AI from First Principles · Chapter 2 of 10
The four things people call “training”
The most expensive confusion in AI governance, and entirely avoidable.
Someone says “we want to train the AI on our customer data.” Before you answer, find out which of four completely different things they mean. They differ in cost by six orders of magnitude and — the part that matters to you — in whether the data can ever be removed.
Why deletion is the sharp question
If you are subject to any right-to-erasure obligation — GDPR Article 17, India's DPDP Act, CCPA — the four options are not equivalent and only two are comfortable:
| Approach | Where personal data ends up | Can you delete it? |
|---|---|---|
| Prompting | The request, and whatever logs captured it | Yes — a log retention problem you already solve |
| RAG | A search index you control | Yes — delete the document, re-index |
| Fine-tuning | Absorbed into weights as numbers | Not cleanly. The honest answer is retrain without it |
| Pre-training | The same, at enormous scale | No, and it is not your model anyway |
This is why “can we fine-tune on customer records?” deserves a different answer from “can the assistant search customer records?” — even though to the person asking they feel identical.
The questions to ask, verbatim
- “Are we changing the model's weights, or changing what we send it?”
- “If a customer asks us to delete their data next year, what exactly do we do?”
- “Where does the data physically sit between now and then?”
- “Whose data shares that location, and what separates them?”
Fine-tuning is usually not what they need
Teams reach for fine-tuning because it sounds like the serious option. Most business problems brought to it are better solved by retrieval, because the requirement is usually know our current facts rather than adopt a behaviour. Fine-tuning teaches style, format and task shape; it is an expensive and poor way to teach facts, and the facts go stale in the weights.
So the governance-friendly option is frequently also the technically better one. That is a good position to be in, and worth saying out loud in the meeting.
The four ways to change a model's behaviour, and what each costs
“Train it on our data” is the most common request a technology leader makes about AI, and it is usually the most expensive way to get what they actually want. There are four levers and they differ by orders of magnitude in cost and reversibility.
| Lever | What it changes | Cost / effort | Reversible? |
|---|---|---|---|
| Prompting | Instructions, format, tone, examples in the request | Minutes | Instantly |
| Retrieval | What the model knows right now — your documents in the prompt | Days to weeks of engineering | Yes — change the index |
| Fine-tuning | Style, format and task shape — not facts | Weeks, plus a labelled dataset | Yes, but you re-run the job |
| Pre-training | The model itself | Millions of dollars, months, a research team | No |
The most valuable correction in this chapter: fine-tuning is not how you teach a model facts.
It reliably teaches form — a house style, a rigid output format, a specialised task shape, a domain register. It does not reliably install knowledge, and facts installed that way cannot be updated without another training run, cannot be cited, and cannot be removed on request.
If the requirement is “it should know our policies”, the answer is retrieval — cheaper, updatable the moment the policy changes, and it can point at the paragraph it used, which is usually a requirement in itself.
If the requirement is “it should always answer in our claim-note format with these seven fields”, that is a genuine fine-tuning case.
And the ordering rule: exhaust the cheaper lever before moving to the more expensive one. Most projects that started with fine-tuning would have been finished sooner with retrieval and a better prompt — and a great many that reach for retrieval have not yet tried putting the ten relevant paragraphs directly in the prompt.
One consequence worth carrying into a governance conversation: the four levers have completely different answers to “can you delete this person's data?”. In a retrieval system, you remove the document from the index and it is gone. In a fine-tuned model, the information is diffused across weights and the only reliable removal is retraining without it. That difference alone should shape which lever you pick for anything touching personal data.
Check yourself