A six-figure vendor contract avoided, with a private AI model for a credit bureau

The bureau wanted its staff to use AI in their daily work. It could not let sensitive data reach public AI tools. The national data privacy rules applied, and staff using public tools on their own, known as shadow AI, was a real risk. The bureau also wanted to own the capability, so it could build AI into its own products later, including tools that help configure decision engines.

The answer was a private model: a chat interface on top of an AI model running on the bureau's own hardware. Work covered everything from the first requirements to the case for funding.

Stage	What it does	Status
1Write the requirements	Defines the use cases, privacy rules and language	Done
2Check the vendors	Tests what each vendor actually offers	Done
3Design the architecture	Specifies the hardware, software and privacy layer	Done
4Plan the pilot	Sets a short proof of concept on priority use cases	Done
5Make the case	Presents the rollout plan for funding	Done

The first business and product requirements set out what the model had to do and the limits it had to respect. Staff would use it through a chat interface. It had to work in the local language, not only English. And it needed a privacy layer. PII redaction removes personally identifiable information, such as names, ID numbers and the names of client banks, before any text reaches the model. The requirements kept that layer in place even though the model runs locally.

Several vendors pitched for the work. One presented its model as its own proprietary AI, at a high price in US dollars. A closer review showed something different. The model was an open source model released under the MIT licence, which allows anyone to reuse it. The vendor had fine-tuned it, meaning trained it further on its own data, using NVIDIA's openly available tools. Its training data was English finance material, while the bureau needed the local language.

On that basis the bureau did not sign the vendor's pilot or contract. That avoided a cost in the six figures, in US dollars.

The architecture covers the full setup. A hardware spec sheet sets out the GPU servers needed to run the model on site. The software design covers the chat interface, the PII redaction layer and the harness around the model. The harness is the code that controls what goes in and what comes out. Open source models can be downloaded and fine-tuned in house, so the bureau could build the same kind of model the vendor offered, on its own terms.

The pilot plan is a proof of concept of one to two months. It tests the priority use cases with the bureau's existing staff. It compares two paths: build in house with the right hires, or work with a vendor at a lower cost by doing the hardware sourcing and the first software build internally.

The AI strategy and rollout plan were reported to the CEO. The proof of concept is designed to give the CEO the evidence to ask the parent company's board for funding.

• A six-figure vendor contract avoided, after due diligence showed the model was a fine-tuned open source model.
• A complete plan to run AI on the bureau's own hardware: requirements, architecture, hardware spec and rollout.
• A 1 to 2 month pilot, with in-house and vendor paths compared.
• No client data sent to public AI tools, with PII redaction built into the design.