“Where does our data go when your AI runs?” is now a standard question from customers, insurers, regulated counterparties and legal teams, and “into a public chatbot” is the answer that stops AI projects. Private AI is the alternative: systems designed so your data stays under your control, whether the model runs in your own cloud account, on your own hardware, or with an enterprise provider under no-training terms and regional processing. Digital One Agency builds private AI for Australian businesses; this article explains when you need it, the three ways to do it, and what moves the cost.

What private AI actually means

The phrase gets used loosely, so here is the working definition we build to. A private AI system has five properties:

1. Where it runs is your decision. Your own cloud account or hardware, or an Australian or contractually agreed region with an enterprise provider.
2. It never learns from your data. Either the contract prohibits training on your inputs, or you host the model yourself and the question does not arise.
3. It sees only what each task needs. Access is scoped and sensitive fields are masked or excluded by policy, not by hoping nobody pastes the wrong thing.
4. What it keeps is your rule. Retention and deletion you set, with logs showing what was sent, what came back and who acted on it.
5. Who can reach it is controlled. Your people and systems, authenticated, and the model’s own permissions kept to the minimum.

A public chatbot with a company login fails most of those tests. So does an “AI feature” bolted onto a SaaS product whose terms you have not read.

Why the question is being asked now

The Office of the Australian Information Commissioner’s guidance on commercially available AI products, first published in October 2024 and updated in January 2025, recommends as best practice that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools”. It also reminds organisations that under APP 6 personal information may only be used or disclosed for the primary purpose it was collected for unless consent or a reasonable-expectation exception applies, that they should update privacy policies with clear information about their use of AI, and that they must take reasonable steps to ensure the accuracy of personal information produced or used by AI systems.

Add the automated decision-making disclosure obligation that takes effect on 10 December 2026, and the direction is clear: an organisation has to be able to say, in writing, where its AI processes personal information and how a person can be involved. Private AI is how you make those statements true.

The three ways to do it

1. Self-hosted open-weight models. Run the model in your own cloud account or on your own hardware. Nothing leaves your environment. You carry the operating responsibility (updates, capacity, monitoring) and you accept that the strongest open models trail the strongest frontier models on some tasks. Right for the most sensitive data and for tasks where a good-enough model is genuinely good enough: classification, extraction, drafting from your own templates, internal search.

2. Enterprise frontier models under no-training terms with regional processing. You use a top-tier model through an enterprise agreement that prohibits training on your data and specifies where processing happens. Less operating burden, stronger models, and a contract you can show a customer. Australian-region options are widening: Anthropic has signed for the first stage of a $32 billion Queensland data centre campus with capacity targeted for 2027, as the ABC reported on 16 September 2026, and we covered what it means for buyers in our analysis of the Queensland data centre deal.

3. Hybrid with a policy layer. The most common production answer. A policy layer classifies each request and routes sensitive steps to a private model and general steps to an enterprise API, with masking in between. You get frontier quality where it is safe and full control where it is required.

Whichever you choose, the system should be built behind an interface you control, so the model and the region are configuration. That is what lets you take the Australian-compute option in 2027 without a rebuild.

When you genuinely need it

You need private AI, rather than a public tool with a policy telling staff to be careful, when any of these is true:

• The data is personal, health, financial, legal or otherwise sensitive.
• A customer contract, an insurer or a regulator asks where data is processed or prohibits offshore processing.
• You need to prove what the system did and why (audit, dispute, complaint).
• The AI is part of a product you sell, so its data handling is your customers’ data handling.
• Staff are already using public tools with company data, which the OAIC guidance says they should not be, and you need to give them a sanctioned alternative.

You probably do not need it for a marketing copy assistant working on public material, or an internal brainstorming tool with no customer data in reach. The point is to decide per use case, in writing.

What moves the cost

• Hosting model. Self-hosting costs more to run than an API call and needs someone to operate it; enterprise agreements carry commitments. The hybrid usually lands in between.
• Data work. Classification, masking and access control are most of the effort on a private AI build, and they are the part that makes it defensible.
• Integration. Connecting to your CRM, ERP, phones and documents is the same work as any AI integration; the private layer adds the policy routing.
• Assurance. If a customer or regulator will ask for evidence, budget for logging, retention controls and a controls mapping. It is cheaper to build in than to retrofit, which is the premise of our secure AI system development practice.

For the published market ranges on custom software in Australia and the six things that move a quote, see our 2026 app-cost guide.

Five questions to answer before you start

1. Which data categories are in scope, and which may never leave your environment?
2. Which tasks need frontier-model quality, and which are fine on a smaller model you host?
3. Who has to be satisfied by the answer: a customer, an insurer, a regulator, your own board?
4. What must the logs prove, and for how long?
5. Where does a human review or approve, and how is that recorded?

Answer those and the architecture almost chooses itself. It is also, not coincidentally, the first week of our AI consulting engagement.

How Digital One Agency helps

We design and build private AI as one of our core AI development solutions: data classification and rules, the hosting decision with the cost of each path on one page, the build and its integrations, access control, logging, retention and human-oversight points, and a handover where you own the code, the accounts, the prompts and any fine-tuned models.

If an AI project in your business has stalled on the question of where the data goes, book a meeting and bring the use case and the concern. If you are earlier than that, the free AI audit will show you which of the tools you already use are sending data where they should not.

Frequently asked questions

What is private AI?

AI systems designed so your data stays under your control: the model runs in your own environment or an agreed region, never trains on your inputs, sees only what each task needs, keeps data only as long as you decide, and can be reached only by your authenticated people and systems.

Is it against the rules to use ChatGPT or similar tools with customer data?

The OAIC's guidance recommends as best practice that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, and reminds them that personal information may only be used for the purpose it was collected for unless an exception applies. Whether a specific use breaches the Privacy Act depends on the facts, but the guidance is a clear signal of what the regulator expects.

Which is better: self-hosted models or enterprise APIs?

Neither in general. Self-hosting gives full control at the cost of operating responsibility and, for some tasks, model quality. Enterprise agreements with no-training terms and regional processing give frontier quality under contract. Most production systems use a hybrid with a policy layer that routes sensitive steps to private models.

Does private AI cost more?

It usually costs more to run than calling a public API, and the data classification and access control work is real. Against that, it removes a class of privacy, security and contractual risk and often makes a project possible that would otherwise be blocked. Ask for both paths quoted so the decision is made on numbers.

What happens when Australian AI data centres come online?

Frontier providers have begun signing Australian data centre agreements with capacity expected from 2027, which will widen Australian-region processing options. If your system is built with the model and hosting as configuration rather than architecture, moving to an onshore option is a change of settings, not a rebuild.