What happens when you use an AI service
When someone types into a hosted AI tool or uploads a document, that content is sent to the provider's servers, processed on their hardware and often logged. Depending on the product, the tier and your settings, it may be retained for a period, reviewed for safety, or used to improve future models. Consumer tools usually offer the fewest protections, and they are the tools staff reach for when nothing better is provided.
Residency, sovereignty and control
- Data residency means where data is physically stored. An Australian cloud region gives you residency.
- Data sovereignty means which country's laws the data is subject to. That depends on who operates the service, not just where the servers are. For example, the US CLOUD Act allows US authorities to require US based providers to produce data in their control, even when it is stored overseas.
- Control means whether you could keep running if the provider changed its prices, terms or models, or stopped offering the service.
What Australian law says
Under the Privacy Act, disclosing personal information to an overseas recipient is covered by Australian Privacy Principle 8. In most cases your organisation remains accountable for how the overseas recipient handles that information. Industry rules can add to this: APRA's CPS 230 covers material service providers, and government entities have their own security and data requirements. Our compliance guide covers these in more detail.
Your options
| Option | Where data goes | Good for | Watch for |
|---|---|---|---|
| Free consumer tools | Overseas, under consumer terms | Public information only | Training on inputs, weak controls, no audit trail |
| Business or enterprise plans | Provider controlled, sometimes with regional options | General productivity with sensible data rules | Check training, retention and processing location |
| Models in an Australian cloud region | Onshore at rest, operated by the provider | Most business workloads needing residency | Foreign jurisdiction over the provider, vendor lock in |
| Australian operated AI services | Onshore, under Australian jurisdiction | Sensitive data where you still want a managed service | Smaller model choice, maturity of the provider |
| Self hosted open weight models | Your own network | The most sensitive data, full control | Hardware cost, skills to run and secure it |
Many organisations use more than one: an enterprise plan for general productivity and a self hosted model for the sensitive work. Our self hosting guide covers the last option.
Australian defaults matter too
Sovereignty isn't only about where data sits. Most models are trained mainly on American content and default to US spelling, law, institutions and assumptions. A model that defaults to Australian English and Australian context gives answers your staff and customers don't need to correct, which is part of why we train Australian models.
Questions to ask any AI provider
- Which countries is our data processed and stored in, including backups and logs?
- Which legal entity operates the service, and under which country's law?
- Is our data used for training, and is that off by default?
- How long is data retained, and can we delete it?
- Which subprocessors are involved?
- How would we move to another provider?
Common questions
What is sovereign AI?
AI that is built, hosted and operated under the control of a single country, so the data it processes, the infrastructure it runs on and the organisation operating it are all subject to that country's laws. For Australia, that means Australian infrastructure run by an organisation under Australian jurisdiction.
Isn't an Australian cloud region enough?
An Australian region keeps data at rest onshore, which helps with residency. The service is still operated by the provider under its own terms, and a foreign provider may be subject to its home country's laws. For many uses a local region is a reasonable choice. For the most sensitive workloads, organisations look for Australian operated services or run AI themselves.
Do I need Australian hosted AI?
Not always. It depends on what data you put into AI, your industry's rules and your contracts. Public information and routine drafting carry little risk anywhere. Personal, health, financial, legal or classified information deserves much more care about where it goes.
Is local AI as good as the big cloud models?
The largest cloud models still lead on the hardest open ended tasks. For defined business work such as search over your documents, drafting, summarising and extraction, modern open weight models running locally are genuinely capable, and the gap keeps narrowing.
This guide is general information, not legal or professional advice. Check the official sources, and get advice for your situation.
More guides:
- AI governance: A practical framework for adopting AI responsibly.
- Australian AI compliance: The laws, standards and guidance to know.
- Self hosting AI: Run open weight models on hardware you own.