Every month brings a new ranking of the best AI models, and every month it looks different. If you hang your choice of provider on benchmarks, you are making a decision with an expiry date. In my consulting work I ask different questions. Not: which model writes the finest prose? But: what happens to what you put in?
Four questions instead of a leaderboard
1. Which jurisdiction does your input end up in?
OpenAI, Anthropic, Google and Microsoft are US companies. Even when processing happens in a European data centre, the operator answers to US law — the CLOUD Act obliges American providers to hand over data on demand, regardless of where it is stored. An EU data centre is a location, not a jurisdiction. European providers such as Mistral or Aleph Alpha are positioned differently here; you still have to check the specifics case by case.
2. Is your input used for training?
The biggest difference lies between access tiers, not between providers. Free consumer chatbots typically reserve the right to use inputs to improve their models. Paid API and enterprise agreements usually rule this out. Anyone using the same interface at work as at home is most likely on the wrong tier. This belongs in every AI policy: which access, which contract, which classes of data.
3. Which operating models does the provider offer?
The spectrum runs from pure SaaS through EU data regions and zero-retention agreements to open model weights you run entirely yourself. The more sensitive the data, the further along that scale you should move. Open models from Meta, Mistral, Alibaba or DeepSeek now run on your own hardware at a quality that is simply sufficient for much of everyday office work.
4. How do you get back out?
Exportable data, documented interfaces, no proprietary formats at the core of your own processes. If your workflows are deeply entangled with a single provider, you have no negotiating position at the next price rise. Switching must remain possible — otherwise your selection was not a decision but an enrolment.
My rule of thumb for practice
The first decision is not the provider but the class of data:
- Public and uncritical — research, drafts containing no internal material: any major provider qualifies; let quality decide.
- Internal matters — strategy, contracts, personnel: only under an enterprise agreement, with training excluded and the jurisdiction question settled.
- The crown jewels — client and patient data, trade secrets, anything under professional confidentiality: this does not belong in anyone else's hands. Here a locally operated open model is the cleanest answer.
This classification outlives every model generation. Which provider happens to top the benchmark is then the last question — and the least important one.
