LLM Deployment Comes Down to How You Own the Foundation — API, Self-Hosted, or Hybrid

LLM Deployment Comes Down to How You Own the Foundation — API, Self-Hosted, or Hybrid

Companies that have reached the point of seriously evaluating LLM deployment have usually already cleared the first fork in the road — the question of whether conversational tools like ChatGPT may be used for work at all. It is exactly because that first attempt showed promise that the next question comes up. When you embed this technology across the business, what form does your company want the LLM itself, as a computing foundation, to take? Do you keep paying for a commercial API, put a model on your own servers, or use both for different purposes? This article focuses on that single question.

You will not find the answer by studying product comparison charts. This is not a question of which tool is better. It is decided by the nature of the data you handle, your monthly processing volume, and the amount of security responsibility your organization can genuinely carry. The overall process and cost picture of generative AI adoption is covered in How to Approach Generative AI Adoption and What It Costs, and product-level comparisons of ChatGPT, Copilot, and similar tools are covered in Enterprise Generative AI Comparison. This article sits one step before both of those and digs into only the decision neither one addresses — how you own the foundation.

What an LLM Is — Separate the Tool from the Foundation in Business Terms

LLM stands for Large Language Model, a model trained on large volumes of text that probabilistically generates the continuation of a given context. That is the whole technical definition, but a business decision requires going one step further.

When people inside a company say “let’s bring in generative AI,” three layers of very different character are usually being discussed as if they were one thing.

Where most companies stumble is comparing only the application layer, then letting the foundation-layer choice be dictated by whatever tool they picked. The moment someone later discovers that a particular dataset cannot leave the building, the application layer has to be rebuilt along with everything else.

When you embed an LLM into a business, the order runs the other way. Decide first how you will own the foundation layer, then choose the application layer within those constraints. In that order, the range of data you can handle may widen later, but it will never narrow in a way that forces a rebuild.

Three Ways to Own an LLM Foundation — Commercial API, Self-Hosted, Hybrid

In practice, the foundation layer comes down to roughly three options.

Using a commercial API means calling models such as Claude, GPT, or Gemini on the provider’s cloud. All you supply is an API key and the application that calls it. Upfront investment is close to zero, and keeping pace with the latest models requires no change to your contract. On the other hand, your prompts and internal data are sent to servers outside your control. How you handle that is where contracts and regulation come into play.

Self-hosting means placing an open-source model on servers or a private cloud that you manage, and running inference under your own control as well. Because the data never crosses your boundary, it is a strong option for highly confidential use cases. The trade-off is that the security and compliance burden previously carried by the commercial provider moves inside your own organization.

Hybrid means using both, split by use case. Prediction Guard’s published comparison of self-hosted and cloud deployment observes that production architectures tend to converge on the hybrid pattern, with confidential, high-volume workloads processed in-house and the heaviest inference tasks left on commercial APIs. This is vendor commentary, so it cannot be treated as a statistic, but the direction matches what practitioners see. Keeping everything in-house and pushing everything outside are both extremes.

The table below summarizes how the three approaches differ in character. These are qualitative tendencies, not measured figures from a source.

The Cost Structure Difference — Usage-Based Billing or Fixed Cost

Cost structure sits at the center of the decision, and this is a place for numbers rather than instinct.

Start with commercial API price levels. The figures below are indicative values quoted from several price comparison articles as of August 2026, not verified against official announcement pages. Vendors revise pricing frequently, so always confirm on each provider’s official site before putting numbers into an internal approval request.

What matters in this table is not which individual price wins. It is the fact that the gap in per-million-token pricing between the top-tier models and the lowest price tier is extremely large. Claude Opus (4.8 generation) is reported to have held the same price level as Opus 4.5, while DeepSeek V4 Flash sits in the cheapest tier. A gap of that size means that designing your architecture to run every internal use case through a single top-tier model is the most disadvantageous choice on cost. The assumption that you will route different use cases to different models needs to be built in at the foundation design stage.

It is also generally reported that enterprise contracts attract volume discounts of roughly 20% to 60% above certain usage levels. The range is wide because terms shift substantially with contract structure and annual commitment. Once you can forecast annual volume with reasonable confidence, it is worth negotiating directly with providers rather than modelling costs at list price.

