Which Self-Hosted MT Fits Regulated US Documents?
Table of Contents
Direct answer
No single self-hosted MT engine is best for every regulated US document. LibreTranslate and OPUS-MT suit high-volume plain text under open-source licenses. NLLB-200 is not released for production and is not intended for medical, legal or certified text. For regulated content, any engine needs access control, an audit trail, terminology governance and qualified human review.
Definition and scope
What self-hosted MT means
Self-hosted MT is a machine translation engine that an organization runs on infrastructure it controls. That can be its own servers, a private cloud tenancy or an on-premises GPU host. Source text is processed inside that boundary. It is not sent to a public cloud translation API.
The term MT here covers statistical and neural machine translation engines. In this article, MT and NMT are not treated as AI translation. AI translation in the AD VERBUM sense is an AI+HUMAN hybrid workflow with subject-matter expert review, defined further below.
What the scope covers
This reference covers:
Jurisdiction: the United States, with notes where EU rules apply to cross-border content.
Document types: clinical, regulatory, legal, financial, technical and defense documentation.
Data categories: protected health information (PHI), personal data, trade secrets, export-controlled technical data and privileged legal material.
Regulations: HIPAA, GDPR for EU-linked data, and sector rules such as FDA and EU MDR for medical device labeling.
Vendor duties: what the party operating the engine must document and control.
This article does not give legal advice. Compliance questions go to the organization’s counsel and compliance director.
How self-hosted MT differs from cloud translation APIs
A cloud API is operated by the provider. The provider patches, scales and monitors it. The customer sends text out and receives text back. A self-hosted engine reverses that. The organization controls where text goes and who can reach it. It also owns the full lifecycle: server infrastructure (CPU and GPU allocation), security patches, monitoring, disaster recovery and model selection, according to a practitioner guide on local translation.
Self-hosting changes where data travels. It does not make the output accurate, certified or compliant by itself.
The main self-hosted options compared
The table lists the engines most often considered. Facts come from the linked project pages.
Option | What it is | License | Stated fit and limits |
Self-hosted translation server with a REST API, powered by the Argos Translate library | AGPL-3.0 | Runs offline. Suited to bulk plain text. No claim of domain tuning. | |
Open project with 1,000+ pretrained neural MT models on Marian, plus web-service implementations | Varies by model; check each model card [VERIFY] | General self-hosted services. CPU decoding is described as cost-efficient. | |
C++ library for Marian-based translation in browsers and on consumer devices | Mozilla Public License 2.0 | Client-side execution. Not a central server product. | |
Open-source desktop software based on Marian, optimized for local CPUs | See repository [VERIFY] | Single-user local use. | |
Meta model family covering 200 languages | CC BY-NC 4.0 | Non-commercial license. Research intent. | |
TranslateGemma | Open-weight translation models from Google | Gemma Terms of Use and Prohibited Use Policy [VERIFY against the official model page] | Requires accepting terms. Check commercial-use limits. |
AD VERBUM LangOps System | Proprietary LLM-based system on private EU-hosted infrastructure, operated as an AI+HUMAN hybrid service | Commercial service agreement | Managed service, not a download. Covered under “Where AD VERBUM fits”. |
The first five engines are components. The organization supplies infrastructure, security, quality assurance and review. The last entry is a managed service.
LibreTranslate
LibreTranslate exposes a REST API. Running it locally avoids sending text to a cloud service. Its repository describes the engine as built on Argos Translate and independent of Google or Azure. The license is the GNU Affero General Public License v3.0 (AGPL-3.0).
AGPL-3.0 has network-use provisions. If the organization modifies the software and offers it to users over a network, source-sharing duties can apply. Counsel should review this before embedding LibreTranslate in a product or customer-facing portal [VERIFY with counsel].
OPUS-MT and Marian
Marian is a production-oriented neural MT toolbox. The OPUS-MT paper describes it as stable, production-ready and efficient for training and decoding. The project offers more than 1,000 pretrained models trained on OPUS parallel corpora. It supports bilingual and multilingual models.
A representative Helsinki-NLP model uses six encoder and six decoder layers, eight attention heads and a 512-dimensional model state. Specifications vary by model. The small size is why CPU deployment is practical. Quality varies by language pair and domain. The corpora are general, so specialized terminology needs a glossary layer or fine-tuning.
