Say you're the office manager at a Fort Wayne law firm and a partner just asked whether paralegals can run client contracts through an AI tool to summarize them. Or you handle IT for a healthcare practice and someone on staff has started pasting patient notes into a chatbot to draft after-visit summaries faster. Or you're a school administrator and a teacher wants AI help writing IEP documentation. In every one of those situations, somebody eventually asks the same question: where does that data actually go once it leaves the keyboard?
This post is part of our series on buying a laptop that can run AI locally. If you haven't read the buyer's guide yet, start with Which Laptops Can Actually Run AI Locally? It covers what an NPU is and what qualifies as a Copilot+ PC. This one picks up where that leaves off: why the local-vs-cloud distinction matters if you handle regulated data.
What “On-Device” Actually Means
When AI runs on a laptop's own NPU, the data being processed never leaves the machine. No prompt gets sent anywhere. No document gets uploaded to a server for a language model to read. The processing happens on the silicon sitting on the desk in front of the person using it.
Compare that to a cloud AI tool. Type a prompt into most chatbots, or paste in a document to summarize, and that content travels over the internet to a third party's servers, gets processed there, and the result travels back. That's not a flaw in cloud AI. It's just how it works, and for a huge number of use cases it's completely fine. But it means the content briefly exists on infrastructure that isn't yours, governed by a vendor's terms of service rather than your own policies.
The Claim We Won't Make
Here's where we have to be careful, because this is exactly the kind of thing that gets oversold. Buying a laptop with an NPU does not make your organization HIPAA compliant. It does not make you FERPA compliant. It doesn't make privileged client work automatically protected. Compliance is the sum of encryption practices, access controls, staff training, vendor agreements, and written policy, not a hardware attribute. A device on a desk can't carry that weight alone, and anyone who tells a law firm or a hospital otherwise is selling something they can't back up.
What's honestly true is narrower, and it still matters: on-device processing removes one specific exposure point. The moment where a prompt or a document would otherwise travel to a cloud AI vendor's servers simply doesn't happen. That's one fewer third party in the chain, one fewer set of terms of service governing what happens to your content. For an organization already handling regulated data, that's a real factor. One piece of the puzzle. Not the whole puzzle.
Where This Shows Up in Practice
Law firms
A paralegal drafting a summary of a privileged document using a cloud AI tool is, as a matter of fact, sending that document's content to a third party's servers to get the summary back. That's worth knowing and worth having a firm policy about, separate from whatever a client engagement letter says about confidentiality.
Healthcare practices
A staffer using a general-purpose chatbot to help draft a note from a patient record is transmitting that content off-site, to a vendor the practice likely hasn't vetted through a business associate agreement. That's a specific, describable behavior, not a hypothetical risk.
School districts
A teacher using AI to help write documentation tied to a specific student is doing the same thing: sending student-record content to a server outside the district's control. FERPA doesn't care whether the intent was helpful. It cares what happened to the data.
Hardware Gives You the Option. It Doesn't Make the Decision for You.
An NPU-equipped laptop gives an organization the option to keep certain AI-assisted work off the cloud when it matters. But only if the local tools actually get used instead of the cloud versions that ship by default on almost every device. We've set up machines for clients that had local AI capability sitting unused for 11 months because nobody configured it, nobody trained staff on it, and the cloud chatbot bookmarked in everyone's browser was easier to reach.
The step that matters more than the hardware purchase: write down which AI tools staff can use with which categories of data. Not a spec sheet, an actual policy, even a one-page one. Client-privileged documents go through this tool, never that one. Patient information doesn't get typed into anything outside the approved list. Student records stay off general chatbots entirely. A 40-person practice can draft that policy in an afternoon, and it does more for real data governance than any single device purchase.
If you're looking at a fleet refresh and want the local-AI option available for the roles that need it, that's a separate conversation about which machines make sense. We cover that angle in our piece on whether your business actually needs Copilot+ PCs. But write the policy first, or at least alongside the hardware order. A device without a policy just moves the risk around instead of reducing it.
Figuring out AI policy alongside a fleet refresh?
We help Fort Wayne law firms, healthcare practices, and schools sort out both the hardware and the questions that come with it.