According to PSPF Direction 002-2026, published by the Department of Home Affairs on 29 September 2026, every non-corporate Commonwealth entity must stocktake its legacy technology and send Home Affairs a risk management plan by 31 March 2027. Entities running Systems of Government Significance face an earlier date of 31 December 2026.
Key takeaways
- Binds non-corporate Commonwealth entities under the PGPA Act.
- Stocktake and plan are due by 31 March 2027.
- Systems of Government Significance have a 31 December 2026 deadline.
- Detailed measures sit in Policy Explanatory Note 002-2026.
- Private suppliers are not bound directly.
What the Direction requires
The Direction lists four numbered requirements. By 31 March 2027 each entity must:
- Run a Legacy Technology Stocktake of systems managed by it or on its behalf, prioritising public facing services.
- Keep a Legacy Technology Risk Management Plan inside its cyber security strategy and uplift plan.
- Report the stocktake to the Commonwealth Security Policy Branch and send a copy of the plan.
The plan must include a reduction target set against the entity's own risk tolerance, prioritisation strategies, mitigations for systems that stay and procedures to rationalise the estate.
The fourth requirement applies to entities operating Systems of Government Significance (SoGS). By 31 December 2026 they must apply the SoGS Risk Reduction Measures and report the stocktake of those systems. The Direction says those measures are set out in Policy Explanatory Note 002-2026, to be issued by 13 October 2026.
What counts as legacy
The Direction borrows the test from PSPF section 13.7. A product is legacy when it meets at least one criterion in each of two categories.
Category A covers vendor status: end of life, out of support or on extended support. Category B covers the entity. It applies when a product is:
- impractical to update or support in house
- no longer cost-effective
- above the acceptable risk threshold
- of diminishing business use
- blocking the entity's IT strategy
Who it binds and who it does not
The PSPF applies to non-corporate Commonwealth entities subject to the Public Governance, Performance and Accountability Act 2013. The Direction does not bind private companies, state agencies or suppliers.
Suppliers still sit inside the scope indirectly. The stocktake covers systems run "on behalf of" an entity, so a hosted or outsourced service can end up on an agency's list.
Where AI fits
The title mentions AI-enabled risks. The requirements are about legacy systems and patching. The Direction states that frontier AI capabilities "have targeted the Commonwealth's technology estate", and asks entities to patch critical vulnerabilities rapidly because the time between discovery and exploitation has shortened.
Information & Data Manager reported on 2 October 2026 that the Direction followed OpenAI's disclosure that its models accessed four Australian government services without authorisation.
Sorami’s view
This section is opinion. It is our reading of the Direction for suppliers, not a statement from Home Affairs.
If you sell software or hosting to a federal agency, expect your product to be tested against Category A in the next contract review. An agency can only meet its reduction target by asking vendors for support dates, patch timelines and evidence of how quickly critical fixes ship.
Have those answers written down before the questionnaire arrives. A support policy page and a patching record are cheaper to produce now than under a tender deadline.
What to do now
- List every component you supply with its vendor support end date.
- Write down your patch time for vendor-rated critical vulnerabilities.
- Check whether an agency runs your service on its behalf.
- Watch for Policy Explanatory Note 002-2026 and its SoGS measures.
If you supply an agency and want the evidence checked, see our cloud security review, or contact us to discuss scope.
Related guides
- What the September 2026 ISM requires for AI agents
- ASD Cyber Action Year 2026: the five critical actions
- Every Sorami article is in the guides index.
Sources
- Department of Home Affairs, PSPF Direction 002-2026, Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks (29 September 2026)
- PSPF Direction 002-2026, full text (PDF, two pages)
- Information & Data Manager, Home Affairs Orders Legacy IT Stocktake (2 October 2026)
Facts on this page were checked against these sources on 12 October 2026. We update the page when the source changes.