Bergamot and translateLocally
Bergamot provides a unified API for Marian-based translation, with native and WebAssembly builds. It targets client-side translation in web browsers. translateLocally is open-source software based on Marian and optimized for local CPUs. Both keep text on the user’s device. Neither provides central logging, role-based access or a multi-user audit trail. They fit individual productivity, not controlled enterprise workflows.
NLLB-200
NLLB-200 supports 200 languages. The official release lists a 54.5-billion-parameter mixture-of-experts model and dense, distilled variants down to 600 million parameters. The license is CC BY-NC 4.0, which excludes commercial use.
The model card states three limits. The model is intended primarily for research, especially low-resource languages. It is not released for production deployment. It is not intended for domain-specific medical or legal text, document translation or certified translations. Inputs were limited to 512 tokens. For regulated documents this rules NLLB-200 out as a production engine.
TranslateGemma
TranslateGemma models are open-weight and fall under Google’s Gemma Terms of Use plus a Prohibited Use Policy. These terms are more restrictive than permissive open-source licenses. Read both documents on the official model page before deployment [VERIFY].
Steps to deploy self-hosted MT for regulated content
Each step has an owner and a control.
Classify the content. Owner: compliance director or regulatory affairs manager. Control: a written data classification that marks PHI, personal data, privileged material and export-controlled data.
Set the legal basis. Owner: counsel. Control: a documented review of HIPAA, GDPR and contract duties for each data class. HIPAA business associate agreements apply when a vendor handles PHI on a covered entity’s behalf [VERIFY against 45 CFR 164.502(e) and HHS guidance].
Check the license. Owner: legal and procurement. Control: a license register recording each model and library, its terms and any non-commercial or use restrictions.
Size and build the host. Owner: infrastructure lead. Control: documented CPU and GPU allocation, network segmentation and a private subnet with no outbound route for translation workloads.
Secure access. Owner: chief information security officer. Control: role-based access control, single sign-on, encryption in transit and at rest, and no text retained in logs beyond a defined period.
Log activity. Owner: security operations. Control: an audit trail of who submitted which document, which engine version processed it and who reviewed the output.
Govern terminology. Owner: localization manager. Control: approved term bases and translation memories loaded into the workflow, with change control.
Define quality assurance. Owner: translation manager. Control: a QA checklist with error categories, sampling rules and acceptance thresholds.
Assign human review. Owner: localization manager. Control: a qualified linguist with subject-matter expertise reviews every regulated deliverable before release.
Maintain the platform. Owner: infrastructure lead. Control: a patch schedule, monitoring, a disaster recovery test and a model-update review before any new version enters production.
Security and compliance claims in the United States
Self-hosting reduces the number of parties that receive source text. It does not by itself create compliance. HIPAA, for example, regulates how PHI is used, disclosed and safeguarded. No engine is “HIPAA compliant” as a product. An organization is compliant when its policies, safeguards and contracts meet the rule [VERIFY against HHS guidance].
Claims an organization can reasonably make about a self-hosted engine are narrow:
Text is processed inside a defined network boundary.
Access is limited by role and recorded in an audit trail.
Data at rest and in transit is encrypted.
Retention is defined and enforced.
Claims that need independent evidence include certification, accuracy and fitness for regulated filings. Third-party audit reports, such as ISO 27001 certification, are the usual form of evidence. Teams that want to see how a vendor documents controls for confidential records can review the security and compliance controls published for an AI medical record review platform, then apply the same checklist to any MT host.
For general background on how MT exposes data and where compliance gaps appear, see the AD VERBUM analysis of machine translation risks.
Decision criteria
Use these criteria in order. A failure on an early criterion removes the option.
Criterion | Question | Removes |
License | Does the license allow commercial internal use? | NLLB-200 (CC BY-NC 4.0) |
Intended use | Does the vendor or project state suitability for the document type? | NLLB-200 for medical and legal text |
Data boundary | Does text stay inside controlled infrastructure? | Public cloud APIs for PHI without a signed agreement |
Language coverage | Is the required pair available with documented quality? | Engines lacking the pair |
Domain fit | Can the engine use client term bases and translation memories? | Browser-only tools |
Operations | Does the team have staff for patching, monitoring and recovery? | Any self-hosted engine without an owner |
Review | Is qualified human review built into the workflow? | Raw MT output for regulated release |
A practitioner comparison suggests matching the engine to the job: LibreTranslate for high-throughput bulk plain text, and general LLMs or TranslateGemma for complex documents (Big Iron guide). Treat this as one practitioner’s view and run a pilot on your own documents.