The cost structure on the self-hosted side is entirely different in nature. No matter how many tokens you process, there is no incremental charge; instead you carry upfront hardware investment plus fixed monthly costs for power, maintenance, and staff. Petronella Technology Group’s private AI deployment guide states that as of 2026, even mid-sized companies can build a private AI environment by combining roughly $10,000 to $15,000 of hardware with open-source models that match commercial API performance for many business use cases. That figure is an indication of initial hardware investment only, with operating and maintenance costs on top, and it should be read with the awareness that it comes from vendor-affiliated media.

Where the Break-Even Sits — The 10 Million Tokens per Day Benchmark

So at what processing volume does self-hosting become the better deal? The same guide states that in the high-volume band above 10 million tokens per day, self-hosting reliably becomes the cost-advantaged option within 18 months. The 18 months here refers to the payback period on the upfront investment and has nothing to do with the Vietnamese AI Law grace periods discussed later. This too is an estimate rather than a guaranteed number, but it works as a starting point for judgment.

To make 10 million tokens per day concrete — you will not get anywhere near it while employees are using conversational tools individually. You reach it when the technology is embedded into business systems and batch processing starts running. Feeding entire drawings and specifications to a model, summarizing meeting minutes for every project daily, classifying every inbound inquiry email. Once these “processes that keep running without anyone instructing them” accumulate, token volume changes by an order of magnitude.

The practical conclusion is simple. Starting from self-hosting during the launch phase tends to be the expensive choice. You would be locking in fixed costs before you can forecast processing volume, and before you know which use cases will grow. Grow the use cases on a commercial API first, then re-evaluate how to own the foundation once you have measured token volumes. That sequence is the rational one on cost.

There is, however, one area that cost alone cannot decide — the nature of your data, which is the subject of the next section.

Internal Data and Document Search — Why the Foundation Choice Matters Here

Among the use cases companies expect from an LLM, the largest demand is putting internal data to work, and document search in particular. Past defect reports, equipment maintenance records, correspondence with customers, internal policies. A system that searches these in natural language and returns answers with supporting evidence is one of the generative AI use cases where return on investment is easiest to read.

The standard method for implementing this is RAG, or retrieval-augmented generation. Internal documents are processed into a searchable form; when a question arrives, the relevant documents are retrieved, passed to the model, and used as the basis for the answer. A detailed walkthrough of applying RAG to factory knowledge is available in Putting Manufacturing Shop-Floor Knowledge to Work with RAG.

This is exactly where the foundation-layer choice starts to bite, because structurally, RAG sends the contents of internal documents to the model every time a question is asked. When individuals use a conversational tool, employees choose what they type in themselves. The moment you build RAG, any document included in the search scope is sent to the model automatically whenever a query matches it. Nobody is making a judgment call before it goes.

In other words, at the conversational tool stage you could manage “what not to put in” through operational rules; at the document search stage, the design property changes to inclusion in the search scope equals inclusion in what gets transmitted. That is the single biggest reason to decide how you will own the foundation first.

Petronella Technology Group’s private AI deployment guide cites classified defense data, regulated financial data, manufacturing intellectual property, and multi-year audit logs that must be retained under your own control as the typical cases for choosing self-hosting. Translated to Japanese manufacturers operating in Thailand and Vietnam, the categories that most often apply look like this.

Building this table is the design of your hybrid architecture. Hybrid is the result of deciding which document sets go on which foundation — not something you declare in advance.

Security and Data Governance in Practice — How to Keep Logs and Audit Trails

Once you have decided how to own the foundation, the next step is implementing governance. What gets overlooked here is how much additional work appears if you choose self-hosting.

The belief that self-hosting is safe because data never leaves the building is only half right. Prediction Guard’s deployment comparison points out that choosing self-hosting means absorbing the entire security and compliance burden previously carried by the commercial provider into your own organization. It identifies the foundation of that work as building an audit regime that records prompts, outputs, and access events in a tamper-proof form.

While you are on a commercial API, a substantial part of this can rest on the provider’s certifications and audit reports. The moment you move to self-hosting, all of it becomes your team’s job. Concretely, that means the following.

These are necessary regardless of whether you self-host, but with self-hosting your own team is the implementer. Whether you can staff this is the real entry condition for self-hosting. Plenty of companies can afford the $10,000 to $15,000 of hardware but cannot assign someone to keep operating it, and overlooking that means updates stop shortly after launch.

