Wrapping a public model is the fastest start.
Connecting a hosted model to your approved documents through retrieval gets a working assistant in front of users fastest, with data access controls handled at the retrieval layer rather than inside the model itself.
Self-hosting solves a specific problem, not a general one.
If your industry or contracts require your data never to leave infrastructure you control, self-hosted deployment is the real answer. It costs more to run and needs a team to maintain it. Choose it because of a genuine constraint, not because self-hosted sounds more serious.
Fine-tuning is rarely the first move.
Training a model on your data changes its behaviour, not its access to your latest information. Most businesses asking for a custom AI actually need retrieval against current documents, which is simpler to build, test, and keep accurate.
Access control is the part people underbuild.
Whichever path you choose, define who can see each source before you launch, and make sure the system respects that boundary as documents change and staff turn over. This matters more than which model you pick.
Start with one narrow, well-scoped use case.
A single well-defined job, answering questions from an approved policy library, for example, is easier to evaluate and trust than a broad promise to search everything. Expand once the first deployment earns that trust.
Bring your workflow, your constraints, and the outcome you want to achieve.