The Swiss case for running a model on your own hardware

Every few weeks somebody sends us the same question in different words. They want to use a language model on something confidential, a client’s contracts, an internal codebase, a folder of HR files, and they want to know whether they are allowed to.

The answer usually turns on one sentence in Swiss data protection law, and almost nobody arrives already knowing it.

The obligation people miss

Since 1 September 2023 the revised FADP has applied to AI-assisted processing the same way it applies to everything else. The Federal Data Protection and Information Commissioner has been explicit that the law is technology neutral, and Switzerland still has no separate AI statute.

What that means in practice: the moment your staff put personal data into a language model somebody else operates, you are the controller and the provider is your processor. Art. 9 requires a written agreement covering that relationship. Consumer subscriptions do not come with one. Business and enterprise tiers generally do, which is why “we use the paid plan” is a genuine compliance answer and “we use ChatGPT” is not.

There is exactly one case where the relationship does not exist at all, and that is when the model runs on infrastructure you control. No processor, no Art. 9 contract, no question about where the prompt went.

That has been true for years. What changed is that the option stopped being expensive.

What Qwen3.8-27B actually is

Alibaba’s Qwen team published Qwen3.8-27B on 14 August 2026. It is a dense model with 27 billion language parameters, roughly 28 billion in the full checkpoint including the vision components. It takes text, images and video and produces text. The native context window is 262,144 tokens.

The licence matters more than the specifications, and it is where most of the coverage goes wrong. Qwen3.8-27B is Apache 2.0. There is no revenue threshold, no user cap, no separate commercial licence at any scale.

You will find a great many articles claiming a USD 50 million revenue trigger. That threshold is real, and it belongs to a different model: Qwen3.8-2.4T-A95B, the Max checkpoint, which ships under its own terms. The two names both begin with “Qwen3.8” and the condition has been copied across to the 27B by people reading quickly. If a compliance review at your company flags that threshold, it is checking the wrong licence.

What it does not fix

This is the part that gets left out of the hardware pitch.

Running the model yourself does not make you compliant. You are still the controller. You still need a lawful purpose, purpose limitation, transparency toward the people in the data, retention limits, and security appropriate to the risk. If the processing is high risk, and systematic evaluation of people or large volumes of sensitive data usually is, Art. 22 still requires an impact assessment. The graphics card does not care.

It also does not stop data leaving by other doors. Inference being local says nothing about web search, hosted embeddings, OCR services, observability, crash reporting, or any tool you let an agent call. Those are the paths worth inventorying, and in most builds we have looked at they are the ones nobody wrote down.

And it does not make your security better than a large provider’s by default. An inference endpoint on a flat internal network with unencrypted logs is not obviously safer than a certified processor with a real security team.

The cloud-region trap

One thing worth knowing even if you never run a model locally.

A cloud region named after Switzerland is not the same as processing in Switzerland. Microsoft’s own documentation states that prompts and responses stay in the customer-specified geography unless the deployment type is Global or DataZone. Both are ordinary settings, both are easy to pick without noticing, and the resource keeps its Swiss name either way.

So the product name tells you nothing. The tier, the deployment type and the add-on modules decide it, which is why a serious inventory records those three per tool rather than a list of vendor names.

The honest cost of going local

We would not recommend this as a quality decision, because it is not one.

Measured against hosted frontier models, Qwen3.8-27B wins some things and loses others. On Qwen’s own published card it beats Opus 4.6 Max on SWE-bench Pro, 61.7 against 53.4, and on LiveCodeBench. It loses Terminal-Bench 2.1, 73.0 against 78.2, and it loses badly on Humanity’s Last Exam, 30.8 against 40.0, which is the benchmark closest to hard general reasoning. Those numbers come from the model’s publisher rather than an independent audit, and should be read that way.

Independent measurement from Artificial Analysis is less flattering in a way that matters operationally: about 46.8 tokens per second against a 104.6 median for comparable models, and 160 million tokens consumed across the evaluation suite against a 48 million median. It reaches a good score by thinking a great deal, which you pay for in latency and electricity.

The finding most relevant to a Swiss company: independent testing found that when language and formatting constraints conflict, the model drops the requested language and answers in English instead of German. If you are building something customer-facing in German, that is not a footnote.

What we would do with it

The same thing we would tell any client, which is to stop treating this as one decision for the whole company.

Sort the work by what the data is, not by what the tool is. Confidential material and routine coding against private repositories run locally, where the legal question disappears and the quality gap is smallest. Anything needing the hardest reasoning, or polished prose, goes to a hosted model with proper processor terms, on data you have minimised or pseudonymised first. That routing is the design, and it is also the documentation, because it answers where the data goes for every case before anyone asks.

Start with one workload rather than a platform. Pick the job where the data is sensitive enough that people are currently avoiding the tool entirely, and see whether a local model does it well enough. That answer is cheap to get and tells you more than a procurement exercise will.

If you want the reasoning we apply to the model call itself, retries, schemas and the evaluation set that catches a regression, that is on our AI engineering page. And if you would rather see how we behave when the answer is inconvenient, what we check before a real business uses something we built is the same instinct pointed at our own product.

The practical consequence is smaller than the marketing around it. A capable model you can run yourself does not remove your obligations. It removes one specific counterparty from the middle of them, and for the material where that counterparty was the reason you were not using AI at all, that is enough to change what gets built.