How to configure the environment securely as a whole is covered in Building a Secure Generative AI Environment, and putting internal usage rules in place is covered in How to Write a Generative AI Usage Policy. Once the foundation-layer choice is settled, those two workstreams run in parallel.

Regulatory Landscape in Thailand and Vietnam — Do Not Confuse In Force with Draft

For companies with sites in Thailand or Vietnam, how you own the foundation is also a regulatory question. Information here is easily muddled, and secondary sources frequently conflate the two countries, so it is worth stating the distinction precisely.

Vietnam — The AI Law Is in Force, and the Task Now Is Counting Down the Grace Periods

Vietnam’s AI Law (Law No. 134/2025/QH15) entered into force on 1 March 2026. It is already binding law. It does not apply in full immediately, however. General AI systems have a 12-month grace period running to March 2027, and critical sectors such as healthcare and finance have an 18-month grace period running to September 2027. For a company choosing its foundation now, that means designing backwards from the end of the grace period.

The provisions that bear directly on how you own the foundation concern where data sits. Vietnam’s AI Law extends data localization requirements beyond where data is stored to where it is processed. AI platforms seeking approval for government procurement must place their operating infrastructure within Vietnam, and cloud AI services that process Vietnamese government documents on servers abroad, such as in Singapore or the United States, are reported to be unable to meet that standard.

This needs to be read accurately. These are government procurement requirements, not rules applied uniformly to every activity of every private company. That said, for companies that supply Vietnamese government procurement contracts, or that may do so in future, it bears directly on foundation-layer design. There is also a provision requiring overseas providers of high-risk AI to establish a commercial presence in Vietnam or appoint a local representative.

Thailand — The AI Law Is Not Yet in Force, but the PDPA Is Fully Enforced

Thailand’s situation is completely different from Vietnam’s. Thailand’s AI legislation is not yet in force as of August 2026 and remains at the draft stage. Regulators consolidated the 2022 royal decree and the 2023 promotion bill and published draft principles for an AI law in May 2025. At AI Governance Week 2026 on 29 June 2026, the Ministry of Digital Economy and Society announced its intention to complete the AI legislative framework within fiscal 2026.

Building an internal briefing on the assumption that “Vietnam has enacted it, so Thailand must be the same” gets this distinction backwards. The opposite reading — “Thailand has no law yet, so anything goes” — is equally wrong. Thailand already has a fully enforced Personal Data Protection Act (PDPA).

Thailand’s PDPA came into full force on 1 June 2022 and is modeled on the GDPR. It contains provisions on cross-border data transfers and requires data breaches to be reported within 72 hours. Violations carry fines of up to 5 million baht and the possibility of imprisonment.

In the LLM deployment context, the PDPA bites in two places. First, sending prompts that contain personal information to a commercial API can constitute processing of personal data under the PDPA. Second, because the prompt and output logs you retain for audit purposes may themselves contain personal data, their retention periods and protective measures fall under the PDPA as well. There is no need to wait for an AI law to pass — you can review your foundation-layer design on PDPA grounds alone, starting today.

Note also that announcements of government services such as the TH-AI Passport are a separate matter from AI legislation. Be careful not to write “a law has been enacted” in internal material simply because the government has announced an AI-related initiative.

The EU AI Act — Reference Information for Companies with EU Operations or Trade

If your main customers are companies in Thailand and Vietnam, your exposure is mostly outside the EU, but this is worth noting for companies with EU operations or trade. Full enforcement of the EU AI Act begins on 2 August 2026, with penalties for violations of up to EUR 35 million or 6% of worldwide annual turnover. Among Japanese manufacturers too, companies that ship products to Europe or operate European subsidiaries should confirm whether they fall within scope.

A Decision Framework — Which Approach Suits a Company Advancing Its LLM Use

Here is everything above, reduced to something you can actually decide with. Answer the following in order and the direction of your foundation choice emerges.

The results of these eight items generally converge on three patterns.

Pattern A, a commercial API is sufficient. Processing volume falls short of 10 million tokens per day, the documents involved are not highly sensitive, and no dedicated infrastructure staff can be assigned. Most companies begin here. Forcing a self-hosted choice at this point makes sense neither on cost nor on staffing.

Pattern B, hybrid is appropriate. Sensitive document sets and general documents are clearly separated, and processing volume is growing. Only the sensitive workloads move to the self-hosted side, and everything else stays on the commercial API. This is also the shape the deployment comparison cited above identifies as the convergence point for production operations.

