Pick any AI tool you use today. There is a strong chance you will not be using it in eighteen months. The model will get cheaper somewhere else, faster somewhere else, or simply better somewhere else, and you will switch. The question worth asking now is what happens to your data when you do.
That is the part of the AI conversation almost nobody is selling you on, because nobody makes money explaining it.
The Model Is the Consumable
AI models are becoming a commodity faster than any software category before them. One provider ships an update. The next one matches it within weeks. Open-source models close the gap within months. The brand name on your API endpoint is no longer a real advantage. It is a consumable. You pick the best one for the job this quarter, and you accept that next quarter the answer might be different.
What is not a commodity is your data. Your prompt library. Your evaluation sets. Your customer history. The labeled examples your team built last year. The record of every decision a tool made on your behalf. Those are the assets. They produce value the second time, the tenth time, the hundredth time. The model is the engine. Your data is the road, the cargo, and the route.
The old SaaS playbook between 2010 and 2022 hid this on purpose. The whole point of the architecture was to make your data a feature of the vendor’s platform, rather than something you owned. You signed up for a CRM, and three years later your customer information was so tangled inside the vendor’s system that switching was a six-figure project. The lock-in was not the software. The lock-in was the data trapped inside it.
AI breaks that pattern, and most organizations have not noticed yet.
Bring the Model to Your Data
The model is now the portable piece. You can download open-source weights, run them on your own hardware, or call an external service only when you need it. Tools like Ollama and LM Studio made local inference easy. A recent MacBook Pro can run a capable model on the laptop itself. A consumer-grade graphics card handles larger ones. Not every task needs the most powerful frontier model, and the math is shifting fast for high-volume, repetitive work, where a smaller local model produces the same result for a fraction of the cost.
This flips the SaaS pattern. Instead of sending your data to the model, you bring the model to your data. AI is a decentralizing force when you let it be one. The default settings push you back toward the cloud, because that is where the vendors make their margin. The default settings are not the only option.
The Governance Question in Quebec
For Quebec organizations, the governance angle matters more than the cost angle. Article 12.1 of Loi 25 already requires transparency when personal information is used to render a decision based exclusively on automated processing. The broader governance work around that obligation requires you to understand where personal information goes, who can access it, whether it leaves Quebec, and what automated decisions you are making with it. If you cannot answer those questions for your AI use today, you have a compliance problem that no vendor selection process will solve.
The Commission d’accès à l’information has also recommended algorithmic impact assessments for AI systems that make partially or fully automated decisions, including in workplace contexts. That is not just paperwork. It is the evidence trail showing you understood the risk before deploying the tool. If your data is sitting in a US-hosted cloud subject to foreign-access laws while you process Quebec residents’ personal information, the question is not whether you have exposure. The question is how well you have documented and justified it.
The operating model matters more than the tool choice.
Separate Portable from Proprietary
Separate the portable from the proprietary in your AI stack. Your prompts, your evaluation sets, your retrieval corpus, your audit logs: these are portable assets. Document them. Version them. Treat them as if you might switch to a different model tomorrow, because you might. Your vendor-specific configurations, plugins, and integrations: those are the consumables. Expect to rebuild them when the underlying provider changes.
ISO 42001 makes this concrete. The standard asks organizations to establish, implement, maintain, and improve an AI management system, including processes for responsible AI use, traceability, transparency, reliability, and risk management. If you do that documentation properly the first time, switching models becomes a configuration change rather than a project. For federally regulated financial institutions, OSFI Guideline E-23 points in the same direction for model-risk governance. For high-risk AI systems in Europe, Article 10 of the EU AI Act makes data governance explicit. The work pays off in more than one place.
The question is not which model to use. The question is whether your operating model treats your data as the asset and the model as the consumable. If your AI strategy reverses that, you are building someone else’s moat with your own information.
Sources
- Loi 25 / Bill 64 text, including automated decision provisions
- Commission d’accès à l’information memorandum on AI in the workplace
- ISO/IEC 42001:2023 AI management systems
- OSFI Guideline E-23, Model Risk Management
- EU AI Act, Article 10 on data and data governance
Video version
This article is also the basis for Nord Paradigm’s first YouTube video: watch Own the Data. Rent the Model. on YouTube.