How do you use AI without exposing confidential data?

For a law firm, a hospital, a bank or anyone holding privileged material, the blocking question is rarely whether AI would help. It is whether using it means handing confidential data to systems outside your control. It does not have to.

Run the model where the data lives

The strongest control is architectural: bring the model to the data instead of sending the data to a model. Open-weight models can run in your own cloud tenancy or on premises, and adapting them no longer needs a cluster — the QLoRA method, published at NeurIPS 2023, fine-tunes a 65-billion-parameter model on a single 48GB GPU. That puts private training and inference inside one machine your organisation owns, behind your own access controls, covered by your existing audits.

De-identify before anything is trained

Whatever the architecture, personal and sensitive fields should be found and masked as a standard step before data reaches training or retrieval — names, identifiers, free-text fields that hide both. This is pipeline work, not policy work: detection and de-identification run automatically, are logged, and are tested like any other component, so privacy does not depend on someone remembering.

Restrict retrieval to approved sources

Applications that answer from documents should retrieve only from a corpus you explicitly approved, and every answer should carry its sources so a reader can check where a statement came from. This is also where confidentiality boundaries are enforced: matter-level or patient-level access controls apply to the retrieval index just as they apply to the underlying documents, so the system can never surface a document to someone who could not have opened it directly.

Contain what leaves

If part of a workload does call an external model — sometimes the right trade — make the boundary explicit: strip identifying data before the call, log what crossed, and confine external calls to data classes your policy allows. The practical goal is a defensible answer to one question: for every piece of confidential data, where did it go, and who could see it there? An architecture that can answer that question is one your clients, your regulator and your own security team can accept.