My standard reply to such comments over the past year has been the same: you probably want to use Azure instead. A big part of the business value they provide is ensuring regulatory compliance.

There are multinational corporations with heavy presence in Europe, that run their whole business on Microsoft cloud, including keeping and processing there privacy-sensitive data, business-critical data and medical data, and yes, that includes using some of this data with LLMs - hosted on Azure. Companies of this size cannot ignore regulatory compliance and hope no one notices. This only works because MS figured out how to keep it compliant.

Point being, if there are business consequences, you'll be better off using Azure-hosted LLMs than running a local model yourself - they're just better than you or me at this. The only question is, whether you can afford it.

I don't think Azure is the legal panacea you think it is for regulated industries outside of the U.S.

Microsoft v. United States (https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...) showed the government wants, and was willing to do whatever required, access to data held in the E.U. The passing of the CLOUD Act (https://en.wikipedia.org/wiki/CLOUD_Act) basically codified it in to law.

It might not be ultimately, but it still seems to be seen as such, as best I can tell, based on recent corporate experience and some early but very fresh research and conversations with legal/compliance on the topic of cloud and AI processing of medical data in Europe. Azure seems to be seen as a safe bet.

Compliant with EU consumer data regulations != panacea

No, Azure is not gonna save you. The problem is that the US is a country in legal disarray, and they also pretend that their laws should be applied everywhere in the world. I feel that any US company can become a liability anywhere in the world. The Chinese are now feeling this better than anyone else, but the Europeans will also reach the same conclusion.

The US forces their laws everywhere and it needs to end. Everywhere we go, the fintech industry is really fed up with the US AML rules which are just blackmail: if your bank does not comply, America will mess you up financially. Maybe a lot more should just pull out and make people realise others can play this game. But that needs a USD collapse, otherwise it cannot work and I don't see that happening soon.

AML and KYC are good things for almost everyone except criminals and the people who have to implement them.

Agree, and for the people who implement them -- yes, it's hard, it's annoying but presumably a well-paid job. And for the (somewhat established or well-financed) companies it's also a bit of a welcome moat I guess.

Most regulation has the unfortunate side effect of protecting incumbents. I'm pretty sure the solution to this is not removing the regulations!

and the people who have to open a bank account and get some ai denying them even they never did anything. or having their account blocked because something triggered and then have to fax over 10 documents to prove stuff the bank already has known always as the person has been with the bank for the past 40 years etc.

sure, theoretically kyc and aml are good, the implementations all suck.

LoL, every boardroom in Europe is filled with talk of moving out of Microsoft. Not just Azure, Microsoft.

Of course, it could be just all talk, like all general European globalist talks, and Europe will do a 360 once a more friendly party takes over the US.

Europe has seen this song and dance before. We’re not so sure there will ever be a more friendly party.

You probably mean a 180 (or could call it a "365" to make a different kind of joke).

It's a joke. The previous German Foreign Minister Baerbock has used 360° when she meant 180°, which became sort of a meme.

It's been a meme for longer than that. The joke to bait people 20 years ago was "Why do they call it an Xbox 360? Because when you see it you turn 360 degrees and walk away"

The problem is that the EU regulatory environment makes it impossible to build a homegrown competitor. So it will always be talk.

It seems that one side of the EU wants to ensure there is no competitors to US big tech and the other wants to work towards independence from US big tech. Both seem to use the privacy cudgel, require so much regulation that only US tech can hope to comply so nobody else competes with them, alternatively make it so nobody can comply, we just use fax machines again instead of the cloud?

Just hyperbole, but it seems the regulations are designed with the big cloud providers in mind, but then why don't they just ban US big tech and roll out the regulations more slowly? This neoliberalism makes everything so unnecessarily complicated.

It would be interesting to see the hypothetical "return to fax machines" scenario.

If Solows paradox is true and not the result of bad measurement, then one might expect that it could be workable without sacrificing much productivity. Certainly abandoning the cloud would be possible if the regulatory environment allowed for rapid development of alternative non-cloud solutions, as I really don't think the cloud improved productivity (besides for software developers in certain cases) and is more of a rent seeking mechanism (hot take on hacker news I'm sure, but look at any big corpo IT dept outside the tech industry and I think you will see tons of instances where modern tech like the cloud is causing more problems than it's worth productivity-wise).

Computers in general I am much less sure of and lean towards mismeasurement hypothesis. I suspect any "return to 1950" project would render a company economically less competitive (except in certain high end items) and so the EU would really need to lean on Linux hard and invest massively in domestic hardware (not a small task as the US is finding out) in order to escape the clutches of the US and/or China.

I don't think they have the political will to do it, but I would love it if they tried and proved naysayers wrong.

Businesses in Trump's America can pinky-swear that they won't peek at your data to maintain "compliance" all they want. The fact is that this promise is not worth the paper it's (not) printed on, at least currently.

