Skip to content
All insights Private AI & self-hosted LLMs

Fine-tuning vs RAG for private data

A decision order for private enterprise data: when retrieval wins, when fine-tuning wins, what LoRA changes, and the maintenance cost each choice commits you to.

6 min read #private-ai#rag#fine-tuning
Financial services professionals working through an AI initiative

The question arrives framed as a choice between two technologies, and it usually is not one. A team has private data, a use case, and a board expectation, and someone has told them that fine-tuning is how you make a model “know your business.” Six weeks later there is a dataset nobody can maintain, a training run that improved the tone and degraded the accuracy, and no way to explain where any given answer came from.

The useful reframing is that retrieval and fine-tuning solve different failure modes. Retrieval solves “the model does not know this fact.” Fine-tuning solves “the model knows enough but responds wrong.” Almost every disappointing outcome we are asked to review comes from applying one to the other’s problem, and the direction of the mistake is nearly always the same: fine-tuning applied to a knowledge problem.

For private enterprise data in 2026 the default is retrieval, and the default is not close. Knowledge that changes, must be cited, or is subject to deletion and audit obligations belongs in an index you control, not in weights you would have to retrain to correct. Fine-tuning earns its place afterwards, on a narrower question.

What retrieval gives you that weights cannot

Three properties decide most regulated deployments, and only one approach has them.

  • Update latency. A policy change reaches a retrieval system as soon as the document is re-indexed. It reaches a fine-tuned model at the next training cycle, and in between the model asserts the superseded version with no signal that anything is wrong.
  • Attribution. Retrieved passages can be shown to the user, checked by a reviewer, and stored with the answer. A fine-tuned model produces the sentence without the source, which turns every accuracy question into an investigation.
  • Deletion. Removing a record from an index is a delete. Removing knowledge from weights is a research problem with no clean answer, which makes retention obligations and erasure requests far easier to satisfy on the retrieval side.

There is a fourth, less discussed: fine-tuning bakes your errors in. A retrieval system that returns a wrong document is debuggable, because you can see what it returned. A model trained on a flawed dataset produces the same wrong answer with no trace back to the cause, and the fix is another training run.

Where fine-tuning genuinely wins

The case for fine-tuning is real, and it is narrower than vendors present it. It wins when the problem is behaviour rather than knowledge, and when the task is stable enough that a training artefact has a useful life.

Consistent structured output is the strongest case. If every response has to conform to a schema, a regulatory phrasing convention, or a fixed extraction format, a small adapter enforces that far more reliably than prompt instructions, and it survives the model ignoring your seventh bullet point on the eleventh turn.

Latency and volume make the second case. Retrieval adds an embed, a search, a rerank, and a longer prompt to every request. At very high query volume on a narrow, stable task, the per-request overhead of retrieval can dominate total cost, and a fine-tuned model that answers directly is cheaper per request and faster. This applies to classification, extraction, and routing workloads more than to open-ended assistants.

Third, specialised procedural behaviour: multi-step reasoning patterns specific to your domain that the base model performs inconsistently even with the right evidence in context. This is real, but it is also the case most often claimed without evidence. Confirm that the evidence was actually present and correct before concluding the model needs retraining.

LoRA, QLoRA, and honest economics

Parameter-efficient methods changed the arithmetic without changing the decision order. LoRA and QLoRA reduce the GPU and memory footprint of adaptation substantially against full fine-tuning, which puts training within reach of a single high-memory GPU or a small cluster rather than a dedicated training environment.

On absolute numbers, published 2026 ranges put fine-tuning engagements anywhere from roughly $5K to $60K or more depending on scope, against roughly $5K to $20K for an initial retrieval deployment. Treat both as order-of-magnitude signals rather than quotes: the variance inside those ranges is driven by data preparation, which is the cost nobody scopes correctly.

Three things follow from parameter-efficient tuning that are worth stating plainly:

  • It lowers training cost against full fine-tuning, meaningfully.
  • It does not remove the retraining trigger. If the knowledge encoded in the adapter changes, you train again.
  • It makes the combined pattern affordable, which is its real contribution: a behaviour adapter over a frequently changing retrieval base is now a reasonable production architecture rather than an expensive one.

What parameter-efficient tuning does not do is overturn retrieval’s advantage for knowledge that moves. Cheaper retraining is still retraining.

