Small language models tailored for your industry drive greater business value

The Misplaced Focus of Enterprise Executives

The famous response by Willie Sutton, an American bank robber, to the question of why he robbed banks was simply, “because that’s where the money is.” While this may seem like a narrow perspective, it makes logical sense. Today, I observe a trend among enterprise executives that would likely leave Sutton puzzled: many are fixated on finding a secure location for their Large Language Models (LLMs), prioritizing data residency and perimeter security over the actual value they aim to protect.

In essence, these executives are attempting to construct a secure vault without any money inside. A safe with no money wouldn’t attract a thief like Sutton, and it shouldn't concern executives either. However, the situation is worse than that. A large language model can actually introduce disproportionate risks for a company, regardless of its location, if it hasn’t been trained specifically on industry-specific details.

If a model cannot identify what you need to know—such as spotting Basel III covenant violations in banking, detecting CAPA deviations in pharmaceutical manufacturing, or understanding the nuances of force majeure in energy contracts—it won’t be very useful, no matter where it's hosted.

The Need for Custom Language Models

What enterprises truly require is a custom language model capable of delivering detailed and accurate analysis of the sensitivities it must monitor. This is not about a superficial overview that could easily be incorrect. Regulators won’t be impressed if noncompliance stems from a GPT model providing an inaccurate answer on a mission-critical issue.

Small Language Models (SLMs) offer significant advantages. They can be up to three to five times more accurate than general-purpose models. Focusing on domain-specific information provides additional benefits that even Willie Sutton might appreciate: cost savings and the ability to run the model within a private environment.

General-purpose models demand substantial computing power to retain knowledge across diverse topics, from 18th-century poetry to quantum physics. An SLM in the range of 1 billion to 13 billion parameters may be less than 1% of the size of industry giants. This focus allows prompts to use less energy and enables easier deployment either on-premises or on a sovereign cloud.

Practical Applications of Small Language Models

Consider how this looks in real-world scenarios:

• For an insurance company, a financial SLM trained on the firm’s underwriting language and risk vocabulary can handle credit covenant analysis in ways that large language models cannot reliably do.
• For a pharmaceutical manufacturer, an SLM can detect CAPA deviations and note drug interaction risks using the specific terminology required for regulatory submissions.
• For an automotive supplier, an SLM can be trained to decode predictive maintenance signals and review supply chain anomalies, communicating this information in plain language—not just to data scientists’ dashboards but directly to the shop floor.

Security Beyond Geography

While security remains a critical priority, even with a highly specialized SLM, the question of sovereignty is less important than architecture. Just as a bank on Main Street is kept safe by burglar alarms, thick vault walls, and complex locks rather than geography, the same applies to AI systems.

From my two decades in finance IT, I’ve learned that security needs to be integrated into the architecture. Wherever your data resides, your systems must be designed so that IP cannot leak, and query data cannot be retained by third-party API providers, made vulnerable to model inversion attacks, or injected into agentic pipelines.

You need air-gapped inference for tier-one sensitive workloads, differential privacy in training pipelines—mathematical guarantees, not consent forms—and cryptographically signed audit trails for every AI decision. You want to be able to ask your team: if our model’s weights were stolen tomorrow, what would an adversary learn? The answer should be “not much.”

Securing Customer Privacy in the AI Era

Protecting customer privacy in the AI era requires a similar strategy. There is a version of data privacy in enterprise AI that is imagined in legal documents, and then there is the version that works. Policy-level controls do not prevent model memorization of private materials during training, inference time re-identification, or the logging of queries by a third-party API provider.

To protect data in practice—not just in theory—enterprises need security by design: federated learning, which trains models across distributed nodes without raw data ever moving; differential privacy, which provides mathematical guarantees against reverse-engineering individual records; and synthetic data generation, which replaces sensitive training data with statistically equivalent proxies.

The Future of AI Regulation

Finally, keeping an eye on changing regulations is as important as ever. Whether or not you implement these measures depends on your own appetite for risk, but soon, EU AI Act Article 10, India's DPDP Act, and a growing patchwork of US state laws will require technical controls, not just policies. By 2027, “privacy-preserving by design” will appear in enterprise AI RFPs as standard.

Getting It Right

Designed correctly and deployed securely, small language models should outperform larger competitors in all the ways that matter most to stakeholders: efficiency, predictability, and commitment to success. And that’s good news for your business, because Willie Sutton was wrong—taking care of your stakeholders is where the money really is.