Australia's Department of Home Affairs has ordered federal entities to inventory their legacy IT and prepare plans to reduce the risks. Published on September 29 and signed by Secretary Stephanie Foster, PSPF Direction 002-2026 explicitly addresses risks from frontier AI.
By March 31, 2027, the covered non-corporate Commonwealth entities must report their stocktake and risk management plan to Home Affairs. Each plan must set a target for reducing legacy systems. Agencies should prioritize public-facing services.
Entities operating Systems of Government Significance face additional requirements by December 31, 2026. An explanatory policy note is due by October 13. The earlier deadline therefore does not apply across every entity's entire IT estate.
This risk signal documents a mandatory protective measure. Compliance and effectiveness have not yet been demonstrated. The direction does not establish an additional AI incident.