Australia mandates legacy-system risk plans for AI-enabled cyber threats
Australia's Home Affairs secretary issued PSPF Direction 002-2026 for non-corporate Commonwealth entities. It requires legacy-technology stocktakes and risk-management plans by 31 March 2027, while Systems of Government Significance must incorporate specified risk-reduction measures by 31 December 2026.
Why it matters: The direction converts AI-enabled cyber risk from general guidance into dated inventory, planning and reporting duties for covered entities. The operational focus is legacy exposure, patch speed and resilience rather than model procurement alone.