The preparation burden nobody budgets

Retrieval preparation is document ingestion, chunking, metadata, embeddings, retrieval tuning, access control, and an evaluation set. It is substantial, and it is mostly data engineering your team can already do.

Fine-tuning preparation is labelled instruction-response pairs at sufficient volume and consistent quality, train and validation splits, style normalisation across examples, and safety filtering. It is a different discipline, and it is where projects stall. Curating a few thousand examples that consistently demonstrate the behaviour you want is expert work, usually by the same subject-matter experts who have no capacity.

Then there is catastrophic forgetting. Training on domain data can degrade general capability or previously learned behaviour if the update is not carefully managed, which is one reason enterprises prefer parameter-efficient methods over full retraining and keep the factual layer in retrieval. It is also why every fine-tune needs a regression suite covering capabilities you did not intend to change, run before and after.

Maintenance is the decision you are actually making

Choosing an approach is choosing an ongoing operational commitment, and this is where the total cost separates.

Retrieval maintenance is data operations: ingestion pipelines that keep working when a source system changes, embedding refreshes, vector store growth, retrieval quality tuning, and permission management as entitlements change. It is continuous and predictable, and it scales with corpus churn.

Fine-tuning maintenance is model operations: dataset refresh, retraining cycles, evaluation regressions, deployment and version management, and redoing the work when the base model changes. That last item is the sharp one. Open-weight model families release faster than most training datasets can be maintained, and a fine-tune pins you to a base version until you can afford to move.

When knowledge changes often, retrieval is cheaper to maintain. When behaviour is stable and volume is very high, fine-tuning is cheaper per request. Most enterprise assistants sit in the first case.

The decision order we use

Work through this in sequence and stop at the first clear answer.

  1. Does the knowledge change often? If yes, retrieval.
  2. Do you need citations, auditability, or deletion compliance? If yes, retrieval.
  3. Is the dominant failure wrong facts or inconsistent behaviour? Wrong facts means retrieval; inconsistent format, tone, or process means fine-tuning.
  4. Is latency a hard constraint that retrieval overhead breaks? If yes, fine-tuning becomes viable on a narrow task.
  5. Is volume high enough that per-request retrieval overhead dominates total cost? If yes, fine-tuning gets more attractive, particularly with LoRA.
  6. Do you need grounded facts and consistent behaviour together? Build both: retrieval for knowledge, an adapter for form.

What to do first

Start with retrieval, even when you expect to fine-tune eventually. It reaches production faster, it produces the evaluation set and the failure log you would need to build a training dataset anyway, and it tells you empirically which failures are knowledge and which are behaviour.

Run it long enough to accumulate a real failure log, then classify. If the residual failures are behavioural, concentrated in a stable task, and expensive enough to justify a training cycle, fine-tune that one task with an adapter and keep the knowledge where it belongs. If the requirements are unclear, this order also protects you: retrieval is straightforward to unwind, and a fine-tuned model on a misunderstood requirement is a sunk cost with a maintenance tail.

FAQ

Can fine-tuning teach the model our internal knowledge so we can skip retrieval?

It can encode facts, but it gives you the wrong properties for enterprise knowledge. Fine-tuned facts cannot be cited, cannot be updated without another training cycle, and cannot be deleted on request in any way you would want to defend to a regulator. If a policy changes on Tuesday, retrieval reflects it after re-indexing; a fine-tuned model reflects it after the next training run, and until then it states the old policy with full confidence. Treat fine-tuning as a behaviour layer, not a knowledge store.

What does LoRA actually change about the economics?

It lowers the GPU and memory footprint of adaptation enough that fine-tuning becomes feasible on a small cluster or sometimes a single high-memory GPU, which moves training from a capital decision to an operational one. What it does not change is the retraining trigger: if the knowledge in the adapter goes stale, you still retrain. LoRA makes running retrieval and a behaviour adapter together affordable, which is why the combined pattern is more common now than it was two years ago.

How do we know when retrieval alone has stopped being enough?

Look at your failure log and classify each miss as a knowledge failure or a behaviour failure. Knowledge failures mean the right passage was not retrieved, and the answer is better chunking, hybrid search, or reranking. Behaviour failures mean the evidence was present and correct but the output had the wrong format, the wrong register, or skipped a required step. When the second category stops shrinking with prompt work and represents a meaningful share of the volume, a small adapter on a stable task is the proportionate fix.

Working on something similar?

Tell us about your data and the workflow around it, and we will give you a straight read.

Book a 30-min intro call