Owned intelligence, governed from the first call.

Guide

Rent or Own: How to Decide Where Each AI Workload Runs [2026]

Craig Alberino · · 11 min read
Rent or Own: How to Decide Where Each AI Workload Runs

Renting intelligence means calling a model that runs in a provider's cloud, through its API, on the provider's terms. Owning it means running a model, usually an open-weight one, on hardware or cloud accounts the enterprise controls. The choice is made workload by workload, on four facts: the data the workload touches, the capability it needs, what it costs at volume and how long it has to stay stable. An enterprise can do both, and govern both under one policy and one record.

A summary of customer records, an analysis of public filings and a classification job that runs all day have different data, different risks and different economics, and each can land in a different place.

This guide covers what renting and owning each involve, the five questions that decide where a workload runs, what owning a model takes beyond hosting it, and how to keep the decision reversible. It is part of the series on the hybrid AI estate.

Regulatory references verified as of October 28, 2026.

What renting and owning each involve

A rented model is a service. The provider runs it, versions it, prices it per token and retires it on its own schedule. Prompts and responses travel to the provider's cloud under the contract and the provider's data terms.

An owned model is software the enterprise operates. The weights come from a lab or a vendor under a license, and they run on infrastructure the enterprise controls. The enterprise decides when the version changes, where the data goes and who may call it. It also takes on capacity, patching, monitoring and the security of the serving stack. vLLM's security documentation, on its API key authentication, says "Additional security measures are required for production deployments."

A rented model is a third-party relationship. The third-party risk guide covers what to ask each provider. An owned model is a component with an upstream supply chain. NIST's Generative AI Profile names that risk directly: "GAI value chains involve many third-party components such as procured datasets, pre-trained models, and software libraries."

Five questions that decide where a workload runs

1. What data does the workload touch?

Start with the data classes the workload reads and writes. Provider data terms are now explicit, and they still define a path out of the enterprise. OpenAI's platform documentation states that "data sent to the OpenAI API is not used to train or improve OpenAI models" as of March 1, 2023, and that abuse monitoring logs are "retained for up to 30 days" by default. Anthropic states that by default it will not use inputs or outputs from its commercial products for training, and that for API users it deletes inputs and outputs "within 30 days of receipt or generation," with listed exceptions. Both offer zero data retention to eligible customers: OpenAI after its approval, Anthropic by arrangement with its sales team.

Those terms govern what the provider does with the data. The data still leaves the enterprise. A workload whose data may not leave the enterprise under contract, regulation or internal policy belongs on an owned model, or needs the sensitive fields removed before the call. A workload on public or low-sensitivity data can go to a rented model under the policy that allows it.

2. How much capability does the workload need?

Open-weight models trail the closed frontier, and the gap is measurable. Epoch AI reported in May 2026 that "the most capable open-weight models have lagged frontier closed models by an average of four months" on its Capabilities Index. On cyber-relevant tasks, Epoch's October 2026 analysis puts the lag at six to seven months.

For many workloads the lag does not matter. Our June analysis of Mythos, Daybreak and the system around the model put it this way: "On narrow, well-defined tasks with a clear evaluation rubric, a routed ensemble of specialized small models with strong context and tool layers can match or beat a single frontier call." The same piece found where that breaks down: "the long-horizon, open-ended problem."

3. What does the workload cost at volume?

Rented and owned models are priced in different units. A rented model costs per token, and those prices fall fast. Epoch AI found in March 2025 that the price of reaching a given performance level fell between 9x and 900x per year, depending on the task. An owned model costs capacity: hardware or reserved cloud instances, the people who run the serving stack, and the evaluation work every new version needs.

A workload that runs all day at a steady rate on a narrow task can fill owned capacity. A spiky or occasional workload rarely can. Compare options on cost per successful workload, the price of a result the business accepts, including retries and human review.

4. How long does the workload have to stay stable?

A rented model changes on the provider's schedule. OpenAI's deprecations page lists the August 2025 GPT-5 snapshot, gpt-5-2025-08-07, for shutdown on December 11, 2026. Anthropic gives "at least 60 days' notice before model retirement for publicly released models," and its documentation is plain about what follows: "Requests to retired models fail." Providers also update models in place, which the glossary covers under model drift.

