Data Sovereignty Routing Agent for Brisbane In-House Counsel: Keep AU-Resident Matter Data Inside AU-Resident Infrastructure

The procurement team wants to put a generative AI assistant in front of every contract you touch. The board wants a memo by Friday explaining what happens to privileged correspondence and personal information when a prompt is sent to a model hosted in another jurisdiction. You already know the answer your CIO wants (“the vendor says it’s fine”); you also know the answer the Australian Solicitors’ Conduct Rules expect you to be able to give your client — which, as in-house counsel, is your employer. The Data Sovereignty Routing Agent is built so that question has a defensible technical answer before a prompt ever leaves the building.

Why it matters now

The Australian Solicitors’ Conduct Rules (ASCR) impose a duty of confidentiality (Rule 9) and a duty to act in the client’s best interests (Rule 4.1.1), and the Law Council has confirmed the ASCR apply to solicitors employed in corporate legal teams. When an in-house lawyer routes a matter — even a fragment of one — through a third-party AI service whose processing region, sub-processors, or training-data posture is not contractually fixed, the question of where that data lives and who can compel its disclosure becomes a live confidentiality issue. Disclosure to the client of AI use, and of where the processing occurs, is not currently a uniform standalone ASCR rule, but it is downstream of the existing confidentiality and candour duties: if the client (the company, the board, the audit committee) cannot tell you which AI tools touched which matters, your file is not in a state you can stand behind. The Law Council is also reviewing the ASCR (2026 review) in light of new federal obligations affecting solicitors, which makes the underlying expectation — that you can describe and constrain your own handling of client information — more pointed, not less.

The 5-minute view

“AI-use disclosure non-compliance” is the failure to be able to tell a client (or a regulator, or the board) which AI services processed which matter content, in which jurisdiction, under which retention and training terms
ASCR Rule 9 (confidentiality) applies whether the disclosure is to a journalist, a counter-party, or a US-based inference endpoint
Many enterprise LLM offerings route traffic to the nearest available region by default — “AU-available” is not the same as “AU-resident-only”
Sub-processor lists change without notice; a model upgrade can move processing to a region you did not approve
The Data Sovereignty Routing Agent enforces region-pinning before a prompt is dispatched, refuses egress to non-approved jurisdictions, and writes an auditable record of where each matter’s data was processed
The agent is a pre-flight control layer, not a model — it sits between your internal applications and whichever LLM endpoint is in use
Output is a per-matter sovereignty log suitable for board reporting and for ASCR-aligned file notes

What Exegesis is building

The Data Sovereignty Routing Agent is part of the Exegesis Legal pillar — agentic AI plumbing for Australian legal teams that need to demonstrate, not merely assert, control over where client data is processed. The agent ingests an AI request (prompt, context, attachments) from an internal system, evaluates the destination endpoint against a policy file the legal team controls (approved providers, approved regions, approved retention terms), and either dispatches the request to a compliant endpoint or refuses and logs the refusal. The verification logic is deterministic — policy-as-code, not model judgment — which is the same posture Exegesis takes with RuleCheck, our open-source pre-lodgement filing checker. No matter content is sent to external LLMs for the routing decision itself; the decision is made locally against the policy.

The deliverable

Region-pinning enforcement for AI requests originating from in-house systems (contract review tools, knowledge-base assistants, drafting copilots)
Policy-as-code configuration: approved providers, approved regions (AU-only, AU+NZ, etc.), prohibited sub-processors, prompt-class rules
Per-request decision log: which matter, which endpoint, which region, which policy version, allow/deny, timestamp
Monthly sovereignty report for board, audit committee, or external auditor — exportable as Markdown or CSV
Refusal-mode behaviour: when no compliant endpoint is available, the request is blocked rather than silently downgraded
Integration via a local proxy or SDK; no matter content is transmitted to Exegesis infrastructure

CTA

Join the waitlist — be the first to know when access opens for Brisbane in-house legal teams

The Data Sovereignty Routing Agent is in design partnership with a small number of Australian in-house teams. We’re scoping deployment patterns (proxy, SDK, gateway) and pricing structure (per-seat, per-request, enterprise licence) based on what corporate legal functions actually need to put in front of their boards. Join the waitlist and we’ll let you know when general access opens — and what you tell us about your current AI governance gap will shape the configuration defaults.

Sources

Law Council of Australia — Australian Solicitors’ Conduct Rules: https://lawcouncil.au/policy-agenda/regulation-of-the-profession-and-ethics/australian-solicitors-conduct-rules

Exegesis capability references:

Schema

```json { “@context”: “https://schema.org”, “@type”: “TechArticle”, “headline”: “Data Sovereignty Routing Agent for Brisbane In-House Counsel”, “about”: [ {“@type”: “DefinedTerm”, “name”: “AI-Use Disclosure Non-Compliance”, “inDefinedTermSet”: “https://lawcouncil.au/policy-agenda/regulation-of-the-profession-and-ethics/australian-solicitors-conduct-rules”}, {“@type”: “GovernmentService”, “name”: “Australian Solicitors’ Conduct Rules”, “url”: “https://lawcouncil.au/policy-agenda/regulation-of-the-profession-and-ethics/australian-solicitors-conduct-rules”} ],