Volume and data residency decide between a private LLM and a model API.

Ask where the data may go before asking the price.

Most comparisons start with the price per token. The first question below often settles the other two.

• Where the data may go. Call recordings, patient records and anything under a confidentiality clause usually cannot leave your tenancy, and then the shortlist is open-weight models on hardware you control.
• What a wrong answer costs. Multi-step reasoning over contracts is where the strongest hosted models still earn their premium. Classifying ten thousand short messages is not.
• The monthly cost at your real volume. Estimate it from your own numbers before you commit. A per-token price sounds small until it is multiplied.

The choice goes into the proposal in writing, with what happens if it proves wrong. Model choice is one of the few decisions in a build that can stay reversible, so design the system to keep it that way.

Paid model APIs do not train on your data by default.

That holds on the paid API terms of OpenAI, Anthropic and Google. No training still leaves retention, and neither term says where the data is processed. Read all three columns before you sign.

Free tiers and abuse-monitoring logs catch teams out.

A free tier is often governed by different terms from the paid one. A prototype built on the free tier may already have sent data somewhere the production system never would.

Abuse-monitoring retention means a copy exists for a while even with training off. For data you may not hand to anyone at all, that copy matters, and it is why zero-retention agreements exist.

In the systems we build, a hosted API runs only under terms with training disabled, and you approve that choice in writing before the build starts.

Does UAE data protection law stop us using a foreign API?

Not automatically. The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, covers the processing of personal data across the UAE, with exceptions. Free zones with their own data protection law, such as the DIFC and ADGM, sit outside it, and health, banking and credit data follow their own rules. The exclusion comes from the free zone's own law, so a free-zone address alone exempts nothing.

Articles 22 and 23 govern transfers of personal data outside the UAE. Broadly, a transfer may go to a country with adequate protection, or rely on a specific exception such as a contract that imposes the law's protections, or the data subject's consent. As of March 2026, according to Chambers and Partners, the implementing regulations had not been issued and the UAE Data Office was not yet fully operational, which leaves room for interpretation.

In practice, sending personal data to a model API that processes it outside the UAE is likely to count as a transfer out of the UAE, and so is hosting it in Germany. So our contracts name the hosting jurisdiction: Germany by default, the UAE on request, or your own servers. If you also serve people in the EU, the GDPR applies in its own right.

General information, not legal advice. Ask your own counsel about your case.

Is a self-hosted model cheaper than an API?

Only above a volume you can calculate. An API bill grows with tokens, while a self-hosted model is mostly a fixed cost, the same whether the GPU is busy or idle. Break-even sits where the two lines meet, and it moves every time a provider changes a price.

The worksheet below sets out the method. Fill it in with your own volumes.

At modest volume, the API costs less.

Line B is the one that catches people out. Anthropic notes that its models from Claude 4.7 onwards use a tokeniser that produces about 30% more tokens for the same text, so one document costs a different number of tokens on different models. Measure in every language you use.

An illustration, with list prices read on 23 September 2026. Ten thousand documents a month, at 3,000 input tokens and 500 output tokens each, comes to 30 million input tokens and 5 million output tokens. Both Anthropic and OpenAI discount batch work by 50%.

At this volume the API bill is smaller than the people cost of keeping a GPU server patched, monitored and evaluated, before any rent is counted. Three things change the picture: volume that grows by orders of magnitude, a narrow and steady task such as classification where a small model is good enough, and data that may not leave at all. In that last case, the only alternative to self-hosting is leaving the job undone.

For hardware in the EU, providers rent dedicated GPU servers by the month. Hetzner, for example, lists servers with a single NVIDIA RTX PRO card with 24 GB or 96 GB of GPU memory, in data centres in Germany and Finland. Put the current price in line E.

The quality gap shows on hard multi-step reasoning.

In our view, open-weight models still trail the strongest hosted models on hard multi-step reasoning. For retrieval, extraction and summarising, which is most of what a business asks of a model, they are comparable, and they can run with no internet connection at all.

Settle it with your own evaluation set rather than a leaderboard. Run both candidates several times per case and let the numbers decide. Our guide to evaluating an autonomous agent sets out how.

Often the answer is both, split by job:

Open-weight models are now measured on native Arabic tests.

The second version of the Open Arabic LLM Leaderboard, published in February 2025, removed machine-translated tasks because of their lower quality and possible cultural bias. It added native benchmarks, including an Arabic MMLU and ALRAGE, a test of Arabic retrieval-augmented generation.

Two open-weight families are built in the UAE with Arabic first. Falcon-H1 Arabic, from the Technology Innovation Institute in Abu Dhabi, was released on 5 January 2026 in 3, 7 and 34 billion parameter sizes, and TII reports it at the top of that leaderboard. Jais 2, from Inception, Cerebras and MBZUAI, was released in December 2025 in 8 and 70 billion parameter versions. Multilingual families such as Qwen3, whose open-weight models are published under the Apache 2.0 licence, are another common starting point.

A leaderboard measures performance on exams. Your contracts, invoices and customer messages are a different test, and Gulf dialect in a voice note differs from the Modern Standard Arabic of a textbook. Put a hundred of your own Arabic cases in the evaluation set before choosing.

Licences are part of the cost.

Open-weight licences differ, and some are not open source at all. The Llama 3.1 Community License requires any company whose products had more than 700 million monthly active users on the release date to ask Meta for a separate licence. Qwen3's open-weight models use Apache 2.0. Read the licence, and any use policy it points to, before a model goes into a product you sell.

Start on an API and build for a later move in-house.

The move stays cheap if the system is built for it from the first week, with four things in place:

• A provider-neutral interface in your code, so the model is a setting rather than a rewrite.
• Prompts, retrieval settings and tools kept in your own repository rather than a vendor's console.
• An evaluation set that runs against any model, so the switch is a measured decision.
• Logs and audit trails in your own systems, so history does not stay behind with the provider.

With those in place, moving a job from an API to a self-hosted model is a test run and a configuration change. Without them it is a rebuild.

Each situation points to a default choice.

No model provider pays us or lists us as a partner, so the choice named in your proposal comes with our reason for it and no referral fee behind it.