Generative AI is already in most law firms. Usually it arrived quietly. A lawyer drafts a letter in a free chatbot, a paralegal summarises a discovery bundle, or someone pastes a clause in to “make it plainer”. It saves time, and that’s exactly why it’s hard to stop.
The problem isn’t AI. It’s where the data goes, who can access it, and which country’s laws apply once it’s there. This article explains data sovereignty in plain terms for Perth firms and looks at a practical option: a private AI model hosted in Perth.
This is general information, not legal advice. Check your obligations with your professional body and your own advisers.
What “data sovereignty” actually means
Data sovereignty is the idea that data is subject to the laws of the place where it’s stored and processed, and of the companies that control it. Two separate questions matter:
- Where is the data physically? Which data centre, in which country?
- Who controls it? If the provider is headquartered overseas, foreign law may give foreign authorities a route to request it, even when the servers are in Australia.
The second point is the one most people miss. The US CLOUD Act (2018), for example, allows US authorities to compel US-based providers to produce data in their possession, custody or control, regardless of where it’s stored. “Australian region” does not automatically mean “only Australian law applies”.
Why this matters more for law firms
Confidentiality and privilege
Lawyers owe clients a duty of confidentiality, and legal professional privilege can be put at risk if confidential material is disclosed carelessly. Pasting a client’s documents into a consumer AI tool, where terms may allow the provider to retain or review inputs, is hard to square with those duties. Since 1 July 2022, WA practitioners have been regulated under the Legal Profession Uniform Law, and its conduct rules on confidentiality apply whatever tool you use.
The Privacy Act and APP 8
Under the Privacy Act 1988, Australian Privacy Principle 8 deals with cross-border disclosure of personal information. If personal information goes to an overseas recipient, the disclosing organisation can remain accountable for how that recipient handles it. When staff paste client details into an overseas AI service, that’s a cross-border disclosure your firm may be responsible for.
Client expectations
More clients now ask in engagement terms or security questionnaires where their data goes. Being able to answer “it stays on hardware in Perth, run by an Australian company” is a clean answer.
“But the big providers offer Australian hosting”
Some do, and enterprise AI products have improved a lot. Several now offer Australian data residency and contractual promises not to train on your data. For many organisations that’s enough. It’s worth being clear about the trade-offs, though:
- Control still sits with an overseas parent. Residency settles where the data is stored, not which jurisdictions can compel the provider.
- Settings drift. Features, sub-processors and terms change over time, often by notice email.
- Shadow AI continues. An enterprise licence doesn’t stop staff using a free tool on their phone if the approved tool is slower or harder to reach.
The aim isn’t to scare anyone off cloud services. It’s to make an informed choice about which work belongs where.
What a private, Perth-hosted AI looks like
The alternative is to run the AI model on dedicated hardware you control, in a facility you can visit.
At Green Racks we run a private, open-weight language model on NVIDIA Pro 4000 GPUs in Osborne Park, as part of our sovereign AI hosting in Perth. For a firm, that means:
- Nothing leaves the building. Prompts and documents are processed on hardware in our WA facility. They aren’t sent to an overseas API.
- Australian company, Australian law. Green Racks is an Australian-owned operator, with no foreign parent between you and the people running the rack.
- Your documents, your knowledge base. The model can be connected to your precedents, policies and matter documents, so answers draw on your own material.
- Visibility. Partners can see what the team uses AI for (drafting, summarising, research questions) and where the bottlenecks are.
We call this the Sovereign AI Workspace. It’s built for small and mid-sized firms that want the productivity of AI without the uncertainty of where client material ends up. The Workspace is in Limited Beta, and seats are capped while we onboard the first firms.
What it is not
To be straight about the limits: a locally hosted model is very capable for drafting, summarising, extracting and answering questions over your documents. It isn’t a replacement for the largest frontier models on every task, and it doesn’t give legal advice. Like any AI tool, it needs a lawyer to check its output. We’d rather set realistic expectations than oversell.
Practical steps for any Perth firm, whichever tool you choose
- Find out what’s already happening. Ask your team, without blame, which AI tools they use and for what.
- Write a short AI policy. Cover which tools are approved, what may never be entered (client identifiers, privileged material), and who to ask.
- Classify your work. Public research might be fine in a cloud tool. Client documents and privileged advice deserve more control.
- Read the terms. Check data retention, training use, sub-processors and governing law for any tool you approve.
- Prefer infrastructure you can verify. If you can visit the data centre and meet the operator, you can answer client questions with confidence.
The Perth advantage
Hosting in Perth isn’t just about sovereignty. It’s fast (under 10 ms across the metro area, against roughly 40-50 ms to the east coast) and it’s local, so you can drive to Osborne Park and see the rack your firm’s AI runs on. Our facility page shows the setup, and our security page covers physical access controls.
See it for yourself
If your firm is weighing up AI and where client data should live, we’re happy to walk you through the Sovereign AI Workspace and show you the hardware in person. Get in touch or email [email protected].
For the infrastructure side, see our dedicated servers in Perth and pricing pages.
