AI that aligns with your mission, not just your budget

It seems impossible to escape the AI hype train, from news headlines, LinkedIn spam, to rising prices on anything and everything computer-related. While I recommend everyone take the industry's claims with an industrial-sized pinch of salt, it’s hard to deny that generative AI can be a useful tool.

As a digital partner to a wide range of organisations, we increasingly get asked questions about AI. Such as:

• How can we best use it? 
• How can we keep our data secure? 
• How can we minimise the environmental impact of using it?

There's also a question we hear from organisations that are thinking a little further ahead: How do we maintain tech sovereignty? Keeping meaningful control over our own data, infrastructure, and digital decision-making, rather than sleepwalking into dependency on a handful of powerful platforms.

I’ve reviewed several AI providers across several categories to try to provide some answers. 

AI raises a number of profound ethical questions; our AI ethicist (in training) has already written a blog post beginning to explore some of these issues. This post isn’t intended to be a deep dive into these questions; it's instead an evaluation based on a few concrete metrics we consider important and that align with our core values.

Metrics that matter

Data retention

Data retention is exactly what it sounds like: does the AI provider retain copies of your conversations, prompts, or uploaded documents? And if so, for how long and for what purpose? 

This might seem abstract until you consider what people actually use AI for; drafting confidential emails, analysing business data, brainstorming sensitive projects, or even seeking personal advice. Would you be comfortable if all of that was stored indefinitely and potentially used to train future AI models? 

Under GDPR you're responsible for how third parties handle data you share with them. If you're processing client information or employee data through an AI tool, you need to know it's being handled properly.

Some providers offer zero data retention (ZDR) policies where they don't store or train on your data at all. Others keep everything by default unless you opt out, and some sit somewhere in between. 

The key is understanding what happens to your inputs and whether you have control over them. Look for clear documentation about data retention periods, whether your data is used for model training, and most importantly, whether zero data retention is available and how to enable it. The difference between opt-in and opt-out matters too, it's the difference between ‘privacy by default’ and ‘privacy if you remember to tick the right box’.

Location and the CLOUD act question

Where your data is physically processed matters, not just for speed and latency but for legal jurisdiction. Many organisations prefer data to be processed in UK or EU data centres because of regulatory alignment with GDPR and UK data protection laws. It keeps data sovereignty clear. 

Here's where it gets tricky. The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) allows US law enforcement to compel US-based companies to hand over data, even if that data is stored on servers outside the US. This means that even if a provider has EU data centres, it may still be subject to US data requests if it's a US company. 

This isn't about being anti-American; it's about understanding the legal landscape. For organisations handling sensitive data, whether health records, legal documents, or confidential business information, this matters. EU data centres don't automatically mean CLOUD Act protection if the provider is US-based. You need both EU data centres and a non-US parent company for full separation from US jurisdiction. 

What to look for: 

• data centres physically located in the UK or EU 
• the provider's country of incorporation and headquarters 

The documentation isn't always clear on this; sometimes you need to dig into privacy policies and legal terms to get the full picture.

Environmental impact

AI is energy-intensive. Training large language models requires massive computational power, and each query you make uses energy. 

As AI becomes ubiquitous, its carbon footprint becomes a legitimate concern. Estimates show that a single AI query uses significantly more energy than a traditional search. 

The good news is that some providers are taking this seriously. Look for: 

• data centre powered by renewable energy 
• carbon neutrality or net-zero commitments 
• transparency about energy consumption
• membership in climate initiatives like Science-Based Targets 

Not all green claims are equal. Some providers buy carbon offsets, others use renewable energy directly, and some do both. Understanding the difference helps you make informed choices aligned with your values.

It's also worth noting that energy efficiency and environmental responsibility often correlate with operational excellence; providers who care about their footprint tend to care about efficiency overall.

