Classic ML, Real ROI: Why the CLOUD Act Still Matters Under revDSG

Large language models get most of the attention right now, but a large share of everyday business problems were already solved — reliably and cheaply — by classical machine learning long before anyone talked about chatbots. It is worth remembering what these methods are good at, and why running them on your own infrastructure has become a compliance question, not just a cost question.

Where Classical ML Already Pays for Itself

A handful of well-understood techniques cover most of the recurring forecasting and classification problems a business runs into:

• Time-series forecasting — ARIMA, Prophet, or LSTM models for demand forecasting, inventory optimization, and cashflow projections.
• Anomaly detection — Isolation Forest and autoencoders for fraud detection, quality control, and predictive maintenance.
• Classification — Random Forests, XGBoost, and SVMs for churn prediction, credit risk scoring, and automated document categorization.
• Clustering — k-Means and DBSCAN for customer segmentation and market analysis.

These are established, interpretable methods. They do not require a GPU cluster, they do not require an API key to a foreign provider, and in most cases a domain expert can explain exactly why the model produced a given output — something that is much harder to do with a large language model.

The Honest Trade-Off

Running these models yourself is not free. It means investing in infrastructure, in people who understand the techniques, and in ongoing maintenance — model drift does not fix itself. That is a real cost, and it should be budgeted as one.

What you get in return is independence: full control over your data, your models, and your long-term cost structure, instead of a recurring bill tied to usage you do not fully control. For a large class of well-defined business problems, a specialized, self-operated model is not a compromise — it is simply the better engineering choice. It tends to be faster, cheaper to run at scale, and easier to adapt to your own data than routing the same problem through a general-purpose LLM API.

The Regulatory Angle: CLOUD Act vs. revDSG

There is a second reason to keep this kind of processing in-house, and it has nothing to do with model quality.

The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) allows US authorities to compel a company headquartered in the United States to hand over data it controls — even when that data physically sits on a server outside the US, for example in Frankfurt. The moment a request is routed through the API of a US-headquartered provider, the data it carries can fall under that law, regardless of where the processing servers are located or which regional data center handles the request.

Switzerland's revDSG (the revised Federal Act on Data Protection, in force since 2023) governs how Swiss organizations must handle personal data, including where and how it may be transferred outside Switzerland. The two frameworks were not written with each other in mind, and the legal interplay between a US disclosure order and Swiss (or EU) data protection obligations is not fully settled. Providers typically offer contractual safeguards — standard contractual clauses, data processing agreements, no-retention policies — which reduce exposure but do not remove it. Any organization sending data to such a provider should weigh this risk deliberately and document that decision, rather than assume the question away.

Running classical ML models on your own infrastructure sidesteps the question entirely for the workloads these models cover: nothing is transmitted to a third party in the first place, so there is no cross-border disclosure risk to assess.

Not Every Problem Needs an LLM

None of this is an argument against generative AI — it is an argument for using the right tool. Classical ML remains the more economical, more explainable, and more legally straightforward choice for forecasting, anomaly detection, and classification workloads. Reserve the large models for the problems that actually need language understanding and generation.

That is also the design behind KeepUrAi: a self-hosted AI stack that keeps your data and your models on your own servers by default. If you want to see it in practice first, the hosted edition at qcg-ai.ch is a Swiss-operated service you can try without deploying anything yourself.