Correspondence triaged by hand, reports rebuilt every month, documents rekeyed between systems, and a Microsoft 365 tenant that needs checking before Copilot is switched on. We help Canberra organisations decide which AI is worth adopting and then build it. For Commonwealth agencies and their suppliers, that includes the registers, accountable owners and impact assessments the Commonwealth AI policy now requires.
For agencies and their suppliers, we also provide IT consulting in Canberra on software selection and cloud hosting decisions, and custom software development for case management tools, internal portals and the integrations between them.
Start with our AI strategy and advisory service or our work on AI for government.
Canberra's AI questions are shaped by public sector rules: what has to be registered, who is accountable, and where information may be processed. These are the situations we are asked about most.
Ministerial correspondence, grant applications, submissions and case notes arrive as free text and get triaged by hand. Extraction and drafting with a human reviewer suits this work well.
Copilot is often the first AI tool an agency or contractor considers, and information management decides whether it is safe. Readiness work tells you what has to be fixed first.
Membership systems, policy submissions and research archives held in separate platforms. A governed search over your own material is often the first useful project.
Some workloads cannot be sent to a public AI service at all. Open models running on agency-controlled infrastructure keep prompts and documents inside the boundary.
Non-corporate Commonwealth entities now need a use case register, an accountable owner per use case and impact assessments before deployment. Many are starting from a list nobody has finished.
Agencies must assess every in-scope AI use case, including AI inside software they buy. Vendors who can answer the assessment questions in writing move through procurement with fewer delays.
The Digital Transformation Agency's Policy for the responsible use of AI in government was updated to version 2.0, effective 15 December 2025. Like the first version, it applies to all non-corporate Commonwealth entities, with exceptions for the defence portfolio and the national intelligence community, and corporate Commonwealth entities are encouraged to apply it. The DTA's summary of the update describes new requirements at both the agency level and the individual use case level.
For suppliers the effect is indirect but real. An agency cannot register and assess a use case it does not understand, so the questions land on whoever built the software. Our comparison of the Commonwealth policy with the NSW regime, in the guide to the NSW AI Assessment Framework, shows how much of the supplier evidence overlaps.
Each agency sets out how it intends to adopt AI, rather than approving tools one request at a time.
Named accountability for the policy, and a published AI transparency statement that tells the public how the agency uses AI.
Every in-scope AI use case recorded, with an accountable owner assigned to each one.
An AI impact assessment for each in-scope use case before it goes live. Agencies must have this requirement in place by 15 December 2026.
A process for handling AI incidents, and a way for staff and the public to report AI safety concerns.
Foundational AI training is mandatory for all APS staff, with staff who design and build use cases informed about Australia's AI Ethics Principles.
Underneath the Commonwealth policy sits the National framework for the assurance of AI in government, released by Data and Digital Ministers on 21 June 2024 and built on Australia's AI Ethics Principles. Because state frameworks rest on the same national framework, an agency or supplier that does the assurance work properly once can reuse most of it across jurisdictions. Our article on AI compliance requirements for government contracts covers the full set of layers a bid has to clear.
AI policy sits alongside the security frameworks agencies already work under. The Protective Security Policy Framework is reviewed each year, and PSPF Release 2025 introduced policy changes covering innovative technologies, including artificial intelligence.
On the technical side, the Australian Signals Directorate's IRAP program provides independent assessors who test how well a system implements the controls in the Information Security Manual. An IRAP assessment produces a report. It is not a certification, and the agency consuming the service decides whether to accept the remaining risk.
Our role: Solve8 is not an IRAP assessor and does not hold an IRAP assessment. We design AI systems so the controls and evidence an assessor will look for are there from the start, and we help suppliers understand the gap before they pay for an assessment.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
The Australian Government ran a whole-of-government trial of Microsoft 365 Copilot in the first half of 2024, across more than 60 agencies. The DTA's summary of evaluation findings found that Copilot may magnify poor data security and information management practices, and recommended that agencies configure their information systems, permissions and processes to accommodate generative AI safely.
That finding is the case for readiness work. Copilot answers from whatever each user can open, so a folder shared too widely years ago becomes searchable in plain English the day licences are assigned. In an agency, labels, retention and records obligations sit on top of the permissions question.
Our guide to the Copilot permissions audit covers the trial findings in more detail, including where Microsoft stores and processes Copilot data for Australian tenants.