If your organisation has sustainability goals, your AI provider choice can support or undermine those commitments. The challenge is finding providers who are transparent about their energy use and willing to commit to measurable improvements, rather than just greenwashing with vague environmental statements.

Understanding the AI landscape

Before I dive into the evaluation results, it's worth explaining the main types of AI service providers in the market at the moment.

AI systems (all-in-one platforms)

Being the most popular, these types of providers are the ones most people have already encountered: ChatGPT, Gemini and Claude. 

They provide access to AI models via a web-based chat front end. Just enter your questions, and they will respond. All of the main providers offer both free versions and paid subscriptions. 

All allow some degree of customisation, for example, setting custom prompts (the initial instructions the model receives before it responds) as well as access to other information, such as uploaded documents. These platforms offer the easiest entry point to using AI models.

API providers (infrastructure platforms)

Similar to service providers, API providers give access to AI models; however, they dispense with the chat-based front end and allow you to interface directly with the models via the API. 

These providers let you build your own AI applications by feeding whatever prompts and other information you want into the requests. They also allow chaining requests together and even using multiple models, requests and contexts (think conversations) in ‘agentic’ workflows. 

Fortunately, as a developer, the industry has largely standardised on an API format, making it much easier to build these applications and swap providers in and out as required. API providers often charge based on tokens,  both in the request and response, which can make it more difficult to estimate costs.

Compute providers (hardware platforms)

These are the companies that rent out the powerful computer hardware needed to run AI models, typically GPUs (graphics processing units). Think of them as landlords for high-performance computing. Whether you need servers on demand for a few hours or dedicated machines running 24/7, these providers offer the raw computing power. This is for organisations that want to run AI models themselves rather than relying on someone else's service, which gives you complete control over the infrastructure but requires significantly more technical expertise. Examples include AWS, Google Cloud, and specialised GPU providers like Lambda Labs. 

What I learned about AI

I’ve included the outcomes of my evaluation in the tables below. It's important to bear in mind that the AI landscape is incredibly fast-moving, we are still firmly in the ‘wild-west’ phase of its development, much like the internet of the early 90’s. Any information contained in this post should be double-checked before making a decision.

On a positive note, thanks to legislation there are a growing number of EU based AI providers springing up as well as a growing movement towards responsible energy usage, including attempts to standardise emissions reporting across the entire lifecycle of AI models (from the initial training of the model through to its day to day usage) as well as an increase in the number of data centres that are using renewable energy. I hope that revisiting this evaluation in 12 months will show a significant increase in the number of providers that meet all three metrics used in this evaluation.

AI systems (all-in-one platforms)

Given the nature of the service, it is unreasonable to evaluate these providers based on a zero-data-retention policy; you don't necessarily want your chats disappearing each time you log off! 

Instead, I have evaluated these providers based on their general data security offering, focusing on how they store your data and what they use it for.

All those we cover here are UK or EU-based and owned, so you can be sure they fall outside the US CLOUD Act.

API providers

Only two providers currently meet all the metrics we are evaluating for. There are a number of other providers with strong credentials in renewable energy and data retention that either use US-based data centres or are run by US-headquartered companies and just miss inclusion.

Compute providers

There were 5 compute providers that met all 3 metrics used for this evaluation. If you have both high usage needs and critical privacy requirements, then these providers could be a good choice. We have direct experience with Hetzner, where we host several of our internal services and some of our client sites. We have also used Scaleway for a number of other services.
 

So, what does this all mean?

While we are in the ‘wild west’ phase of AI development, things move fast. 

Thanks to incoming legislation such as the EU AI Act and demand from values-driven consumers, new providers are popping up all the time. 

This means any purchasing decisions should be made with a commitment to regular landscape reviews. When looking for a provider, it is important to verify their ethical claims and check whether they have them independently verified by credible third parties.

Hopefully, this guide provides a useful snapshot of the current landscape and helps you formulate your own evaluation criteria. 

If you need any help with this, then please get in touch.