Governments can switch a rented model off too. On June 12, 2026, Anthropic disabled two of its models, Fable 5 and Mythos 5, for every customer to comply with a U.S. export control directive. Anthropic said it would begin restoring access on July 1, after the export controls were lifted.

An owned model changes when the enterprise changes it. That makes it the stronger choice for a workload validated once and expected to behave the same for years, such as a scoring step a model risk team has signed off on.

5. What may the model touch, and where did it come from?

An owned model arrives with a license and a lineage. OpenAI released gpt-oss-120b and gpt-oss-20b in August 2025 "under the flexible Apache 2.0 license." Mistral released Mistral Small 3 under Apache 2.0. Meta's Llama 4 Community License requires any licensee whose products had more than 700 million monthly active users in the calendar month before Llama 4's release to request a separate license from Meta. Google's Gemma Terms of Use incorporate a Prohibited Use Policy by reference, so legal review reads each license before production.

The AI bill of materials entry covers what to record about a model's origin. Country of origin can also carry legal weight. On October 20, 2026, the Department of Homeland Security published notice of an order removing DeepSeek products, and "third-party products and services developed using DeepSeek implementations," from federal civilian agency information technology. The order covers federal civilian agency systems and procurements. Enterprises that sell to those agencies now have a reason to know the base model under every fine-tune they run.

Rented or owned, factor by factor

Factor Points toward renting Points toward owning
Data Public or low-sensitivity data, allowed to leave under contract Data that policy, contract or regulation keeps inside the enterprise
Capability Long-horizon, open-ended reasoning that needs the frontier Narrow, repeatable tasks with a clear evaluation rubric
Volume Spiky or occasional demand Steady, high-volume demand that fills owned capacity
Stability Work that can absorb a provider's version changes Work validated once and expected to behave the same for years
Supply chain A provider under contract, with its own disclosures Weights of known lineage, under a license legal has read
Operations No team to run a serving stack A team that patches, monitors and evaluates the models it runs

Operations is the sixth factor: an owned model needs a team to run it. A workload rarely points the same way on every row. Weigh the data row first: it decides what is allowed before cost and capability decide what is preferred.

Rent or own, decided workload by workload across six factors: data, capability, volume, stability, supply chain and operations, with what points toward renting and what points toward owning for each. Weigh the data row first: it decides what is allowed.
Six factors. A workload rarely points the same way on every row.

Owning a model takes more than hosting it

Running weights on owned hardware decides where a model runs. It does not tell the enterprise what the model learned in training or what it will do with the tools it is given.

Cohere published a case on October 26, 2026. Asked to write a defensive detection rule, an open-weight Qwen model "ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing." Its reasoning trace said it would call no tools. Cohere reported the behavior at "less than one call in 100,000," found it in builds from four publishers, and said it could not answer whether it was deliberate or left over from training.

Three controls follow for any owned model, whatever its origin. Record where the weights came from and under which license. Decide what the model may touch: which tools, which destinations, which data. Keep the record of what it did, written outside the model, because a reasoning trace is the model's account of itself.

The EU AI Act draws a related line for providers. Article 53(2) exempts general-purpose models released under a free and open-source license from two of its documentation duties, and states that "This exception shall not apply to general-purpose AI models with systemic risks." The exemption covers the provider's paperwork. It does not tell the enterprise what the model will do inside its walls.

Keep the decision reversible

A provider retires a model, an open-weight model closes the gap, a contract changes the data terms, or volume grows. Every move between a rented and an owned model should be a configuration change, made without rewriting the applications that call it.

Three things make that possible. Applications call a stable endpoint instead of a provider's API directly. A model allowlist names the models each team may use and the permitted alternatives for each workload. One policy applies to every model, rented or owned, so a move does not reopen the questions of who may call it, with which data, under whose authority. When one model goes dark, the work moves to a permitted alternative under the same policy, and the move is recorded like any other decision.

For data that has to stay in one jurisdiction, the AI sovereignty and air-gapped deployment entries cover the deployment options.

