Data residency requirement for firms using AI

I am confused on the stance of law firms on this I was talking to an owner in Australia and he mentions he is using codex and other ai software but needs data to not leave Australia.

I mentioned to him most ai software would send his data to the US outside of his country since that is where the model is likely hosted.

He then responded it’s an Australian company and is assuming data must be in Australia.

Is there a misunderstanding here?