JDCS
Start a conversation
Start a conversation Or call

jdcs.au · Mid North Coast, NSW

Back to the course
Get the full workbook
JDCS
The quick summary

Private AI, in one page.

The one distinction that decides everything

Which plan you are on decides what happens to your data. Anthropic's 28 August 2025 consumer terms change (training unless opted out, retention up to five years) hit Claude Free, Pro and Max, and expressly excluded Work, Government, Education and API use including via Bedrock and Vertex AI. The 13 May 2025 OpenAI preservation order overrode user deletions across ChatGPT Free, Plus, Pro and Team plus non-zero-retention API, and excluded Enterprise; it was lifted around 26 September 2025. Residency is where data is stored. Sovereignty is which country's laws can compel access. The Australia and US CLOUD Act Agreement took effect 31 January 2026 and does not shield a private Australian business from US legal process.

The Australian obligations
  • 10 Dec 2026: APP 1.7 requires disclosing the kinds of personal information used in significant automated decisions and the kinds of decisions made. OAIC signalling a broad reading that may capture systems materially assisting human decisions.
  • The small business exemption has NOT been removed. That is a tranche 2 proposal, no bill passed, no commencement date.
  • TPB(GS) 55/2026: tax practitioners need client permission before client information goes into AI tools.
  • AML/CTF tranche 2, from 1 Jul 2026: lawyers, accountants, conveyancers and agents are AUSTRAC reporting entities, seven-year records.
The current framework (AI6)

National AI Centre Guidance for AI Adoption, 17 October 2025. It replaced the Voluntary AI Safety Standard and condensed ten guardrails into six essential practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; maintain human control. Mandatory guardrails were dropped in the December 2025 National AI Plan.

The regulator's own line

The OAIC notes local deployment is "likely to be more privacy-preserving as it limits the risks of third party access to the data".

What runs on your own hardware

Solved locally: summarisation, structured extraction, classification and routing, transcription, translation, OCR, question answering over your own documents. Frontier still wins: hard agentic coding, long-horizon reasoning, complex multi-step tool use. Single-pass work absorbs a small gap invisibly; agentic work compounds per-step error. Open models run roughly one release cycle behind (about 4 months by Epoch AI; 57 against 61 on Artificial Analysis in August 2026), stable for about 18 months. Weights are static files that cannot phone home, and you can verify that.

What it costs
  • 10 seats: on-prem $7,700/yr vs SaaS $5,400 and API $4,435. On-prem loses.
  • 30 seats: $14,050 vs $16,200 and $13,306. A tie, decided by admin hours.
  • 100 seats: $28,757 vs $54,000 and $44,352. On-prem wins.
  • AU hardware: Mac Studio M4 Max 36GB $3,499 · M3 Ultra 96GB $6,999 · ASUS Ascent GX10 128GB $6,249 · RTX 5090 about $6,499 · RTX PRO 6000 96GB $18,499.
  • Power is noise (about $273/yr for a Mac Studio M4 Max). Maintenance at 5 to 10 hours a month is not.
The hybrid to aim for
  1. Classify red, amber, green. Red never leaves the network. Amber goes to cloud only after de-identification, logged. Green is cost-routed.
  2. De-identify, then measure it. Report recall per identifier type on your own documents, name the gaps, gate the rest with a human.
  3. One gateway as the single egress point, so the red block is enforceable rather than aspirational. Log the permission policy version that served each query.
  4. Pilot in the cloud. Every serious local stack exposes an OpenAI-compatible endpoint, so moving later is a base URL change, not a rewrite.
  5. Start with transcription. Fastest visible win, strongest privacy story. Permissions, not the model, are what sink these projects: filter before retrieval, never after generation.
Your first move this week
  • 1. ......................................................
  • 2. ......................................................
  • 3. ......................................................
And the honest caveat

Sometimes the right answer is the cloud tool you already have, on a business plan with training off. General information only, not legal advice: for what your own obligations require, talk to your lawyer, your accountant or your professional body.