Private AI Must Deliver Measurable Business Results

Artificial intelligence is moving deeper into business operations, but control over company data is becoming as important as the capabilities of the models themselves. Businesses must decide which applications warrant a private or dedicated environment and which can be handled through standard public cloud services. “The decision is not driven by the size of the company but by the kind of data the AI works with,” as Tibor Pakozdi, founder and CEO of AI.hr, points out for ICTbusiness Media - ICTbusiness.biz. Protecting regulated and contractually confidential information matters particularly when that information represents a competitive advantage. Pakozdi argues that private AI does not necessarily require new infrastructure or a separate technology stack. Instead, AI applications should work with existing databases, business systems and established access permissions.

Management teams also need a reliable way to assess the economic case before committing to an AI project. Rather than launching broad initiatives, companies should prioritize recurring processes with outcomes they can measure. Reliability demands testing on real tasks, continuous monitoring of answer quality and mandatory human review of consequential decisions. Smaller AI models could lower adoption costs, while AI agents will increasingly perform actual steps inside business applications. In this interview, Pakozdi explains how companies can combine data protection, commercial value and accountable AI deployment.

Private AI is increasingly presented as a way to keep control over data and models. For which organizations is it a real business need, and when are public cloud services the more rational choice? Which requirements around sensitive data, regulatory compliance and ownership of knowledge decide the choice? What are the trade-offs of the private approach in cost, performance, maintenance and speed of development?

By private AI we mean the following: data stays in an environment the company controls, the application respects the access rights that already exist, and the model is used under terms the company itself has contracted. That environment can be the company's own data center, but equally a dedicated space with a cloud provider inside the European Union. This is exactly how we work at AI.hr: we build AI applications inside the client's infrastructure, connected to the systems and models the client already uses.

The decision is not driven by the size of the company but by the kind of data the AI works with. The private approach is the natural choice in three cases. When the data is regulated: personal, health and financial data. When it is protected by contract: customer documentation or defense programs. And when it represents a competitive advantage: technical processes, costings and quotations. The same applies when the AI accesses internal systems, such as an ERP or a maintenance system. For general productivity, marketing content and work with publicly available information, the standard business plans of the leading AI models, such as ChatGPT or Copilot, are entirely sufficient and there is no need to replace them.

The best result comes from a combination. The application and the data stay with the client, and the model is the one the client already has a contract for or runs itself, depending on how sensitive the data is. The company keeps both control and speed of development, without new infrastructure costs. Ownership matters just as much: in our projects the code, the documentation and everything that is built belong to the client. The company gains lasting value and does not depend on a vendor.

How would you advise a management board that wants to launch its first serious AI project but has no reliable way to assess whether it is economically justified? Which metrics need to be defined before the project starts so that the return on investment can be proven? Which costs are most often overlooked: data preparation, infrastructure, integration, monitoring or maintenance?

I would advise the board to choose, for its first project, a process whose impact can be measured. The business case is best proven on one concrete process that repeats often, for which data exists, and for which someone on the business side is accountable and wants to improve it. In manufacturing that is often the handling of customer enquiries and the preparation of quotations; in construction, the comparison of subcontractor bids against the contract. These are processes where the result shows within the first weeks.

The metrics are set before the project starts. First, the current state is recorded: how long it takes to process one case, how many cases are processed per month and what share contains errors. Then the target state after rollout is defined, together with the method of measurement: who measures, on which sample and over which period. Once those figures are known, the return on investment can be proven in numbers. That is exactly why our projects begin with a short assessment together with the client's own experts, the people who know the process best. At the end of the assessment the board receives a prioritized list of possible applications and an agreed measure of success, so the decision is made on concrete data.

As for costs, infrastructure and the model are usually the smaller part of the bill. Most of the value lies in data preparation, integration with existing systems, aligning access rights and maintenance after delivery, because processes and documents change. We include those items in the assessment from day one and work with a scope and price agreed in advance. The board gets a clear framework: a known cost, a known timeline and a known result.

How can a private AI environment be built that protects business data without becoming yet another isolated system? How do you solve integration with existing databases, applications and access permissions? Who should be responsible for the quality of the data, the models and the answers the system gives?

The answer is to build inside existing systems, not next to them. The application reads data where it already is, in existing databases, document systems and business applications, and the user signs in with the same account they use for everything else. There is no copying of data to a new location and no new rules for anyone to maintain. Private AI is part of the company from day one, not another separate system.

The most important part is how access is governed. Instead of separate rules for each application, access is governed by a single set of company-wide rules: who may see which kind of data, by role, department and level of confidentiality. Those rules apply equally to every application, so an employee sees through the AI exactly what they would see without it, and each new application is rolled out faster than the last. Privacy and speed of development go together.

Responsibility must be clearly divided, because that is what produces results. The department that works with the data is responsible for its quality, since the people who run the process know which document is current. The team that develops and maintains the application and the model is responsible for their technical soundness. The owner of the process is responsible for the answers that feed into business decisions, with a clear rule on when a person checks the answer. When those roles are agreed at the start, the project goes into regular operation and stays there.

The reliability of AI systems is often judged by user impression rather than by measurable criteria. How, in practice, do you test and monitor models before and after they go into production?  How do you track errors, hallucinations, changes in quality and attempts at unauthorized access?  For which kinds of decisions must human review remain mandatory?

Reliability is measurable. Before going into production we test the application on a set of real questions and tasks with known correct answers, compiled by the client's experts. An accuracy threshold the application must reach before going live is agreed in advance. The same test is repeated with every change to the model, the documents or the application itself, so the client always knows the quality it is getting.

After rollout, everything is verifiable. Every answer cites its source, the document and the page, so checking it takes a few seconds. All questions, answers and sources used are logged, a sample of answers is reviewed regularly, and users give feedback directly in the application. Quality is tracked on data over time, not on impression. The same applies to security: every access to data is logged, an attempt to reach data outside the user's permissions triggers an alert, and the application is protected against attempts to steer its behavior through instructions hidden in documents or prompts.

Human review remains for decisions with financial, contractual, legal or safety consequences, for decisions about people, such as hiring and performance evaluation, and for communication with customers and regulators. In those cases the AI prepares a proposal with sources, and a person decides faster and with better insight than before.

How do you expect the private AI market to change over the next five years, particularly with the development of smaller models and AI agents? Will more affordable infrastructure open up space for small and medium-sized enterprises, or will large organizations keep the advantage? Which technological and organizational prerequisites should Croatian companies build now?

I expect two major changes, and both favor companies. The first is smaller models. For most well-defined business tasks, such as classifying documents, extracting data or answering questions from internal documentation, smaller models are already good enough and run on modest hardware, inside the company itself. Private AI becomes available to every company, without a large budget. The second is AI agents, systems that not only answer but carry out steps in business applications themselves. Here the benefit multiplies, and companies that already have their permissions, audit trails and approval rules in order will be the first to take advantage of them.

More affordable infrastructure opens up space precisely for small and medium-sized enterprises. The advantage rests less and less on computing power and more and more on well-organized data, clearly described processes and speed of decision-making. Smaller companies have the edge here because they decide faster. For the Croatian economy, where such companies predominate, this is a real opportunity.

Preparation consists of a few concrete steps, on the technical and the organizational level. On the technical side: digitized and well-organized data with a known owner, one place where user accounts and access rights are managed, and a basic record of who accessed what. On the organizational side: clearly assigned responsibility for every important process, the habit of measuring before and after a change, internal rules on the use of AI, and employees who can judge whether a model's answer is correct. Companies that lay these foundations now will be ready for every next generation of the technology. At AI.hr we help them take that first step today.