BYOK and the model choice: what it really means

Mike, MikeRust, and the responsibility that transfers to the practitioner the moment they enter their API key.

*Italian version*

There’s a scene playing out in many practices around the world these weeks. A colleague downloads Mike, or our desktop evolution **MikeRust**, opens it, and faces a dropdown menu reading “choose your LLM provider”: Anthropic, Google, OpenAI, Mistral, local vLLM, Ollama. A three-second selection. Click.

It looks like a technical preference. It isn’t.

Will Chen, Mike’s author, positions his platform as the open source alternative to Harvey and Legora. In Europe the conversation translates to different names — Lexroom, Simpliciter, Normo and Aptus in the Italian market, with their German, French and Iberian counterparts — but the dynamic is identical: commercial platforms wrapping frontier models, pricing aligned to positioning, integration with local databases. Mike and MikeRust don’t replace these platforms — they open a parallel path in which the practitioner speaks directly to the model and keeps control of the data chain.

The concrete recommendations in this article are calibrated for the European practitioner, but the framework applies across jurisdictions: the names of the regulations change, the principles don’t.

What BYOK really is

BYOK stands for Bring Your Own Key. You activate an API key with your chosen provider, pay that provider directly for the tokens you consume. No software markup, no per-seat license, no enterprise contract.

Economically, it’s a revolution. Contractually, it’s something more subtle. By activating BYOK, the practitioner personally becomes the principal in a contractual relationship with a third-party vendor that processes their clients’ data. There’s no software company that has already negotiated the DPA on your behalf, no familiar “we’ve defined how we handle your data in our terms of service”. All of it falls directly on the practitioner.

Mike under AGPL-3.0 and MikeRust prepared by Semplifica under the same license don’t sell you a service, don’t process your data, aren’t your data processor. The external processor is the API key vendor — and you choose them.

The invisible gesture and the supplier choice

Every time you upload a document and press enter, the bytes of that document — with your client’s name, the matter number, the counterparty, the dates — leave your machine, reach a server, get processed, return. That server belongs to someone with a registered office, a jurisdiction, a downstream supply chain.

Choosing the supplier isn’t only a technical decision — model quality, response speed — it’s also a formal, contractual, compliance decision, and it shapes the steps of your workflow. Choosing a model under US jurisdiction forces you, for consistency, to pseudonymise before sending. Choosing a European model reduces but doesn’t eliminate that need. Choosing a local model makes it optional. Touching the model choice means, sooner or later, touching the document workflow of the firm.

Three steps, from least to most secure

True anonymisation. Names, tax IDs, VAT numbers, addresses are replaced with irreversible generics. No way back to the originals. Secure but cumbersome: the model’s response can no longer be re-mapped to the real client.

Reversible pseudonymisation with a tightly held mapping table. Identifiers become stable codes (“Client A”, “Company Alpha”), and an encrypted local mapping table — the de-pseudonymisation table — sits on disk, accessible only to the practitioner. The model sees codes; the practitioner receives the response and re-maps it internally. For 95% of practical cases this is the reasonable trade-off.

No pseudonymisation. Documents go to the model in the clear. Acceptable only if the model runs on your own machine or on infrastructure you fully control.

A note of intellectual honesty: the CJEU’s EDPS v. Single Resolution Board ruling has made clear that pseudonymisation isn’t a free pass. If you hold the mapping table, that data remains “personal” for you under the GDPR. The value of pseudonymisation is that the recipient (the LLM provider, who doesn’t hold the table) doesn’t have reasonable means to re-identify the individual. In the event of a provider data breach, a foreign government access request, or future use of prompts for model training, the difference matters significantly.

Five levels of guard

Not all providers are equal. Not in quality — by now comparable for most tasks — but in who sees what, under which law, with which downstream subprocessors. Five levels, from most reassuring to least.

Level 1 — Local model. MikeRust’s “Private AI” with Qwen, Gemma, or Mistral self-hosted via vLLM or Ollama on the practitioner’s workstation, or on a dedicated GPU instance at a European provider like Seeweb. Nothing leaves the firm’s network.

Level 2 — European model, European company, European infrastructure. Mistral. Headquartered in Paris, datacentre in France, governed by French law, GDPR by design — no Standard Contractual Clauses required. No CLOUD Act, no FISA.

Level 3 — US company, European infrastructure, explicit delivery. OpenAI via eu.api.openai.com, Google Gemini through Vertex AI in Milan or Turin, Anthropic Claude via AWS Bedrock Frankfurt. Inference happens on European servers, DPAs provide for in-region processing, but the parent company remains under US jurisdiction. The CLOUD Act of 2018 provides in theory that a US federal authority can compel a US provider to disclose data stored in Europe. For this level, pseudonymisation should be applied.

Level 4 — Non-EU provider with “EU marketing” residency. Providers that advertise “EU data residency” without the technical components being genuinely separated from the originating jurisdiction. Pseudonymisation mandatory.