Microsoft 365 Copilot readiness serviceCheck that Purview sensitivity labels reflect how information is actually classified, and that labelled content is handled as intended.
Sites open to every internal account, anonymous links and broken inheritance, found through SharePoint data access governance reports.
Restricted Content Discovery keeps high-risk sites out of Copilot answers while the clean-up finishes.
Confirm that Copilot prompts and responses are captured by your retention policies and audit logging.
Hosted AI services differ in where they store data, where they process it and what they may do with it afterwards. For some government information, the right answer is a model that runs entirely on infrastructure the agency controls. For others, an Australian cloud region with the right contract terms is enough. We document which applies to each use case and why.
Open models deployed on servers or private cloud you control, including networks with no internet connection.
Where hosted services are acceptable, we confirm storage location, processing location and training terms in writing before anything is connected.
From 10 December 2026, Privacy Act amendments require APP entities to describe substantially automated decisions that significantly affect individuals in their privacy policies.
Agency advisory work usually starts with the register, because a use case nobody has listed cannot be assessed. Supplier work starts from the other end, with the questions a buying agency will ask. Both end in a document you own.
We do not complete an agency's impact assessment for it. The accountable owner does that. We prepare the inputs so the assessment is accurate and quick. See what an AI strategy engagement produces and when to start with advice rather than a build.
Find AI already in use, including features vendors have enabled inside existing platforms, so the register starts complete.
Data sources, intended outcomes, risks and controls for each use case, written so your accountable owner can complete the agency's own assessment.
Candidate processes ranked by public value, payback and risk, with high-risk use cases flagged early.
Australian cloud region, agency-controlled infrastructure or no AI at all, with the reasoning written down.
For vendors: the documentation an agency needs to assess your product, kept current as your model or provider changes.
A phased plan with one pilot first, written so your team or another provider can deliver it.
The Royal Commission into the Robodebt Scheme is the reason Canberra treats automated decisions about people with caution, and it should be. The safest early AI projects support staff with reading, sorting and drafting, and leave decisions with a person who can explain them.
Typical candidates include triaging correspondence and submissions, extracting fields from grant and application forms, searching policy and legislation libraries, and drafting first responses for an officer to edit. Our notes on multi-agent document processing, connecting legacy systems to AI and the difference between agents and chatbots explain the building blocks. Where no product fits, we take it on as custom AI development, and our AI and RPA comparison helps decide whether AI is needed at all.
See what this would take in your business
A free 30-minute review on Microsoft Teams. Bring the process you want fixed and leave with a clear first step.
Each phase is scoped and priced before it begins, and stopping after discovery is a legitimate outcome. We work within your procurement method and security requirements, and tell you on the first call if a requirement is one we cannot meet.
A free 30 minute call to test whether there is a project, followed by a written scope with a fixed fee for the first phase.
Workshops in the room with the people who do the work, and the rest over Microsoft Teams or the meeting tools your agency permits.
Delivered in your environment under your access controls, or in an Australian cloud region you approve. One use case is piloted first.
Documentation, admin rights and the evidence your assurance process needs stay with you.
After handover, some organisations keep us on under managed AI services, and teams with their own developers sometimes prefer team augmentation. Before engaging anyone, our guide to choosing an AI consultancy and the AI readiness assessment are worth an hour of your time.
We are a small Australian consultancy and say plainly what we can and cannot do.
The consultant who scopes the work is the one who does it.
Our principal consultant spent 18 years on data and systems projects for BHP, Rio Tinto and Senex Energy, gained while working with previous consulting employers. These companies are not Solve8 clients. Our documented client work includes carbon reporting for Seymour Whyte.
The founder's own SupportAgent runs on customer infrastructure, and Carbonly handles emissions data. Both are his own products.
Australian business, working nationally
Australian regions or your own infrastructure
Accountability and evidence written in
Registered Australian business
Our principal consultant brings 18 years of enterprise delivery experience from projects for BHP, Rio Tinto and Senex Energy, delivered with previous consulting employers. These companies are not Solve8 clients. You work directly with senior people, not a sales team handing you off to juniors.
Guides on security, sovereignty and adoption questions that come up in government work
Questions from agencies and suppliers about AI policy, security and delivery
Have a question about AI for your agency or bid that is not covered here?
Book a Free Scoping CallSolve8 works with organisations in every state and territory. See all the places we work.
Book a free 30-minute consultation. We'll discuss your project, timeline, and budget. No pressure, just honest advice.
Or email us directly at hello@solve8.com.au