What it takes to run AI on confidential legal data

Off-the-shelf AI isn't built for confidential legal data

The quickest way to add AI to a product is to call a model provider's public API. For confidential M&A or client data, that is the wrong default. Public endpoints typically give you little control over where data is processed or stored, and their standard terms can permit retention and human review. Running legal AI responsibly means working a layer below the model: at the cloud region and the contract.

Data residency: models have to run in-region

To keep data resident in Switzerland or the EU, the models have to run in a specific cloud region with the location pinned, through the enterprise offerings of the major cloud platforms, not a global or consumer endpoint. A US-headquartered public API, or a "global" endpoint that routes wherever there's capacity, does not give you regional residency. There is a further catch: not every model is available with full in-region residency, some route back to the model-maker's own infrastructure, so the choice of model is constrained by where it can lawfully run. A workable pattern is data resident in Switzerland with processing in an EU region.

Retention: the default is not zero

By default, enterprise AI platforms retain a sampled subset of prompts and outputs, often for a fixed window, in an abuse-monitoring store that authorised reviewers can access. For privileged legal material, that default is incompatible. Turning it off (variously called zero data retention or modified abuse monitoring) is not a self-serve toggle: it requires a negotiated enterprise agreement and an approval process with the provider, and it should be paired with encryption under keys you control. If a vendor can't tell you their retention setting, assume it's the default.

Privilege: standard terms don't protect it

Communications with an AI tool are not privileged by default. Courts examining privilege increasingly ask whether the platform was closed and whether contractual confidentiality was in place. Enterprise terms that forbid training on your data, bar disclosure to third parties and guarantee zero retention go a long way, but for lawyers, attorney-client privilege and professional secrecy need explicit contractual safeguards layered on top, in the form of a professional-secrecy or privilege addendum with the providers. This is easy to miss and hard to retrofit once data has already flowed.

Two regimes, similar principles

Sitting above all of this are the data-protection regimes themselves. Switzerland's nFADP and the EU's GDPR are separate laws but rest on similar principles: a lawful basis, transparency, data minimisation, security, processor terms (a DPA) and rules on cross-border transfers. Switzerland is outside the EU, so Swiss residency is a distinct claim from EU residency; a tool serving both markets has to satisfy both.

What this means in practice

For legal AI, compliance is engineered at the infrastructure and contract layer, not added afterwards. Fusewise runs models in-region (data resident in Switzerland, processing in the EU) on negotiated enterprise terms that switch off training and retention, with encryption under customer-managed keys, and addresses attorney-client privilege through the appropriate contractual safeguards. The point for any legal-AI team: the model is the easy part; residency, retention and privilege are where the real work is.