Level 5 — Non-EU provider with default delivery outside Europe. Anthropic’s direct API and OpenAI’s standard API without EU routing, but also Chinese providers (DeepSeek, Qwen via Alibaba Cloud, Baidu Ernie, Zhipu). For European practitioners, this level requires robust pseudonymisation and a solid DPA with no-training clauses (Zero Data Retention). Without these two conditions, it shouldn’t be used for client documents. With both, it’s technically usable but remains the least defensible choice when equivalent European alternatives exist. For Chinese providers there’s an additional structural problem: China requires local providers to make data available to authorities on request, and the GDPR does not recognise the adequacy of Chinese data protection law.

Monthly cost for a single practitioner

Mike and MikeRust were built as BYOK tools for single users — one practitioner, one workstation, one API key (although Mike is web-based and natively supports multi-user access). Monthly cost estimate for daily professional use (drafting, summarisation, Q&A, formal checks), with prompt caching active where available:

For the single practitioner, the EU native API offers the best cost/sovereignty ratio. Self-hosting becomes worthwhile when the instance is shared with other colleagues in the firm: fixed cost spreads out, and at scale the per-user cost drops below €20 per month while maintaining Level 1 sovereignty.

The more you can manage, the lower you go

The more the practitioner (or their IT) can autonomously manage the infrastructure, the further they move toward Level 1. Self-hosting an LLM on your own GPU, or a dedicated instance at a European provider managed by a trusted DevOps consultant, is the only form of full data sovereignty: no subprocessors, no foreign jurisdiction, no DPA, no transfer.

There is a competence cost: someone needs to configure vLLM, monitor the instance, update the models. Not the average lawyer’s skill set, but reliably delegatable to an external consultant for a few hundred euros a month. This is the direction many mid-sized firms are taking. The difference from a year ago is that MikeRust radically simplifies deployment: single binary, a workstation with consumer-grade GPU, done.

Three operational habits

Any firm integrating Mike or MikeRust into its daily workflow should develop three habits, regardless of the chosen model.

The pseudonymisation table lives in an AES-256 encrypted file with a passphrase that isn’t written down anywhere. Not in an Excel sheet on Dropbox, not in a text file on the desktop. If the table leaks, pseudonymisation collapses.

The AI processing register is an internal table the firm maintains. Which model for which type of matter, in which region, with which level of pseudonymisation. The GDPR already requires this in general form (Article 30); the EU AI Act, from 2 August 2026, will require it in greater detail for high-risk uses.

No output leaves the firm without human review. AI handles 70% of the mechanical work; the remaining 30% is professional judgement, and that stays entirely yours.

A note on Claude for Legal

On 12 May 2026 Anthropic published claude-for-legal, an Apache 2.0 repository with twelve vertical plugins for legal practice and over eighty specialised agents. By market reaction metrics — thousands of stars in a few days — it is the biggest legal tech event of the year.

What does it change for this article’s framework? claude-for-legal doesn't shift Claude's position within the five levels of guard (still Level 3 with Bedrock). It significantly increases Claude's functional value, however: now "choosing Claude" no longer means just "having a good model" — it means "having a free professional plugin infrastructure".

It also increases the risk. The more powerful and document-heavy the workflows on Claude become, the more pressing it gets to defend the data upstream. This is the topic of the next article: what claude-for-legal does well, and what it doesn't protect — because there's a systematic misunderstanding between those who think they have solved privacy compliance by installing a plugin called "privacy-legal" and what that plugin actually does.

Model quality matters less than it seems

The raw quality gap between Claude Opus 4.7 (top of the line, US, $25 per 1M output tokens) and Mistral Medium 3.5 (EU native, $2 per 1M, equivalent on many practical tasks) is real but overrated. For 90% of a professional firm’s tasks, Mistral Medium 3.5 produces substantially equivalent output, in native local languages, on European infrastructure, at a fraction of the cost.

The premium American models make sense for the 10% of edge cases: high-stakes opinions, complex litigation, controversial matters. For that 10%, the quality justifies both the cost and the higher level of guard required — provided pseudonymisation is robust. For the other 90%, starting from European defaults is the rational choice, well before being the ethical one.

Data sovereignty isn’t in tension with professional quality. It just requires choosing the model with one additional criterion — not only “how good it is”, but who controls it. It’s a criterion that lawyers, accountants, medico-legal experts, and compliance officers should apply better than anyone else, because it’s exactly the mental structure of their profession: figuring out who answers for what, and to whom.

Mike disrupted the market. With MikeRust we want to bring the interface to the consultant’s own computer. BYOK transferred the choice — and the responsibility — directly to the practitioner. Now it’s the practitioner, not the software vendor, who makes the choice that actually matters.

May 2026. Price lists and model availability are verified at time of writing. For specific operational decisions, consultation with a competent DPO and contractual review of the chosen providers’ DPAs is recommended.

Article 1 of 2 — the second one, on Anthropic’s claude-for-legal, is coming soon.