--- title: "The house AI tool: your team is already using AI, just not on your account" subtitle: "One chat tool your people are allowed to use, running on hardware you own for anything with a customer's name in it, plus the two short lists that turn an unwritten habit into something you can show anyone who asks" url: "https://rxed.ai/blueprints/sanctioned-ai-workspace.html" id: "sanctioned-ai-workspace" version: "1.0" published: "2026-08-25" kind: "workflow" setup_effort: "A weekend" setup_hours: "6-12" running_cost_usd_per_month: "0-30" paid_software_usd_per_month: "0" time_saved: "low" time_saved_basis: "This one does not buy back hours and should not be sold as if it does. What it buys is that the customer data your staff paste into a chat box stays on a machine you own, and that the day something goes wrong you can point at a dated line in a register instead of at nothing" runs_by: "" data_location: "" data_location_note: "" first_to_break: "" failure_signal: "" problem: "Your staff are already using AI at work, mostly on their own personal accounts, and nobody has written down what they may and may not type into it. If something goes wrong, you have nothing to show that you ever set a rule." fix: "Give the team one AI tool on an account you control, with anything containing a customer's name handled by a model running on a machine in your own building. Next to it keep two short lists: what the tool is for and what it must never see, and who was told the rules on what date." tools: [] tech: ["Open WebUI", "Ollama", "LiteLLM", "NocoDB", "Docker"] repos: - name: "Open WebUI" url: "https://github.com/open-webui/open-webui" - name: "LibreChat" url: "https://github.com/danny-avila/LibreChat" - name: "Ollama" url: "https://github.com/ollama/ollama" - name: "LiteLLM" url: "https://github.com/BerriAI/litellm" - name: "NocoDB" url: "https://github.com/nocodb/nocodb" - name: "Baserow" url: "https://github.com/baserow/baserow" categories: ["Local AI", "Self-hosted", "Privacy", "Security", "Documents & archive"] source: "RXed AI News — https://rxed.ai" --- # The house AI tool: your team is already using AI, just not on your account > One chat tool your people are allowed to use, running on hardware you own for anything with a customer's name in it, plus the two short lists that turn an unwritten habit into something you can show anyone who asks Your people are already using AI at work. The only open question is whose account it sits on, and whether you can show anyone what you did about it. Give them one door you control, keep the sensitive work on a machine you own, and write down the two things a regulator would actually ask for. ### The problem Banning it does not work, and the numbers say so. LayerX's 2025 enterprise data-security report found that 77% of employees who use AI chatbots at work paste data into them , and that 82% of those pastes come from personal, unmanaged accounts . Cyberhaven measured the same shift from the data side: the share of corporate content going into AI tools that counts as sensitive rose from 10.7% to 34.8% in two years . IBM's Cost of a Data Breach put shadow AI in 20% of breached organisations in its 2025 edition, adding roughly $670,000 to the average breach; published summaries of the 2026 edition report that share more than doubling, to 43% , against a record global average breach cost near $5 million . Those samples are large enterprises, not four people and a counter, so read the direction rather than the decimal. The direction is not ambiguous. The part most owners get wrong is that the tool is not the risk. The account is. On the consumer tiers of the big assistants, your conversations may be used to improve the models unless someone goes into the settings and turns that off, one person at a time, on their own phone. On the business and enterprise tiers, and on the APIs, the default is the opposite: not used for training unless you opt in, with a data processing agreement you can actually sign, and API inputs typically held for a short retention window for abuse monitoring. Same logo, same chat box, different product. Your receptionist pasting a customer's phone number into a free personal account, and the same sentence typed into a paid workspace seat, are two different events in law. Then there is the duty nobody told you about. Article 4 of the EU AI Act has applied since 2 February 2025 . It requires providers and deployers of AI systems to take measures to support the AI literacy of their staff and of anyone operating AI on their behalf, which includes contractors. If someone in your business uses ChatGPT, Copilot, Gemini or an AI feature inside a tool you already pay for, you are a deployer. The Commission's own Q&A answers this exact case: a company whose employees use ChatGPT to write ad copy or translate text does have to comply, and the staff "should be informed about the specific risks, for example hallucination". Now the honest half, because most of what is written about this is scarier than the law. The Digital Omnibus on AI, Regulation (EU) 2026/1744 , entered into force in mid-July 2026 and amended Article 4: AI literacy stays