The Price of Keeping Your Data to Yourself Is Falling
Matt Genovese
Founder & Product Strategy Lead
Back to Blog
Open models haven’t caught the frontier, but they’re a few months behind rather than a few years, and they run on hardware you control. For the large share of enterprise work that never needed frontier capability, that changes what keeping your data in-house actually costs.
Most technology leaders I talk with can name three AI vendors without pausing; Anthropic, OpenAI, and Google have earned that recall. Detroit had a Big Three as well, and the interesting part of that story was never that the incumbents stumbled, it was how long buyers went without seriously considering anything else.
Ask whether they’ve evaluated anything outside those three and the answer tends to be some version of “the open ones aren’t as good,” which was a perfectly reasonable position to hold, and is the sort that quietly expires while you’re busy shipping.
I won’t argue that open models have caught the frontier, because as best I can tell they haven’t. What I’d push back on is the leap from “not as good” to “not worth evaluating.” They run a few months behind, not a few years, and for a great deal of ordinary enterprise work, classification, extraction, summarization, routing, drafting, the frontier ceiling stopped being the binding constraint some time ago. Good enough is a real category, and most of what a business does all day lives inside it.
Epoch AI puts the distance between the best open-weight models and the best closed ones at roughly four months, where it has sat since January. That figure attracts most of the argument, and it’s the wrong one to watch, because very few enterprises choose between open and frontier on raw capability alone. The narrower question is what you can run inside your own security boundary, and how far behind that sits.
Epoch measures that separately, and it’s the more interesting number. Models small enough to run on a single consumer-grade graphics card are gaining capability roughly half again as fast as the frontier is gaining it.
The thing you can own is getting better faster than the thing you rent.
Qwen 3.8-27B arrived in mid-August scoring 52 on the Artificial Analysis intelligence index, within a point of models that companies are currently paying frontier prices to reach. It serves at roughly 200 tokens per second on a single workstation GPU with a 262,000 token context window, and ships under plain Apache 2.0, no revenue triggers, no agreement to negotiate. (Its 2.4 trillion parameter sibling would like you to call Alibaba’s lawyers first.) The same checkpoint runs on hardware you own, on rented GPUs, or in the AWS or Azure footprint you already have, identical in all three.
A model you can hold can also be pinned, tested, and rolled back; commercial models can change underneath you.
I don’t expect “data sovereignty” to show up on many priority lists, partly because it’s the sort of phrase that sounds like somebody else’s problem, and partly because from inside the US it reads as a European concern (a reading that has aged badly as sentiment abroad has shifted). Data security, however, is on everyone’s list. Strip the term away and what’s underneath is concrete: which of your data leaves your boundary, who holds it once it does, what their breach history looks like, and how much of your legal team’s year you’d care to spend on the question. Every workflow you route to an external model quietly answers it, usually on the say-so of whoever wired up the integration.
None of which means you should stop using commercial models. The architecture worth arguing for is a mixed one, sending work that carries no sensitive data to whichever frontier model handles it best and keeping anything touching regulated data or PII inside a boundary you control, which buys you the frontier’s ceiling and the containment of a model you hold. The point is that this is now a decision worth genuinely making, rather than one you can safely defer. In our experience it belongs in requirements, before engineering settles it by picking whichever API had the friendliest documentation.
Matt leads Planorama Design, a product acceleration firm for enterprise software teams. With nearly 30 years of engineering experience, he helps CTOs and VPs of Engineering structure requirements, validate AI feasibility, and ship better software faster.
Open AI models stall in enterprises not because of performance gaps, but because organizations lack the requirements and governance to adopt them.
Most enterprise AI governance frameworks describe the goal without specifying the work. Here’s what it actually takes.