Choosing Between AI Deployment Options
Two decisions sit between picking a model and running it. Where will the model execute, and how far will it change? AI deployment options get discussed as infrastructure. They are governance choices. Each one shifts where risk lands, what evidence you can produce and, in one case, which legal role you hold.
The AIGP Body of Knowledge is the IAPP document that sets out what the exam covers. It places this in Domain IV, governing AI deployment and use. Questions there describe a situation and ask which option fits. So the definitions have to be exact.
AI deployment options by environment
Cloud deployment hands the infrastructure to a provider. Capacity flexes on demand. Managed services carry part of the security work. The operator gives up direct control over configuration and over where data physically sits.
On-premise deployment keeps the model inside your own estate. Control over data, security configuration and access reaches its highest point here. That is why confidentiality-critical processing in a regulated setting tends to land on-premise.
The estate also evolves more slowly. Validated behaviour stays stable across releases. Patches arrive later.
Edge deployment runs the model on or near the devices generating the data. Latency falls. Raw data moves less. Operation continues when connectivity does not.
The trade is visibility. Monitoring and updates get harder across a distributed and intermittently connected fleet.
Hybrid estates spanning cloud, on-premise and edge are ordinary in large organisations. Each environment can carry its own governance terms rather than one blanket policy.
How far the model changes
The second half of the AI deployment options question concerns the model itself.
Using a model as it comes
Nothing changes the weights. No retrieval layer sits underneath. Governance concentrates on use-case fit, monitoring and the terms of the licence.
Fine-tuning
Fine-tuning trains a pre-trained model further on domain data. It adapts the model to a task or an organisational context. The weights change. So data governance obligations attach to the tuning set: lawful rights to use it, quality, provenance and documentation.
Retrieval augmented generation
Retrieval grounds outputs in content drawn at request time from designated knowledge sources. The weights stay untouched. Governance moves to the corpus instead. That covers access control, permissions inheritance and freshness. A stale or over-broad corpus produces confident answers from the wrong material.
Agentic architectures
Agentic designs plan, use tools and act with limited human direction. Governance moves again. It lands on the privileges the agent holds, the tools it can reach, and the points where a person has to approve rather than review after the fact.
When adaptation changes your legal role
This is where AI deployment options meet a hard legal edge. Article 25 of the EU AI Act treats a distributor, importer, deployer or other third party as the provider of a high-risk AI system. The provider obligations in Article 16 then apply.
Three situations trigger it. Putting your own name or trademark on a high-risk system already on the market. Making a substantial modification to a high-risk system that remains high risk. Modifying the intended purpose of a system, including a general-purpose one, so that it becomes high risk.
The consequence does not split between the two of you. Where one of those situations occurs, the initial provider stops being the provider of that system. It has to cooperate closely with the new provider. It also has to supply the information and the reasonably expected technical access needed to meet the obligations, particularly around conformity assessment. That duty falls away where the initial provider clearly specified that nobody should turn its system into a high-risk one.
Article 25 also requires a written agreement. It binds the provider of a high-risk system and any third party supplying tools, services, components or processes integrated into it. The agreement sets out the information and technical access that compliance needs. Suppliers offering tools to the public under a free and open-source licence sit outside that requirement, unless what they supply is a general-purpose AI model. The Regulation as published in the Official Journal carries the full text.
So fine-tuning does not automatically change your role. Adapting a general-purpose model until it performs an Annex III task can.
Reading AI deployment options in a scenario
Exam scenarios rarely name the option. They describe a constraint and expect you to reason from it. That is where the vocabulary earns its keep.
Latency, offline operation and processing near the source point at the edge. Maximum control over data, configuration and access points on-premise, even where a cloud answer offers managed security as its reason. Elasticity and unpredictable load point at cloud.
Grounding answers in current documents points at retrieval rather than fine-tuning. Adapting tone, format or domain behaviour points the other way. Planning and tool use with limited direction points at an agentic design.
Work the constraint first and the option second. Reading in the other direction is how a plausible answer beats the correct one.
The AIGP study guide sets out the order to work through Domain IV. The piece on answering at the right lifecycle stage covers the related trap of picking a control that belongs to a different phase.
