AI Agent Deployment: On-Premises, Private Cloud, Hybrid or SaaS, and How Regulated Enterprises Choose

AI agent deployment is the choice of where each part of an agent system runs and who operates it: the model, the runtime that executes the agent loop, the tools it calls, the data it retrieves and the logs that record what it did. There are five models: multi-tenant SaaS, a vendor-hosted dedicated tenant, your own private cloud or VPC, your own data centre, and an air-gapped network. Regulated enterprises choose per workload, by data class, applicable regulation and whether any component still sends data back to a vendor.

The decision carries more weight than it did a year ago. The EU AI Act expects deployers of high-risk systems to keep the logs those systems generate “to the extent such logs are under their control”, which turns the location of an agent’s trace store into a compliance question. Financial entities have operated under DORA since 17 January 2025 and remain fully responsible for compliance whenever they rely on an ICT service, wherever it runs.

If you already know everything must stay inside your perimeter, two existing guides go further: the vendor-by-vendor comparison of on-premises agentic platforms tests fifteen products, and the pillar guide to running agent platforms on your own servers defines the category. This article covers the choice that comes before both.

The five AI agent deployment models

Vendors use “private”, “dedicated” and “on-premises” loosely. Pin every offer to one of these five rows before comparing anything else.

Two variants sit between the rows. A sovereign cloud region is a vendor-hosted model with jurisdiction and personnel commitments added; the trade-offs against running the platform yourself are set out separately, and the European policy context is covered in our overview of sovereign AI in Europe. Some vendor contracts also call a dedicated tenant in the vendor’s own account “private cloud”, so check whose account and whose encryption keys sit behind the label.

Four of these modes have their own pages on architecture and controls: self-hosted, private, sovereign and air-gapped.

What actually runs where

A deployment model is shorthand for seven placement decisions. A platform installed in your data centre can still send traffic out through any one of them, so place each component separately.

• Model inference receives the full prompt, including retrieved passages and tool results, so whoever runs the endpoint processes your most sensitive context, request by request.
• Orchestration and the agent runtime plan steps, call tools and keep run state and short-term memory. Run state holds intermediate data and decisions, and the runtime holds the credentials it uses for tools.
• Tools and connectors, meaning MCP servers, HTTP tools and code runners, read and change business systems. A tool hosted elsewhere carries data across your boundary on every call the agent makes.
• The vector store and source data hold embeddings, indexes and the documents behind them. Embeddings derive from confidential text and need the same residency and deletion rules as the source.
• Logs, traces and audit evidence capture inputs, retrieval hits, tool arguments, model outputs and approvals: the record a supervisor or court will ask for, and a copy of everything listed above.
• The control plane and admin console hold agent definitions, prompts, policies, users and role mappings. Whoever operates them decides what agents are allowed to do.
• Telemetry, licensing and updates cover usage metrics, crash reports, licence checks and the update channel: the quietest outbound path, and the one reviews most often miss.

Read each proposal against the table row by row. A design that keeps inference local but ships traces to a vendor’s observability service has moved the most complete copy of your data out of the building. The hardware, network zones and sizing beneath these components are covered in the reference architecture for on-premises AI, and the components themselves in our breakdown of agentic AI architecture.

Hybrid AI agent deployment: patterns that hold, and the hybrid that isn’t

Hybrid suits most large organisations, because their workloads do not share one risk profile. Four patterns hold up under audit:

1. Split by workload. Agents that touch regulated data run on-premises; agents that summarise public material use a cloud service. Both sit in one registry under one policy set.
2. Route by data class. A model gateway sends each request to a local or an approved external model according to the classification of the data in the prompt, and refuses when no compliant route exists.
3. Build outside, run inside. Teams prototype on cloud capacity with synthetic or public data, then promote the tested agent definition into the data centre, where it meets real data for the first time.
4. One control plane, several sites. A control plane you operate manages runtimes in two data centres, or in a data centre and your own cloud account, so agents can fail over without leaving your custody.

The pattern to reject looks hybrid on a slide but leaves the control boundary with the vendor. The agent runtime sits in your network, yet a vendor-hosted control plane receives prompts for quality monitoring, collects traces for its dashboards, stores evaluation sets or must answer a licence heartbeat before the runtime will start. Each is either an outbound copy of sensitive content or an off-switch held by someone else.

Built-in tools deserve the same suspicion. Microsoft’s own baseline reference architecture for its agent service notes that the built-in web search tool “bypasses the egress subnet entirely”, and tells architects to test every built-in tool against their egress policy. If a hyperscaler documents that gap in its own design, assume other platforms have similar ones until a test proves otherwise.

The test is a blackout. Block all outbound traffic from the platform’s network, run the full regression suite and record what fails; every failure is a dependency the contract must name. The guide to proving no hidden callouts shows how to run it, and a control-boundary comparison of three agent platforms applies the same reasoning to named products.