Pattern C, self-hosted at the center. Processing volume is large, most of the data involved is intellectual property or regulated material, there is a requirement to retain audit logs in-house, and operational staff can be secured. Few companies qualify, but those that do find the alternatives structurally hard to take.

The important point is that this decision is not made once. Processing volume changes as use cases multiply, and regulation advances against deadlines, as Vietnam’s grace periods show. At minimum, build in an annual review that reconciles measured figures against the regulatory situation.

Frequently Asked Questions (FAQ)

What is an LLM?

LLM stands for large language model, a model trained on large volumes of text that probabilistically generates the words that follow a given context. For business decisions, the important thing is to separate three layers — the application users touch, the integration mechanism that passes internal data to the model, and the LLM that performs inference itself. Conversational tools such as ChatGPT are application-layer products; where and how the LLM behind them runs is a separate, foundation-layer decision.

How much does LLM deployment cost?

Because the nature of the cost changes with how you own the foundation, there is no single benchmark. Commercial APIs are billed by usage, and according to price comparison articles as of August 2026, the per-million-token rate differs greatly between top-tier models and the cheapest tier. Self-hosting has a structure of upfront hardware investment plus fixed operating costs, with one estimate holding that even mid-sized companies can build a private AI environment by combining roughly $10,000 to $15,000 of hardware with open-source models that match commercial API performance for many business use cases. That figure is an indication of initial investment only, with operating, maintenance, and staffing costs on top. In practice we recommend growing use cases on a commercial API first, measuring actual processing volume, and then re-deciding on the basis of those numbers.

Is it safe to use internal data with generative AI?

The answer differs by data type. General documents such as internal policies and work instructions are often fine on a commercial API, whereas intellectual property like drawings and machining conditions, material covered by customer confidentiality agreements, and personal data need their destination and retention terms settled before use. This matters especially once you build a document search system, because any document included in the search scope is sent to the model automatically as soon as a query matches it. No human is making that call each time, so classifying which documents belong in search scope, before you build, is the practical crux.

What regulations must be observed when deploying an LLM in Thailand?

As of August 2026, Thailand’s AI legislation is not yet in force and remains at the draft stage. The Ministry of Digital Economy and Society has indicated its intention to complete the legislative framework within fiscal 2026. The Personal Data Protection Act (PDPA), by contrast, has been fully in force since 1 June 2022, with provisions on cross-border data transfers, a 72-hour data breach notification requirement, and fines of up to 5 million baht plus the possibility of imprisonment for violations. Rather than waiting for an AI law to pass, review prompt transmission and log retention on PDPA grounds first. Note that Vietnam’s AI Law has been in force since 1 March 2026, so the situation there differs from Thailand. Companies with sites in both countries should be careful not to transplant the same design across the border unchanged.

Summary — Deciding the Foundation First Means Less Rebuilding Later

An LLM deployment decision is not an exercise in comparing products. Three variables determine how you own the foundation — the nature of the data you handle, your monthly processing volume, and the amount of security responsibility your organization can carry.

To recap this article. The foundation-layer options are commercial API, self-hosting, and hybrid, and production architectures are reported to converge on hybrid. Cost structures differ in nature between usage-based billing and fixed cost, and the band where self-hosting is said to become reliably advantageous is above 10 million tokens per day. Locking in fixed costs during a launch phase when volumes cannot be forecast is a disadvantage, so growing use cases on a commercial API and measuring first is the rational route.

What cost alone cannot decide is the nature of the data. The moment you build document search, any document in the search scope is sent to the model automatically by design. Classifying which foundation carries design data, customer-supplied drawings, and personal data is, in itself, the design of your hybrid architecture.

On regulation, never confuse the two situations. Vietnam’s AI Law has been in force since 1 March 2026, with grace periods ending in March 2027 and September 2027, whereas Thailand’s AI legislation remains at the draft stage as of August 2026. And in Thailand the PDPA is already fully enforced, which means there are points to review without waiting for an AI law.

What grows when you choose self-hosting is operational work rather than hardware spend. Can your own staff build and sustain an audit regime that records prompts, outputs, and access events in a tamper-proof form? Confirm the outlook on people before you confirm the hardware budget.

We are also happy to talk with companies that have not yet chosen a foundation, or that want help working out which pattern they fall into in the first place. How to estimate processing volume, how to approach internal document classification, and how to split the design across sites in Thailand and Vietnam are all questions worth settling before you request quotations, because doing so reduces rework later. Even if you are still mid-evaluation, please get in touch through our contact form — we would be glad to help.

