Local AI or cloud API: the real comparison of cost, quality and risk

The "local versus cloud" debate is often framed ideologically. We prefer to frame it in four columns: cost, quality, availability, compliance. Here is our grid, as we use it when scoping a project.

Cost: two curves that cross

An API is paid per token. For an assistant handling a few hundred requests a day, the monthly bill is small and you start immediately. For bulk processing — thousands of documents, continuous call transcription, an internal assistant used by two hundred people — the curve becomes linear and never stops.

A local inference server is expensive on day one, then almost free. A workstation with a 24 GB card comfortably runs a quantized 8-billion-parameter model; a server with two 48 GB cards opens the door to 70-billion models. These machines are amortized over three years and reused from one project to the next.

Our rule of thumb: below a few thousand requests a month, the API wins on cost. Above that, local wins within the first year — and the gap widens afterwards.

Quality: less of a gap than you think on targeted tasks

The best proprietary models remain ahead on open-ended tasks and long reasoning. But most business cases are targeted tasks: extracting fields from an invoice, classifying an email, answering from a document base, transcribing a voice note in Darija. On these tasks, a well-chosen open model, possibly fine-tuned on a few hundred examples, reaches equivalent quality.

Method matters more than model size: an evaluation set built on your real data, measured before choosing, is worth more than any public leaderboard.

Availability: who controls the switch

An API depends on connectivity, quotas, version changes and a third party's pricing policy. A local model works offline, does not change behaviour unless you decide it, and does not disappear when a provider retires a version.

Compliance: the deciding factor in Morocco

This is where the Moroccan framework weighs in. Sending the content of a customer message, a resume or a medical file to an API hosted abroad is a transfer of personal data within the meaning of articles 43 and 44 of Law 09-08. To a State outside the list of deliberation 236-2015 — which is the case of the United States — you need a derogation under article 44 or an express authorization from the CNDP.

For sensitive data (health, opinions, union membership), article 12 additionally requires prior authorization, regardless of where the processing takes place. And article 57 punishes the processing of such data without express consent with three months to one year of imprisonment and a fine of 50,000 to 300,000 MAD.

A model deployed on your premises does not let the data out. It does not remove the ordinary obligations — declaration, information, security, impact assessment under D-188-2020 — but it removes the entire "transfer" layer.

When the API remains the right choice

We are not dogmatic. The API is legitimate when:

• volume is low and usage exploratory;
• the task genuinely requires a frontier model;
• the data sent is not personal, or is filtered before the call.

In the latter case, we place a local filter that strips identifying information (names, emails, numbers, identifiers) before the text leaves the network, and we document the residual transfer. It is not an absolute guarantee — no filter reaches 100% — and that must be stated clearly in the impact assessment.

The grid on one page

What we recommend at scoping

Start by measuring: real volume, tolerated latency, data sensitivity, existing hardware. Then decide column by column. In our experience, a Moroccan company processing customer or employee data very often ends up choosing local — not on principle, but because the "compliance" column and the "cost at high volume" column point in the same direction.

Articles on regulatory topics are technical and documentary analysis, not legal advice. Excerpts from legal texts are reproduced from official publications; our interpretations are flagged as such.