Internal AI without a US cloud: realistic in 2026?
Published · updated
The question comes up in almost every conversation with a management team: “we’d like to use AI, but we can’t send our files to OpenAI.” It’s a fair question: the US CLOUD Act may let US authorities demand data a provider controls inside their jurisdiction, even when the data sits in a Swiss data centre. The scope, and the ways to challenge a demand, depend on the case. The honest answer in 2026 is no longer “impossible”. It has turned into a question of assembly: which model for which task, and where to run it.
The recent changes
Three things have changed. The open-weight models have become credible for bounded tasks: you can test Kimi K2.6, Qwen3.5 and several Mistral models against the proprietary services on your own evaluation set.
Switzerland also published Apertus (EPFL, ETH Zurich and CSCS), one of the few large models designed to publish its weights and its code, plus real information about its training data.
Swiss hosting has matured too: Infomaniak serves these models from Geneva behind an OpenAI-compatible API and publishes a commitment not to train on your requests; Swisscom and Exoscale add other options. Those properties still have to appear in the contract you sign.
And the legal frame stays sectoral: the revised FADP, statutory secrecy, employment law, intellectual property and the industry rules already apply, with no need to wait for a general AI statute.
That Swiss legal position does not settle whether the EU AI Act reaches a particular cross-border use. Four questions for a Swiss company separate the company’s role, the EU connection, the effect on people and the evidence needed before production.
Apertus: an openness argument, with limits
I don’t put Apertus forward for raw capability. I propose it when the traceability of the model matters more than the score.
Apertus isn’t only a capability proposition. Its documentation and its openness are part of what it’s worth, and so is its Swiss language coverage, Swiss German and Romansh included. That matters to an administration or a school that wants to inspect its technology chain. In one specific deployment, Liip measured 82% acceptable answers after eight months on a Zurich municipal assistant. That figure belongs to Liip’s questions and Liip’s configuration, at Liip’s own acceptance threshold; it isn’t a general benchmark. French, reasoning, long tasks: all of that has to be tested on your own material. Apertus can also be adapted locally, but it isn’t automatically the best base to fine-tune for every use.
Adding capability where it is needed
For demanding reasoning, Kimi K2.6 is one candidate; it’s too large for a small installation and available in some hosted catalogues. The origin of the weights and the location of the data centre aren’t the whole analysis. A downloaded model still depends on a runtime, libraries, logs, telemetry and a channel for administration. A Chinese model served in Geneva may reduce some risks next to a US API. But the operator, the contract, the subprocessors, the keys, the administrative access, the licence and the update chain still need review.
| Need | Candidates to test as at 14 August 2026 | Deployment conditions |
|---|---|---|
| Document assistant with sources | Apertus 70B or another qualified model | Approved service or hardware sized for precision, context and concurrency |
| Extraction, classification and standard replies | Apertus 8B, Qwen3.5 or a suitable Mistral model | Internal benchmark; memory includes weights, runtime and context cache |
| Complex reasoning and agents | Kimi K2.6 or a qualified frontier model | Approved API or cluster, constrained tools, human approval and logs |
| Confidential code | Devstral Small 2 or another code model | Memory depends on quantisation and context; repositories, secrets and tools remain isolated |
The uses that work, and the ones that do not yet
At the scale of a company of 10 to 100 people, three uses are good candidates for a measured pilot: finding information in internal documents with sources; transcribing and summarising meetings under the applicable rules; and extracting fields or classifying forms. How mature each use is depends on the quality you require, the language, the controls and the cost of an error. Even a well-designed open stack may trail the latest proprietary models on some tasks. And no model can make up for disordered data.
The sovereign stack, layer by layer
- Hosting: a server on your premises for the most sensitive; Infomaniak, Exoscale or Swisscom for the rest
- Inference: vLLM to serve a team, Ollama for a workstation
- Models: choose by testing rather than by nationality. Mistral’s selection guide describes Small 4 as 119B total / 6.5B active parameters; calling it suitable for a “modest GPU” without assumptions on quantisation, context and concurrency would be misleading
- Voice: Voxtral or Whisper, transcribed locally
- Document memory: PostgreSQL with pgvector, or Qdrant, on the same infrastructure
- The interface: Open WebUI or a house interface, on your domain
Sovereignty here isn’t a slogan, and it isn’t a server address either. Assess who you contract with, which jurisdictions apply, where the processing runs, who the subprocessors are, who can reach the support access and the keys, what telemetry leaves, what the licence says, how updates arrive, which formats you hold and whether the exit has been tested. A modular stack makes replacement easier. But it guarantees portability only when you have tested the replacement.
A method that ages better than a model list
For every use case, keep a representative evaluation set, a measure of quality and error, a confidentiality class, a latency target, the context size, the number of concurrent users, the licence, the operator, the total cost and a fallback procedure. Run the test again before you change a model, and at least quarterly for the catalogues that move fast.
The date on this catalogue
- Apertus 70B model card
- Mistral model-selection guide
- Mistral Devstral Small 2 model card
- Federal report on the CLOUD Act
I took the catalogue and the properties on 14 August 2026. Models, offers, licences, prices and capabilities change from one month to the next. The table identifies candidates, not a universal benchmark result or a legal guarantee.