world. They have to be good enough for this particular task — and be at your place.

And then there is a third reason, added this year: who is allowed to start it has become a regulatory question. Since 2 August 2026 the transparency rules under the AI Act have applied in the EU — whoever operates an AI chatbot facing the public has to disclose it, and whoever publishes deepfake content has to label it. In Czechia, supervision is led by the Czech Telecommunication Office. It is not the whole AI Act, but it shows the direction: the question is not whether you use AI, but where, for what and on whose responsibility.

How to write it up on one page

When you come to answer this for yourself or for your team, a four-column table is enough. Take your five most frequent tasks and fill in:

This table is your entire AI strategy. If not a single row in it holds up, technology is not to blame.

What to watch out for

The last column is the one that matters most — and also the one most often filled in optimistically. Write into it what the tool can do, not what you expect of it. If an agent has access to sending mail, the entry is “can send an email”, even if you told it not to. A model has no reliable boundary between data and commands: text that arrives from outside can tell it what to do, and it will do it with your permissions. That is the “lethal trifecta” the last track of the series talks about.

The next track is practical: we will run our first model at home. In an hour, without an account and without a card.