On-premises vs cloud AI agents, side by side

Cost shifts the balance in every row and deserves its own analysis. The breakeven method for self-hosted inference and the full-cost guide for on-premises platforms work through the numbers, so this guide leaves them there.

A decision matrix for regulated enterprises

Score each workload, not the organisation. The column with the most marks is the starting point, and a single hard constraint, such as a classified data source, overrides the count.

What each regulation changes

EU AI Act. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk obligations for Annex III use cases to 2 December 2027, and to 2 August 2028 for AI built into products under Annex I. Under Article 26, deployers of high-risk systems must assign human oversight and keep automatically generated logs for at least six months, so the location of the trace store becomes an architecture decision. The guide to the EU AI Act for AI agents covers the rest.

DORA. Financial entities keep full responsibility for compliance when they use ICT third-party services, and Article 30 requires contracts to name the regions where data is processed and stored and to grant access and audit rights. On 18 November 2025 the European Supervisory Authorities designated the first 19 critical ICT third-party providers for direct EU oversight, among them the EU entities of Amazon Web Services, Google Cloud and Microsoft. Running a platform on-premises does not by itself take it out of DORA: ICT services are defined as digital and data services provided on an ongoing basis, the Commission’s answer in the supervisors’ Q&A calls that definition intentionally broad, and each financial entity must assess what it relies on, including licensed software that comes with continuing support and updates. DORA and AI goes further.

GDPR transfers. When a SaaS agent processes EU personal data in the United States, the transfer usually rests on the EU–US Data Privacy Framework adequacy decision of 10 July 2023, which covers only self-certified recipients. The General Court upheld that decision on 3 September 2025, and an appeal, Case C-703/25 P, was still pending at the Court of Justice on 6 November 2026. Separately, the US CLOUD Act of 2018 requires providers subject to US law to comply with US legal process for data in their possession, custody or control, wherever it is stored.

NIS2. Essential and important entities must manage supply-chain security, including the security aspects of their relationship with each direct supplier, under Article 21(2)(d). For an agent platform, that reaches the model sources, update servers and telemetry endpoints as well as the vendor contract.

Questions to put to every vendor

Ask in writing and file the answers with the contract. The 66-question RFP checklist for agent platforms holds the long version.

1. Which components open outbound connections, to which destinations and for what purpose, and can each be switched off without losing support?
2. Where are prompts, traces, embeddings and evaluation sets stored, for how long, and which vendor staff can read them?
3. Does any vendor-hosted service receive prompt or response content, even sampled or “anonymised”?
4. How do updates arrive? Are packages signed, can you import them offline, and can anyone change your installation without your approval?
5. Does the licence validate offline, and does the platform keep running when validation fails or the licence lapses?
6. How does remote support work: access you grant per incident, recorded and revoked afterwards, or standing credentials?
7. Which built-in tools call external services, and do all of them route through your egress proxy?
8. Can every model endpoint point at servers you run, with external models disabled by policy?
9. In what format can you export agent definitions, workflows, logs and audit records, and what does leaving cost?
10. Which identity providers connect natively, and which only through a reverse proxy?

Answers to questions 1, 3 and 5 settle whether a “hybrid” offer is hybrid at all. For cloud services, the EU Data Act has applied since 12 September 2025: providers must remove obstacles to switching, including to on-premises infrastructure, and from 12 January 2027 they may no longer impose switching charges. Contract terms still matter more than statute here, and the principles for a portable agent platform set out what to secure. VDF AI publishes its own deployment answers in its trust centre; hold every vendor, VDF included, to the blackout test. When the model is chosen, the production deployment checklist takes the build step by step.

How VDF AI fits

VDF AI runs in VDF’s managed cloud (VDF AI Cloud), in your own data centre, in a private cloud or VPC, in a sovereign cloud, or fully air-gapped, so the deployment decision can follow each workload rather than the vendor’s preference. VDF AI Router puts policy before every model call, with allow, deny and pin lists, approvals for regulated domains and an air-gap mode that routes to local models only; each routing decision is returned with its reason and the candidates it weighed.

Agents built in VDF AI Agents and orchestrated in VDF AI Networks leave a per-agent audit log and execution trace covering the input and identity, retrieval hits, tool calls and arguments, the model’s response and the final output. The governance layer registers every agent, Network and model with an owner, purpose, risk class and version, and third-party agents such as Copilot or watsonx agents can be registered under the same layer, which keeps a hybrid estate in one inventory. The Vault keeps a cryptographically durable record of each execution, and evidence packs for the EU AI Act or a sector audit are assembled from those records.

On-premises, Microsoft Entra ID single sign-on is native, with security groups mapped to roles; Okta, Keycloak, generic SAML or OIDC and LDAP connect through an SSO-aware reverse proxy, and role-based access control is included on every plan. On-premises licences are sold as seat bundles, and each bundle can begin with a three-month free platform trial, during which the vendor questions above can be tested against your own network.