Insights
Written for people who have to decide something
No vendor gloss and no scare campaigns. What the obligations actually say, what the tools actually do, and where we think our own approach is the wrong answer.
-
26 July 2026
Australian privacy reform — what it means for AI use in professional firms
The direction of travel is toward more accountability, higher penalties and a narrower small-business exemption. Now is not the time to be casual about AI-related disclosures.
Read article → -
26 July 2026
AI and your PI insurance — six questions worth asking your broker
The right time to find out your PI policy has an AI exclusion is not while you're notifying the client.
Read article → -
26 July 2026
Onshore hosting vs onshore inference — the distinction most Australian vendors won't clarify
Some vendors host your data in Sydney and then send it to California for the AI processing. The privacy analysis is the second one.
Read article → -
26 July 2026
On-premise AI versus cloud AI — an honest comparison
We sell on-premise systems, so treat our view accordingly. Here is the case against us as well as for us.
Read article → -
26 July 2026
Could an AI disclosure be a notifiable data breach?
The obligation is to assess suspected breaches within 30 days. That is very difficult when the disclosure happened on a personal phone and left no trace.
Read article → -
26 July 2026
Is Microsoft Copilot safe for Australian law firms?
The short version — Copilot is one of the better cloud AI options for firms, but the analysis is more specific than most vendors will tell you.
Read article → -
26 July 2026
AI and legal professional privilege — the waiver risk nobody costed
Privilege depends on confidentiality being maintained. An AI service is a third party, and the disclosure happens before anyone thinks to ask whether it should.
Read article → -
26 July 2026
AI and legal discovery — using it without breaching your obligations
The implied undertaking is a duty to the court, not a courtesy to the other side. AI review has to be organised around it.
Read article → -
26 July 2026
Is ChatGPT confidential? What Australian firms need to know
The honest answer is "it depends on the tier, and probably not the one your staff are using at 9pm on a Thursday."
Read article → -
26 July 2026
AI scribes and patient confidentiality — what Australian practices need to check
The $3 million small business exemption does not apply to health service providers. A solo practice carries close to the same obligations as a hospital.
Read article → -
26 July 2026
De-identification of client data before AI — why it usually doesn't work
Removing the name is not de-identification. Removing the name is removing the name.
Read article → -
26 July 2026
APP 8 and AI — how cross-border disclosure rules apply to chatbots
APP 8 was written long before anyone was pasting client files into chatbots. It applies to them anyway, and section 16C is the part that bites.
Read article → -
26 July 2026
APP 11 and AI — the security obligation nobody's applying to their own AI infrastructure
Bringing AI in-house solves the cross-border problem. It doesn't solve the security problem — that one now sits with you.
Read article → -
26 July 2026
Writing an AI policy that staff will actually follow
A policy that prohibits AI without providing an alternative does not reduce your exposure. It reduces your visibility of it.
Read article → -
26 July 2026
AI meeting note-takers — the confidentiality problem nobody's talking about
Everyone's discussing whether staff should paste documents into ChatGPT. Meanwhile a note-taker bot is sitting in the meeting listening to everything, on somebody's personal account.
Read article → -
26 July 2026
AI incident response — the first 24 hours
The reflex to delete everything and hope it goes away is understandable and almost always wrong.
Read article → -
26 July 2026
The AI audit — 12 questions to find your firm's actual exposure
The point isn't to catch anyone. The point is to know what's actually happening before the OAIC asks.
Read article →
Not sure whether you have a problem?
Most firms do not know how much confidential material is already leaving the building. A short conversation will tell you.