Examples
Example 1: internal triage of supplier emails
A manufacturer wants to read multilingual supplier emails. The content is non-regulated and high volume. LibreTranslate or an OPUS-MT model on a private host is a reasonable fit. Controls: access control, short log retention and a notice that output is for understanding only.
Example 2: clinical study documents containing PHI
A sponsor needs patient-facing and clinical text translated. The data includes PHI. A self-hosted general MT engine can keep text on site. It still lacks medical terminology governance and does not replace review. Controls: role-based access, audit trail, locked term bases and review by a medically qualified linguist.
Example 3: legal discovery
A law firm needs fast gisting of foreign-language documents. Privilege is the main risk. A self-hosted engine keeps documents inside the firm’s boundary. Output is for triage only. Anything filed or relied on goes to a qualified human translator.
Example 4: medical device labeling
A device maker needs instructions for use in several EU languages. Raw MT output is not suitable. The workflow needs ISO 17100 aligned review, controlled terminology and traceable QA records.
Failure modes and mitigations
Failure mode | Effect | Mitigation |
Non-commercial license used in production | Legal exposure | License register and counsel review before deployment |
Model used outside its stated intent | Unreliable output on regulated text | Match model cards to document types; block unsuitable engines |
Text persisted in logs or caches | Unplanned PHI storage | Retention limits, log scrubbing, encryption |
Unpatched host | Breach risk | Patch schedule, vulnerability monitoring |
Terminology drift | Inconsistent labeling | Term base governance and change control |
Hallucinated or omitted content | Errors in dosage, units or clauses | Human review, back-checks on numbers and units |
No owner for the platform | Silent degradation | Named operations owner and a recovery test |
Over-claiming compliance | Regulatory and contract risk | Limit claims to documented controls and independent audits |
Where AD VERBUM fits
AD VERBUM is a language service provider with 25+ years of experience and a network of 3,500+ subject-matter expert linguists. Its proprietary LangOps System is LLM-based, runs on private EU-hosted infrastructure and supports 150+ languages including regional variants. Every deliverable is an AI+HUMAN hybrid with expert review. Client translation memories and term bases are integrated. Certifications include ISO 27001, ISO 42001, ISO 17100, ISO 18587, ISO 13485 and AQAP2110, audited by Bureau Veritas. AD VERBUM aligns to GDPR and HIPAA. It states turnaround 3x to 5x faster than traditional workflows. Pricing is by quote. See translation and localization services.
Perspective
We see self-hosting as a data-boundary decision, not a quality decision. Teams often assume that moving an engine in-house solves a compliance problem. It solves one part. The remaining duties are terminology governance, QA, audit trails and qualified review. These are process controls, and they are where regulated projects succeed or fail.
We also separate MT from AI+HUMAN hybrid translation. An engine produces a draft. A hybrid workflow adds subject-matter experts, client terminology and documented QA to that draft. For regulated content, the second is the deliverable. For related background on how localization workflows are structured, see our overview of globalization, internationalization and localization.
— Eric Brown
Key points
Self-hosted MT keeps text inside an organization’s boundary but does not certify output.
LibreTranslate is AGPL-3.0. Counsel should review network-use provisions.
OPUS-MT offers 1,000+ pretrained Marian models and suits general text on CPU hosts.
NLLB-200 is CC BY-NC 4.0, is not released for production and is not intended for medical, legal or certified text.
Bergamot and translateLocally are client-side tools without central audit trails.
The operating organization owns patching, monitoring, recovery and model selection.
Required controls: access control, audit trail, retention limits, term governance and QA.
Regulated deliverables need qualified human review before release.
FAQ
Is LibreTranslate suitable for regulated documents?
It can process text locally and offline, which supports a data boundary. It is a general engine with no stated domain tuning for medical or legal text. Use it for triage or gisting, and add terminology control and expert review for regulated deliverables.
Can NLLB-200 be used commercially?
The official release lists CC BY-NC 4.0, which excludes commercial use. The model card also says the model is not released for production deployment. Organizations needing production translation should choose another engine or a managed service.
Does self-hosting make translation HIPAA compliant?
No. HIPAA applies to how an organization and its business associates safeguard PHI. Self-hosting limits exposure, but policies, access control, audit logging and agreements still apply [VERIFY with counsel and HHS guidance].
What staff does a self-hosted MT engine need?
The organization needs infrastructure staff for CPU and GPU allocation, patching, monitoring and disaster recovery. It also needs a localization owner for terminology and QA, and linguists for review.
Sources