What changed
Australia's Home Affairs secretary issued PSPF Direction 002-2026 for non-corporate Commonwealth entities. It requires legacy-technology stocktakes and risk-management plans by 31 March 2027, while Systems of Government Significance must incorporate specified risk-reduction measures by 31 December 2026.
Why it matters
The direction converts AI-enabled cyber risk from general guidance into dated inventory, planning and reporting duties for covered entities. The operational focus is legacy exposure, patch speed and resilience rather than model procurement alone.
What to do
Covered entities should confirm scope, inventory public-facing and significant systems, assign owners, record support and vulnerability status, build the required risk plan, and retain reporting evidence for the December 2026 and March 2027 deadlines.
Caveat
The direction applies to non-corporate Commonwealth entities under the PSPF, not every Australian organization. It addresses technology-estate resilience against AI-enabled threats and does not provide a complete AI-agent security standard.