Questions to ask about each workload

  • Which data classes does it read and write, and may any of them leave the enterprise?
  • Does it need frontier reasoning, or a narrow task done the same way every time?
  • What is its cost per successful workload on each option, at the volume it runs today?
  • Who validated it, on which model version, and what happens when that version retires?
  • For an owned model: where did the weights come from, under which license, and which tools may it call?
  • If the workload moved tomorrow, how many applications would have to change?

How APERION governs rented and owned models

APERION is runtime governance for AI agents. It enforces policies and controls in real time across an enterprise's AI agents, maintains human accountability, and captures auditable evidence for every decision.

Owned intelligence, governed from the first call. Enterprises will rent some intelligence and own more of it. APERION future-proofs the hybrid AI estate: every agent and every model an enterprise rents or owns, governed from one control point inside its own walls. Do not let the model provider become the architecture.

The control point sits in the path between agents and every model and tool they call, rented or owned, and keeps each action inside the authority a person delegated. Global policy. Local enforcement. Portable evidence. The policy is written once for the whole estate, it is enforced at the control point inside the enterprise's walls, and the evidence stays with the enterprise. When the control point runs on infrastructure the enterprise controls, the policy, the evidence and the choice of model stay with the enterprise, whichever provider does the work.

The Trust Fabric sets out the four layers underneath: verified identity, access governance, runtime governance, and audit and evidence. The accountable human decides, and the record shows who decided, when and under which policy. The thesis is set out in full on AI governance and why APERION.

A verified person, the authority that person delegated, the agent that used it, the policy that applied, the decision and the record of all of it. That chain is the product.

Frequently asked questions

Should an enterprise self-host LLMs or use an API?

Many do both, and the decision is made workload by workload. Data that may not leave the enterprise, narrow tasks that run at steady high volume, and work that must stay stable for years point toward a self-hosted model. Open-ended reasoning that needs the frontier, spiky demand and teams with no one to run a serving stack point toward an API. One policy and one record cover both.

What is the difference between open-weight and closed models?

A closed model is reached as a hosted service, and its provider controls its weights, versions and retirement. An open-weight model's weights are published, so an enterprise can run it on infrastructure it controls under the model's license. Licenses vary: some are Apache 2.0, others carry custom terms such as user thresholds or prohibited-use policies that legal review has to read.

Is a self-hosted model more secure than a rented one?

Self-hosting decides where the model runs and where the data goes. It does not tell the enterprise what the model learned in training or what it will do with tools. In October 2026 Cohere reported an open-weight model that tried to upload a file to an outside storage bucket while its reasoning said it would call no tools. Owned models need provenance records, limits on what they may touch and a record of what they did.

How far do open-weight models trail closed frontier models?

Epoch AI reported in May 2026 that the most capable open-weight models have lagged frontier closed models by an average of four months on its Capabilities Index. Its October 2026 analysis of cyber-relevant tasks found a lag of six to seven months. For narrow, well-defined tasks, a routed set of specialized small models with strong context and tool layers can match a frontier call. Open-ended reasoning on hard problems is where the gap shows.

How should cost be compared between rented and owned models?

Compare cost per successful workload: the price of a result the business accepts, including retries and human review. A rented model is priced per token, and those prices have fallen quickly. An owned model is priced in capacity, operations and evaluation work. Steady, high-volume narrow work can fill owned capacity. Occasional or spiky work rarely does, so a rented model is usually the better fit there.

How do you avoid lock-in when renting AI models?

Keep the decision reversible. Applications call a stable endpoint instead of a provider's API directly, a model allowlist names permitted alternatives for each workload, and one policy covers every model, rented or owned. When a provider retires a model or a better option appears, the work moves to a permitted alternative as a configuration change, and the move is recorded like any other decision.

Sources

Related reading

GuidesEnterprise AIAI GovernanceEnterprise Strategy
Craig Alberino
Craig Alberino
Craig Alberino is the Co-Founder and CEO of APERION, which builds the runtime governance layer for AI agents in regulated enterprises. Inline policy enforcement and identity-bound audit, deployable on premises.

Put this in the path of your own agents.

Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.

Request a Demo Read the docs