an obligation for providers and deployers, but no specific, or "sufficient", level is mandated any more. The Commission's Q&A, last updated 27 July 2026, is equally clear on what you do not need. There is no certificate : "organisations can keep an internal record of trainings and/or other guiding initiatives." There is no obligation to test employees . There is no AI officer and no governance board . What changed this month is enforcement, not the rule: national market surveillance authorities started supervising and enforcing as of 2 August 2026 , on the basis of national penalty laws, and the Commission says explicitly that sanctions must be proportionate and are more likely "if there is proof of an incident due to lack of appropriate training and guidance". Read that sentence twice. The exposure is not an audit. The exposure is the day something goes wrong and you have nothing written down. So the job is small and it is two things. Give the team one AI tool they are allowed to use, on an account you control. Keep a file that says what it is for, what it must never touch, and who was told what, on what date. Everything below is how to build that in a weekend without a subscription. ### The architecture [ the team ]  laptop · phone · the tablet at the counter         │  one login, your own address: ai.yourbusiness.example         ▼ [ Open WebUI — the one door ]   accounts, groups, who sees what         │  looks like the chat they already use, so they use it         ├──────────────────────────┐         ▼   anything with a name in it     ▼   everything else [ Ollama — your own box ]     [ LiteLLM — the meter ]   ├─ customer records, contracts   ├─ one paid key, held by you   ├─ staff files, health notes     ├─ a budget per person   └─ never leaves the building    └─ business tier: no training [ the two files — NocoDB ]   the part that is actually the deliverable   ├─ the use list : what we use it for, what it must never touch   └─ the told list : who was told, what they were told, on what date One box, three containers, two tables. The split down the middle is the whole design: work that contains a person's name goes to a model running on hardware you own, and everything else goes out through one key you can meter and switch off. Staff never choose which. The tool is configured so the sensitive model is the default and the outside route is the deliberate step. ### Tool choices — and why First, the cheapest answer: if you already pay for Microsoft 365 or Google Workspace, you may already own a sanctioned door. A business tier with the AI feature switched on, plus the two files below, satisfies most of this without a single container. Build the rest only if you have work that genuinely should not leave the building, or if you refuse to pay per seat for people who use it twice a week. Open WebUI (149.8k stars, v0.11.0 on 27/07/2026, commits this week) is the door. Accounts, groups, per-group model access, an admin view, document upload for question-answering over your own files, and a chat window your staff will recognise from the first second. Read the licence before you deploy it: it is not OSI open source . It is a BSD-3 base plus a branding clause that forbids removing or replacing the "Open WebUI" name and logo, with an exemption for deployments of fifty end users or fewer in any rolling thirty days . Under fifty people you may put your own name on it. Over fifty, you keep their branding or you buy an enterprise licence. LibreChat (42.4k stars, MIT, commits this week, v0.8.8-rc1 tagged 14/08/2026) is the alternative if a plain permissive licence matters more to you than polish. Same shape: multi-user, multi-provider, self-hosted. Ollama (179.4k stars, MIT, v0.32.15 on 19/08/2026) runs the in-house model. On a machine with 32 GB and a real GPU or Apple silicon, gemma4:12b or qwen3.6:27b are comfortable working assistants; on 16 GB, gpt-oss:20b is the usual pick. Be honest with yourself about the gap: a model on your own box in 2026 is a good drafting and summarising assistant, and it is not the frontier. On a CPU-only VPS it is slow enough that people will quietly go back to their phone, which defeats the entire exercise. Test the speed on your actual hardware in the first hour, not after the rollout. LiteLLM (57.2k stars, v1.98.0 on 23/08/2026, MIT core with separately-licensed enterprise directories) is the meter on the outside route. One paid key that you hold, virtual keys per person, a hard monthly budget, and a log of what was spent by whom. It is what stops a business API key becoming an unbounded bill, and it gives you usage evidence without reading anyone's chats. NocoDB (64.7k stars, 2026.08.1 on 19/08/2026) holds the two files. Note the licence: NocoDB moved to the Sustainable Use License on 29 January 2026 , free for internal business use. Running your own AI register is internal use. If you want a permissive core instead, Baserow does the same job. A shared spreadsheet also works, and a spreadsheet you actually fill in beats a database you don't. Monthly cost. Software: €0, all of it. Hardware is the real line, and it is a one-off, not a subscription: a