Private AI for law firms
Private AI for a law firm means using AI on client information under an enterprise agreement that rules out training on your data, in a location you choose, with access controls and logs. Microsoft, for example, lists 4 Australian Azure regions. It is the alternative to the public chatbots that three state legal regulators warned against in December 2024.
Why public chatbots are the wrong place for client files
Three Australian sources point the same way. The joint statement on AI in Australian legal practice, issued on 6 December 2024 by the Victorian Legal Services Board + Commissioner, the Law Society of NSW and the Legal Practice Board of Western Australia, warns that putting confidential, sensitive or privileged client information into a public AI chatbot or copilot is not safe, and asks lawyers who use commercial tools to read the contract terms carefully.
The OAIC’s guidance on commercially available AI products recommends, as best practice, that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools. It also notes that deploying a system locally or on premises is likely to be more privacy-preserving, and that cloud deployment raises the question of whether personal information could be disclosed outside Australia.
The Supreme Court of NSW’s Practice Note SC Gen 23 goes further for material such as subpoenaed documents and information under suppression orders: it must not go into a generative AI program unless the practitioner is satisfied the information stays within a controlled environment, is used only for that proceeding, and is not used to train any model.
What “private” should mean in practice
Vendors use the word loosely. These are the controls that make it mean something, and the evidence to ask for.
| Control | What to look for | Evidence to request |
|---|---|---|
| No training on your data | A written term that prompts, outputs and uploaded files are not used to train or improve models | The service terms or data protection addendum, not a marketing page |
| Processing and storage location | A named region, and a statement of whether processing can leave it | The deployment type and region in your configuration |
| Retention | How long prompts and outputs are kept, and why | The vendor’s retention and abuse monitoring documentation |
| Who can see your data | Whether the model maker, the vendor’s staff or reviewers can access it | Access and human review terms |
| Access control | Users see only the matters and documents they are entitled to | Role and matter permissions in the tool |
| Logging | A record of who used the tool, when, and on which matter | A sample audit log |
Two vendor examples show why the detail matters. Microsoft’s data, privacy and security page for its Azure AI models states that prompts and completions are not available to OpenAI and are not used to train foundation models without your permission. The same page says prompts are processed within the customer-specified geography unless a “Global” or “DataZone” deployment type is chosen, in which case processing can occur elsewhere. It also describes abuse monitoring that can store prompts for human review unless the customer is approved for modified monitoring.
Amazon Web Services says in its Bedrock data protection documentation that model providers do not have access to customer prompts and completions. Its data retention page shows that retention settings vary by model and that some models require retention for review. In both cases the answer depends on the configuration your firm or its provider chooses, which is why the configuration itself is the evidence.
Three ways to deploy private AI
| Option | How it works | Suits |
|---|---|---|
| Enterprise AI service in an Australian region | A major cloud provider’s AI models run under your firm’s own agreement, configured for an Australian region with training excluded | Many small and mid-size firms |
| Private deployment in your firm’s cloud tenancy | Models and document stores sit in a cloud account the firm owns, with the firm holding the keys and the logs | Firms with sensitive practice areas or larger document sets |
| On-premises open-weight model | A model runs on hardware in the firm’s office or data centre, with no external processing | Firms with strict client requirements and in-house IT support |
Each option can feed the same uses: summarising documents, searching the firm’s precedents and past advice, drafting under review, and powering email triage and document automation. The more private the option, the more the firm takes on in running costs and upkeep.
Questions to ask any AI vendor
- Is our data used to train or improve any model, and where is that promise written in the contract?
- In which country and region are prompts processed, and in which are they stored?
- Can any deployment setting move processing outside that region?
- How long are prompts, outputs and uploaded documents kept, and can we shorten that?
- Can the model provider, your staff or any reviewer read our content, and in what circumstances?
- Which subprocessors handle our data, and where are they?
- How do access controls map to our matters and staff roles?
- What is logged, who can see the logs, and how long are they kept?
- How do we get our data back, and deleted, when we leave?
- Have you had a security incident affecting customer data, and how were customers told?
Keep the answers in writing. They become part of the firm’s AI register and support the duties described in the Privacy Act guide for law firms, including overseas disclosure under APP 8 and security under APP 11 of the Privacy Act 1988.
Who private AI suits
It suits firms that want AI working on client documents (summaries, searching past advice and precedents, drafting under review), firms whose clients impose confidentiality or data location terms in their engagement, and in-house legal teams bound by their organisation’s data policies. A firm that only wants calls answered and messages taken can start with the AI receptionist and add private AI later.
What private AI does not fix
Moving AI into a private environment deals with confidentiality and data location. It does not make the output correct. A privately hosted model can still invent a case or misread a clause, so the verification and supervision steps in the checklist for a law firm AI policy apply in full. It also does not settle whether a client should be told AI was used on their matter; the joint statement encourages lawyers to record and disclose AI use to clients, and that remains a firm decision.
How Yes AI approaches it
Yes AI designs and builds private AI setups, from an enterprise AI service configured for an Australian region through to custom and private language models, and writes down the configuration so the firm can show a client or regulator where data goes. The general approach is described on customllm.au. Private AI work is scoped and quoted per firm; request a quote and tell us which uses you have in mind. The receptionist and intake services that can run alongside it have published monthly prices, compared on what a virtual receptionist costs a law firm.