Cloud AI platform selection: a prototyping studio or an enterprise platform for a regulated product?
Teams building AI into a regulated product often prototype in a cloud provider's developer studio, then find the enterprise platform is a different service with different terms. The choice that matters is not which brand, but whether the exact service you will call can hold regulated data, in the region you need, behind controls your security team accepts.
How do you choose a cloud AI platform for a regulated product?
Quick answer
Choose a cloud AI platform for a regulated product by checking the exact service, not the brand: is it on the provider's HIPAA or BAA list, does the model run in the region you need, and can it sit behind private networking with your own keys. Agnotic Technologies runs these checks before writing client code.
| Criterion | Studio | Enterprise platform |
|---|---|---|
| Service on the HIPAA or BAA list | Check separately: a studio may be a different service from the platform | Check the exact service and feature on the provider's current list |
| Region where the model runs | Often global or provider-chosen | Choose a region; confirm the specific model is offered there |
| Private network access | Public endpoint | Private endpoints inside your network |
| Customer-managed keys | Usually not offered | Check per service whether your own keys cover stored data |
| Prompt and output retention | Read the terms for logging, retention and use of inputs | Configurable logging; confirm what the provider keeps and for how long |
| Identity and access | API keys tied to a person | Your cloud identity, roles and service accounts |
| Evaluation and safety tools | Side-by-side prompt testing | Evaluation jobs, content filters and monitoring you can automate |
| Quotas and support | Developer quotas | Production quotas you can request, under your support plan |
What they are
What is Studio
A browser workspace and API key for trying models quickly: write a prompt, compare outputs, export code. Studios are built for speed and often run under developer terms, with fewer network, key and logging controls than the enterprise platform from the same provider.
What is Enterprise platform
The provider's production AI service inside your cloud account: model endpoints, private networking, customer-managed keys, identity and access controls, logging, quotas and evaluation tools, under your cloud agreement and, where listed, its BAA.
Key differences
Why is a developer studio not the same as the enterprise platform?
Providers often offer the same models through two doors: a studio for quick experiments and a platform inside your cloud account. The doors can have different terms, logging and data handling. A prompt that works in the studio still has to move to the platform before any regulated data touches it, so plan that move from the first day.
How do you read a provider's HIPAA service list?
Read it service by service and feature by feature. AWS's HIPAA Eligible Services Reference, last updated October 15, 2026, lists eligible services, notes exclusions on some entries, and says services not listed may be used in HIPAA accounts only if they do not process or store ePHI. Google Cloud's BAA covers its infrastructure and a named list of products. Microsoft offers its HIPAA BAA through its Product Terms for in-scope services and notes there is no HHS-approved certification for cloud providers.
Why does the region of the model matter?
A provider can offer a region without offering every model in it. Check that the exact model and version you plan to use runs in the region your contracts or customers require, and whether the service can process requests in other regions, with how to turn that off if your contracts require it.
Which network and key controls should you require?
Private endpoints so traffic never crosses the public internet, customer-managed keys for any stored data such as fine-tuning sets, vector indexes and logs, and access through your cloud roles rather than personal API keys. Ask which of these each AI service supports, because support varies between services on the same platform.
How does the platform fit the cloud you already run?
The platform you already run has your identity, logging, network and BAA in place, which removes weeks of security review. Moving AI to a second cloud is sound when a model you need is only available there, but budget for a second identity setup, a second log pipeline and a second BAA. Our build vs buy guide covers hosted models vs self-hosted ones and version pinning.
When to use each
When to use Prototyping studio
- You are testing ideas with public or synthetic data only.
- You want to compare models and prompts before choosing a platform.
- No regulated data, customer data or secrets will be entered.
- You plan to move the winning prompt to the enterprise platform afterwards.
When to use Enterprise AI platform
- The product will process PHI or other regulated data.
- You need the model in a specific region or country.
- Security requires private endpoints, your own keys and central logging.
- You need quotas, monitoring and support terms for production traffic.
What does a five-step cloud AI platform proof of concept look like?
1. Confirm eligibility on paper. List every service the feature will call and check each against the provider's current HIPAA or BAA list, with the page date recorded.
2. Build in your account, not the studio. Deploy the model endpoint in the region you need, behind a private endpoint, with your keys and cloud roles.
3. Run your evaluation set. Use synthetic or de-identified cases, compare at least two models, and record quality, latency and failure cases.
4. Check what is kept. Inspect logs, traces and any stored prompts, and confirm retention settings match what your security team approved.
5. Load test under quota. Run expected peak traffic, note throttling, and request the quota you need before launch.
The NIST AI Risk Management Framework is a useful structure for writing up the result, and NIST notes AI RMF 1.0 is being revised, so cite the version you used.