second-hand mini PC or Mac with 32 GB is the entry point, and electricity for a box that idles most of the day is a few euros a month. A small VPS at €5–12/month runs the door and the register fine, but not the model. If you also want frontier quality for the non-sensitive half, business seats at the major vendors sit around €23–28 per user per month with a two-seat minimum, or pay-per-use API credits through LiteLLM, which for a small team is usually the cheaper of the two. Verify the current price and, more importantly, the current training terms on the vendor's own page the day you sign. Those terms are the reason you are paying. ### Setup outline 1. Write the use list first, on one page, before you install anything: the five jobs AI is for in your business (draft this email, summarise this thread, translate this text, tidy these notes, explain this document), and the short list it must never touch. Names, health, payroll, bank details, anything under a signed confidentiality clause. One page. Your staff will read one page. 2. Deploy Open WebUI with Docker behind HTTPS on a subdomain, and turn off open sign-up immediately. You create the accounts. 3. Install Ollama on the same machine, pull one model, and time it. If a two-paragraph answer takes longer than the person would take to write it themselves, change the model or change the machine before step 4. 4. Put LiteLLM in front of the outside route with a virtual key and a monthly budget per person. Start the budget low. Nobody has ever complained that their AI budget was raised. 5. Set groups: which people can reach the outside route at all, and which are local-only. In most small businesses that is two groups, and the local-only one is the larger. 6. Set log retention deliberately, then write the number down. Chat logs contain whatever your staff typed, which means they are personal data. Ninety days is a defensible default; forever is not. 7. Run one session of forty-five minutes with the whole team. What it is for, what it must never see, that it invents things confidently and that is the main risk, and how to check an answer before it leaves the building. Then log it in the told list: date, who was there, what was covered, the one page they were given. 8. Repeat step 7 for every new starter as part of induction, and once a year for everyone. That recurring line in the register is the entire compliance artefact. ### Pitfalls — the real ones The register is the deliverable, the box is the excuse to build it. Deploy the whole stack and skip the two files and you have bought yourself a chatbot, not a defence. The Commission asks for an internal record of trainings and guiding initiatives. That is a table with dates in it, and you can have one this afternoon. Blocking the consumer tab is the losing move. People used their own accounts because nobody gave them anything better. If your sanctioned door is slower, uglier or needs a VPN, it will lose to the phone in their pocket, and you will have moved the leak instead of closing it. Do not point this at decisions about people. Screening job applications, ranking staff, monitoring performance: that is high-risk territory under the AI Act with a completely different obligation set, and it is not what this build is for. Keep the assistant on drafting and summarising, and keep humans on judgment. If you put an AI in front of customers, you must say so. The transparency duties in Article 50 apply from 2 August 2026, and a customer talking to a chatbot has to know it is a machine. That is a different project than an internal assistant, and it carries its own disclosure. Your logs are now a GDPR asset you did not have last month. They sit inside your retention policy, your access controls and any access request you receive. Decide who can read them before someone reads them. Tell them about hallucination by name, in plain words. Not "limitations of generative models". "It will invent a supplier's phone number and sound completely certain, so check anything that leaves this building." The Commission's own example is hallucination, and it is also the failure your business will actually meet. ### Verified repos [Open WebUI](https://github.com/open-webui/open-webui) — Open WebUI License (BSD-3 plus a branding clause, exempt under 50 users), 149.8k stars, v0.11.0 (July 2026), active [LibreChat](https://github.com/danny-avila/LibreChat) — MIT, 42.4k stars, active (August 2026) [Ollama](https://github.com/ollama/ollama) — MIT, 179.4k stars, v0.32.15 (August 2026) [LiteLLM](https://github.com/BerriAI/litellm) — MIT core, enterprise directories separately licensed, 57.2k stars, v1.98.0 (August 2026) [NocoDB](https://github.com/nocodb/nocodb) — Sustainable Use License since 29/01/2026 (free for internal business use), 64.7k stars, 2026.08.1 (August 2026) [Baserow](https://github.com/baserow/baserow) — MIT open-source core, premium and enterprise directories separately licensed, active (2026) Get the next blueprint as it publishes — free, practical, verified tooling only. [Subscribe](https://subscribe.rxed.ai) · Want this audited or extended for your business? DM [@RXed_EU](https://x.com/RXed_EU)