Open-source vs closed models in regulated environments

Trade-offs you faced? - Open: Data control, on-prem, inspectable behavior, lower variable costs; heavier MLOps. - Closed: Best-in-class quality and features; faster iteration; vendor lock-in and data routing concerns. Patterns: - Hybrid routing: Open-source for low-risk, closed for complex tasks. - Privacy: Local embeddings with on-prem RAG; send only short queries to cloud. - Compliance: Model cards, DPIAs, logging, and SOC2 alignment. What audits or legal reviews helped smooth approvals? Any tips for procurement and DPIA templates?