References

1. Self-hosted versus cloud LLM deployment comparison

Source for the tendency of production architectures to converge on hybrid, the pattern of processing confidential high-volume workloads in-house while leaving the heaviest inference tasks on commercial APIs, the point that choosing self-hosting absorbs the security and compliance burden into your own organization, and the statement that a tamper-proof audit regime covering prompts, outputs, and access events is the foundation of that work. As vendor technical commentary, it is cited as a tendency rather than a statistic.

Self-Hosted vs Cloud LLM Deployment Guide | Prediction Guard

2. Private AI deployment guide for enterprises

Source for the statement that self-hosting reliably becomes cost-advantaged within 18 months in the high-volume band above 10 million tokens per day, that as of 2026 even mid-sized companies can build a private AI environment by combining roughly $10,000 to $15,000 of hardware with open-source models, and that the data types suited to self-hosting include classified defense data, regulated financial data, manufacturing intellectual property, and multi-year in-house retention of audit logs. All of these are estimates from vendor-affiliated media, not guaranteed figures.

Private AI Deployment Guide for Enterprise | Petronella Technology Group

3. Claude Opus pricing information

Source for the statement that Claude Opus (4.8 generation) API pricing is $5 per 1 million input tokens and $25 per 1 million output tokens, holding the same level as Opus 4.5. This is an indicative figure from a price comparison article as of August 2026 and has not been verified against an official announcement page.

Claude Opus Pricing | eesel AI

4. LLM API pricing comparison

Source for the pricing of GPT-5.2 at $1.75 input and $14.00 output, GPT-5.5 at $5 input and $30 output, and DeepSeek V4 Flash at $0.14 input and $0.28 output (all per 1 million tokens), as well as the point that enterprise contracts commonly attract volume discounts of roughly 20% to 60% above certain usage levels.

LLM API Pricing Comparison – GPT, Claude, Gemini, DeepSeek 2026 | Spheron Network

5. Enterprise AI data sovereignty

Source for the point that full enforcement of the EU AI Act begins on 2 August 2026, with penalties for violations of up to EUR 35 million or 6% of worldwide annual turnover.

AI Data Sovereignty for Enterprise | NeuralTrust

6. Commentary on Vietnam’s AI Law

Source for the statement that Vietnam’s AI Law (Law No. 134/2025/QH15) entered into force on 1 March 2026, with a 12-month grace period for general AI systems running to March 2027 and an 18-month grace period for critical sectors such as healthcare and finance running to September 2027.

Vietnam – Artificial Intelligence Law, Foundation and Outlook | Baker McKenzie

7. Enforcement directive covering AI platforms in Vietnam

Source for the points that Vietnam’s AI Law extends data localization requirements beyond storage location to processing location, that AI platforms seeking government procurement approval must place operating infrastructure inside Vietnam so cloud AI services processing government documents on foreign servers cannot meet the standard, and that overseas providers of high-risk AI must establish a commercial presence in Vietnam or appoint a local representative. These are government procurement requirements and do not apply uniformly to all private-sector activity.

Vietnam Bans Classified Documents on AI Platforms | Tech Times

8. Status of AI legislation in Thailand

Source for the points that Thai regulators consolidated the 2022 royal decree and the 2023 promotion bill and published draft principles for an AI law in May 2025, and that Thailand’s AI legislation remains at the draft stage and not in force as of August 2026. Japanese-language news outlet based in Bangkok.

Developments on Thailand’s AI Legislation | Bangkok Shuho

9. Thai government policy announced at AI Governance Week 2026

Source for the point that the Ministry of Digital Economy and Society announced at AI Governance Week 2026 on 29 June 2026 its intention to complete the AI legislative framework within fiscal 2026. Japanese-language news outlet covering Thailand.

Reporting on Thailand’s AI Policy | Thaich.net

10. Thailand’s Personal Data Protection Act (PDPA)

Source for the points that Thailand’s PDPA has been fully in force since 1 June 2022 and is modeled on the GDPR, that it contains provisions on cross-border data transfers and a 72-hour data breach notification requirement, and that violations carry fines of up to 5 million baht and the possibility of imprisonment.

Thailand’s Personal Data Protection Act (PDPA) | KPMG Japan