AI & Machine Learning Company in Portland

Honest ranges tied to scope. A feasibility engagement, meaning data readiness assessment, a leakage and label-quality audit, one or two baseline models and a written go or no-go with an economic case, typically runs USD 25,000 to 60,000 over four to eight weeks and is the cheapest way to avoid a bad six-figure decision. A production model with a real serving path, monitoring, retraining and integration into the system that consumes its output typically runs USD 90,000 to 250,000 depending on data condition, integration depth and regulatory burden. A platform engagement, meaning feature store, training pipelines, model registry, evaluation suite and governance for a portfolio of models, runs USD 250,000 to 700,000 and up across phases. Computer vision on wafer or inspection imagery costs more than tabular forecasting because labeling is expensive and the deployment target is often inside a fab network. Portland senior data engineering and ML rates run below San Francisco and slightly below Seattle. Oregon has no state sales tax, which does not change engineering cost but does simplify contracting. Every engagement is quoted as a fixed fee against a signed statement of work.

Two mechanisms in the Oregon Consumer Privacy Act reach modeling work directly, and both are engineering problems rather than policy ones. First, consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, which means your model needs a documented definition of which decisions qualify and an operational path to exclude an opted-out consumer rather than a policy page saying you would. Second, controllers must complete and retain a data protection assessment before any processing that presents a heightened risk of harm, and profiling and targeted advertising are named categories; the requirement reaches processing occurring on and after July 1 2024, and assessments must be kept for at least five years. Those assessments are producible to the Attorney General, who is the sole enforcer and can seek up to 7,500 dollars per violation. Oregon's sensitive-data list is broader than most states and includes health condition, genetic and biometric data, precise geolocation, national origin, immigration status and status as transgender or nonbinary; processing those as features requires opt-in consent. We write the data protection assessment as part of the project rather than handing you a template afterward.

It hits the feature pipeline, which is the part ML teams tend to treat as plumbing. HB 2008 was approved June 3 2025 and took effect January 1 2026, and its geolocation clause bars the sale of data accurately identifying a consumer's location within a radius of 1,750 feet, carving out communications content and utility metering infrastructure. The practical consequence for modeling is provenance: location-derived features bought from a data broker or bundled into a third-party enrichment product now need a defensible origin story rather than a vendor invoice. The bill also bars processing personal data for targeted advertising or profiling, and bars selling it, where the controller has actual knowledge of or willfully disregards that the consumer is under 16. For a Portland consumer brand running propensity or lifetime-value models, that means age signal has to flow into the feature pipeline as a hard exclusion, not a downstream filter applied to a campaign list. Practically, we audit every third-party feature source for location content, add an under-16 exclusion at the point where the training set is assembled and again at scoring time, and record both in the data protection assessment. Oregon also runs a data broker registry under ORS 646A.593 through the Department of Consumer and Business Services, which is worth checking before you buy a dataset.

Yes, and for Silicon Forest customers it is usually the only acceptable architecture. Wafer images, tool traces, recipes and yield attribution are process IP, and the standard posture is that none of it reaches a hosted API or a vendor's cloud tenancy. We train and serve inside the customer's network on their GPU capacity, with the full stack, meaning PyTorch training, MLflow tracking, model registry, Triton or ONNX Runtime serving and the monitoring layer, deployed on premise or in a customer-controlled private cloud. Our engineers work through the customer's remote-access controls with no data egress, and where the security posture forbids that entirely we build against synthetic or sanitized data and hand over reproducible training code that the customer's own team runs against the real corpus. Model artifacts stay in the customer's registry. For edge deployment on the fab floor we quantize to INT8 or use structured pruning so inference fits the available hardware, and we validate that the quantized model holds its recall on the defect classes that actually matter rather than on aggregate accuracy.

Clinical ML in Portland runs inside HIPAA under a signed business associate agreement, with PHI staying in US-region infrastructure, no PHI used to train a vendor's shared models, and every inference logged for audit. Beyond the privacy floor, the institutional bar is higher than the regulatory one. Academic medical centers here expect a model card, prospective silent evaluation before any clinician sees an output, subgroup performance reported across the demographic axes their equity committee cares about, calibration analysis rather than AUC alone, and a documented plan for what happens when the model degrades. We build for that: point-in-time correct feature construction so a readmission model is not quietly trained on data recorded after the index event, a shadow period against live traffic, a governance packet for the institution's AI or clinical informatics committee, and an explicit statement of the clinical workflow the output enters. HB 2748, effective January 1 2026, bars nonhuman entities from using nursing titles, which matters for any patient-facing surface a model output feeds. No model closes a clinical decision on its own.

A realistic production timeline is sixteen to twenty-eight weeks, and the variance is almost entirely about data condition rather than modeling difficulty. Weeks one to four are discovery and data readiness: decision definition, baseline, label quality audit, leakage hunt, OCPA data protection assessment, HIPAA or HB 2008 scoping where relevant, and a written economic case. Weeks five to twelve are modeling and pipeline work: point-in-time feature construction, experiment cycles with a tracked log, error analysis by segment, and a serving prototype. Weeks thirteen to twenty are hardening: shadow deployment against live traffic, calibration, subgroup performance, drift and data-quality monitors, retraining triggers, and integration into whatever consumes the output. Weeks twenty-one to twenty-eight are rollout, on-call handover, documentation and the first supervised retraining cycle. Fab-network deployments add time for security review and for GPU capacity provisioning inside the plant. Clinical deployments add time for the institution's governance committee, which typically meets on a monthly cadence and should be engaged in week two rather than week eighteen.