Open vs proprietary AI models: which one should your company choose?

Three Options Beyond "Mistral or GPT"

A proprietary service provides both the model and its API infrastructure. The vendor operates inference, capacity and part of the security stack. The company remains responsible for its integration, the data it sends and any decision made from the output.

An open-weight model can run at a hosting provider, in private infrastructure or through a managed service. "Open" does not automatically mean free, local, suitable for the task or unrestricted. Teams must read the model's license, size the hardware and operate the deployment.

A hybrid architecture assigns different models to different tasks. A company-deployed model might classify internal documents, while an API handles selected complex cases after filtering and approval. This can reduce the volume sent to an external service, but it also adds code, tests and vendors to monitor.

What Changed in 2026

OpenAI made the GPT-5.6 family generally available on July 9, 2026, with three tiers: Sol, Terra and Luna. Anthropic offers Claude Fable 5 for demanding knowledge and coding work. Vendor-published comparisons are useful signals, but they do not replace tests on your documents, instructions and error criteria.

For open models, Mistral Small 4 is available under the Apache 2.0 license. Its official model card describes a multimodal open-weight model compatible with several inference engines. That makes custom deployment possible. It does not mean that an inexpensive CPU-only server is suitable for every workload. Memory, throughput, latency and quantization need to be measured on the proposed infrastructure.

Commercial services are also adding data-protection controls. OpenAI states that API and business-product data is not used to train its models by default. It also offers European data residency and processing options for eligible projects, subject to documented conditions and limitations.

The vendor's nationality is not enough to decide. Review the contract, subprocessors, processing location, retention, possible transfers, access controls and the sensitivity of the data.

The Five Criteria That Matter for a company

1. Data and Its Rules of Use

Start by classifying the data: public, internal, confidential, personal, protected by professional secrecy or subject to sector rules.

For an external service, check at least:

• how customer data is used;
• retention periods;
• available processing regions;
• subprocessors;
• mechanisms for transfers outside the European Economic Area;
• deletion, audit and access-control options.

The U.S. CLOUD Act does not automatically make every U.S. service unlawful under GDPR. Conversely, choosing a European provider or a server located in France does not automatically establish compliance. The company must document the processing and assess its risks with the appropriate people.

2. The Actual Task

A general benchmark does not tell you whether a model recognizes your product references, follows your JSON schema or rejects an incomplete case.

Build a representative evaluation set with ordinary cases and exceptions. Measure business criteria: field accuracy, correct citations, schema compliance, false approvals, processing time and the quality of refusals.

Results can change with the prompt, tools, context length, language and quantization. Compare full configurations, not model names alone.

3. Total Cost

An API generally charges by usage. A self-hosted model reserves infrastructure even when request volume is low.

Include:

• API input and output charges;
• storage and supporting services;
• servers or accelerators;
• installation, monitoring and update time;
• regression testing after a model change;
• human recovery caused by errors.

For low and irregular volume, an API can cost less than running a permanent server. For stable volume, strict location requirements or customization, a controlled deployment may make sense. The break-even point depends on workload and hardware, not a universal request count.

4. Latency and Capacity

A compact model may be sufficient for background classification and inadequate for a long analysis. A frontier model may be unnecessarily expensive for extracting three known fields.

Measure 95th-percentile latency, throughput, maximum document size and peak-load behavior. Latency matters for real-time customer service. Stability and cost may matter more for overnight batch processing.

5. Operations and Portability

Self-hosting adds another application to maintain. The team must track patches, versions, saturation, configuration backups, secrets and incidents.

An API reduces this burden but introduces dependence on vendor quotas and model changes. In both cases, keep a clear interface between the workflow and the model. This makes comparative testing and vendor changes easier.

A Practical Decision Table

This table guides the assessment. It does not replace a security review or legal advice for sensitive processing.

Building a Hybrid System Without Fake Confidence Scores

A model does not always know the real probability that its answer is correct. Asking it to "give a confidence score" is not enough to automate a decision.

Routing should use observable signals: document type, mandatory fields, schema validation, business-rule checks, agreement between extractions, data sensitivity and evaluation results.

A hybrid flow can use four steps:

1. The workflow removes unnecessary data and qualifies the case.
2. The model suited to the task produces structured output.
3. Deterministic rules check fields, formats and business thresholds.
4. Cases that fail those checks go to another configuration or human review.

The second model does not remove the need for controls. It adds another processing path that must also be evaluated.

The Evaluation Protocol Before Production

Prepare a versioned corpus that reflects real cases and excludes personal data whenever possible. Define expected results and blocking errors. Then test each configuration with the same inputs and parameters.

Record at least:

• model version;
• prompt and available tools;
• results by case category;
• observed latency and cost;
• errors requiring human review;
• stop conditions and rollback procedure.

Choose the architecture from those results, then monitor it in production. A change in model, prompt or quantization can change behavior and requires the critical tests to be run again.

Sources Consulted

• OpenAI, GPT-5.6 launch, July 9, 2026.
• OpenAI, business data privacy, accessed August 13, 2026.
• OpenAI, data residency in Europe, updated in 2026.
• Anthropic, Claude Fable 5, accessed August 13, 2026.
• Mistral AI, Mistral Small 4, March 16, 2026.
• CNIL, guide to personal-data security, accessed August 13, 2026.
• European Data Protection Board, note on transfers to the United States, accessed August 13, 2026.

Choose the System, Not the Most Visible Model

The right choice is a complete system: model, hosting, contract, data, tests, human approval and recovery.

For a company, the safest approach is to test one limited task, measure errors and total cost, then expand. The open, proprietary or hybrid architecture follows from those results.

If you need to compare these options for a real process, my AI Consulting page describes the assessment work, while AI Agents covers production delivery with controls and human approval.