AI inside your company: how to use artificial intelligence without your data leaving your network

4 min read·Updated October 18, 2026

Where AI runs matters

When you use a cloud AI assistant, what you type and the documents you attach travel to the provider’s servers, often in another country. For drafting an email or summarizing a public article, that’s not a problem.

The question changes when the request includes medical records, payroll, customers’ financial data or confidential contracts: who holds that information, in which country and for how long? Running AI inside the company (on-premise) means the model runs on hardware inside your network, so requests, documents and answers never leave it.

What Colombia’s data protection law says

In Colombia, personal data is governed by Law 1581 of 2012, enforced by the Superintendence of Industry and Commerce (SIC). Four points are key when using AI (Ley 1581, 2012):

• Sensitive data (article 5): data that affects the person’s privacy or whose misuse can lead to discrimination, such as health, ethnic origin, religious beliefs or biometric data. It has reinforced protection.
• Security principle (article 4): information must be handled with the technical, human and administrative measures needed to prevent tampering, loss, or unauthorized access or use.
• Transfers abroad (article 26): transferring personal data to countries without an adequate level of protection is prohibited, with exceptions such as the person’s express and unequivocal authorization.
• Penalties (article 23): the SIC can impose fines of up to 2,000 monthly minimum wages, and suspend or shut down data processing operations.

Using cloud AI isn’t illegal: many companies do it with the right authorizations and contracts. But when the data is sensitive, keeping it inside your network removes the cross-border transfer altogether.

This guide is informational and not legal advice. Before using personal data with AI, check with your advisor which authorizations and contracts you need.

AI-specific risks

OWASP, the reference foundation for software security, publishes a list of the ten most important risks in applications built on language models (OWASP, 2025). Three of them apply wherever the AI is installed:

• Prompt injection: someone writes, or hides in a document, instructions that change how the system behaves.
• Sensitive information disclosure: the system shows data it shouldn’t, for example to a user without permission to see it.
• Excessive agency: giving the AI more permissions or actions than it needs, like sending emails or changing records unchecked.

Running AI inside the company solves where the data lives, not these risks. You still need to control who asks what, which documents each role can read and which actions the system can take.

Cloud or inside your company: how to decide

It isn’t all or nothing. Many companies combine both: the cloud for general tasks and private AI for the processes that handle sensitive information.

What a solid installation requires

• Hardware sized for the model and the number of people who will use it.
• Certified electrical work (in Colombia, under RETIE), backup power and cooling.
• A segmented network and role-based access: each team queries only what it should.
• An audit log of queries and access.
• Controlled updates and backups.
• Local support when something fails.

Where to start

1. 01

   Classify your information

   Which data you’d use with AI and which is sensitive under the law.

2. 02

   Pick a single use case

   For example, querying contracts, manuals or internal policies in plain language.

3. 03

   Decide how to measure it

   Time saved, correct answers or errors avoided, from the first month.

4. 04

   Decide where it runs

   Cloud, inside your company or a mix, depending on how sensitive the data is.

At Korbex we’re preparing Korbex Private AI: artificial intelligence installed inside your company, with one use case measured from the first month and a predictable cost. We’re looking for pilot companies.