Same for America under a democratic presidency. There is really no difference regarding trust in "promises".

You're just moving the same problem from OpenAI to Microsoft.

Regulatory compliance means nothing when the US regulations means they must give access to everything to intelligence services.

The European Court of Justice ruled at least twice that it doesn't matter what kind of contract they give you, and what kind of bilateral agreement there are between the US and the EU, as long as the US have the patriot act and later regulations, using Microsoft means it's violating European privacy laws.

How does that make sense if most EU corporations are using MS/Azure cloud/office/sharepoint solutions for everything? Are they just all in violation or what?

> Are they just all in violation or what?

Yes, and that's why the European Commission keeps being pushed back by the Court of Justice of the EU (the Safe Harbor was ruled out, Privacy Shield as well, and it's likely a matter of time before the CJEU kills the Data Privacy Framework as well), but when it takes 3-4 years to get a ruling and then the Commission can just make a new (illegal) framework that will last for a couple years, the violation can carry on indefinitely.

> you'll be better off using Azure-hosted LLMs than running a local model yourself - they're just better than you or me at this.

This is learned helplessness and it’s only true if you don’t put any effort into building that expertise.

You mean become a lawyer specializing in regulations governing data protection, computing systems in AI, both EU-wide and at national level across all Europe, and with good understanding of relevant international treaties?

You're right, I should get right to it. Plenty of time for it after work, especially if I cut down HN time.

None of that is relevant for on-prem.

My point is, on-prem makes no sense for a business that's not doing R&D on the models themselves, and that's even more true - not less - if that business is processing sensitive data with AI.

I've been poking around the medical / ehr LLM space and gently asking people how they're preserving privacy and everyone appears to be just shipping data to cloud providers based solely on a BAA. Kinda baffling to me, my first step would be to set up local models even if they're not as good, data breaches are expensive.

Same, and I've just sent an email up the chain to our exec saying 'hey remember those trials we're running and the promises the vendors have made? Here is why they basically can't be held to that anymore. This is a risk we highlighted at the start'

that is an excellent way to effect change and I’m certain they’ll feel you’re being productive

How should I be reading your comment?

Telling someone “I told you so” doesn’t move things forward. Suggest what to do next and leave the rest out.

You know I didn't actually just copy and paste an email in to hacker news right? An off the cuff comment on a forum isn't reflective of people's communication styles in a formal context.

I'm quite uninterested in your 'advice' which comes from a place of ignorance regarding my relationship with the project, the company and the people.

Even Ollama + a 2K gaming computer (Nvidia) gets you most of the way there.

Technically you could probably just run it on EC2, but then you’d still need HIPPA compliance

And ironically because OpenAI is actually ClosedAI, the best self-hostable model available currently is a Chinese model.

Mistral AI is French, and it's pretty good.

https://en.wikipedia.org/wiki/Mistral_AI

I use Mistral often. But Deepseek is still a much better model than Mistral's best open source model.

Perhaps except for coding? I find Mistral's codestral running on Ollama to be very good, and more practical for coding that running a distilled Deepseek R1 model.

Oh definitely, Mistral Code beats Deepseek for coding tasks. But for thinking tasks, Deepseek R1 is much better than all the self-hostable Mistral models. I don't bother with distilled - it's mostly useless, ChatGPT 3.5 level, if not worse.

*best with the exception of topics like tiananmen square

As far as I remember the model itself is not censored it’s just on their chat interface. My experience was that it wrote about it but then just before finishing deleted what it wrote

I haven't tried the full model, but I did try one of the distilled ones on my laptop, and it refused to talk about tiananmen square or other topics the CCP didn't want it to discuss.

Can confirm the model itself has no trouble talking about contentious issues in China.

It is somewhat censored, but when you're running models locally and you're in full control of the generation, it's trivial to work around this kind of stuff (just start the response with whatever tokens you want and let it complete; "Yes sir! Right away, sir!" works quite nicely).

What percentage of your LLM use is talking about Tiananmen Square?

Well, for that one, it was a pretty high percentage. I asked it three or four questions like that and then decided I didn't trust it and deleted the model.

The only open part is your chat logs.

Yeah its an awkward position, as self-hosting is going to be insanely expensive unless you have a substantial userbase to amortize the costs over. At least for a model comparable to GPT-4o or deepseek.

But at least if you use an API in the same region as your customers, court order shenanigans won't get you caught between different jurisdictions.

Ideally smaller models will get better.

For most tasks I don't need the best model in existence, I just need good enough. A small law firm using LLMs for summaries can probably do it on prem and hire a smart college student to setup a PC to do it.

The problem is that's still more difficult ( let's say our hypothetical junior IT only makes 60k a year) than just sending all your private business information to some 3rd party API. You can then act shocked and concerned when your 3rd party leaks the data.