60% of Australian agencies keep AI use secret, stoking government cyber risk

From a cybersecurity standpoint, the sheer absence of transparency about government AI usage is an alarm bell. Every undocumented model is a potential blind spot: without even a basic public inventory, there is no baseline for vulnerability assessments, adversarial testing or supply‑chain security audits. The fact that over half of Australian agencies failed to meet a simple disclosure requirement suggests the same bodies may be equally unprepared for the advanced threat landscape that AI systems introduce—including data poisoning, model inversion and prompt‑based attacks.

More than half of Australian government agencies missed the first mandatory deadline to disclose how they are using artificial intelligence, a failure that strikes at the heart of the nation's distinctive ‘soft‑touch’ regulatory model for AI. Documents tabled in the Senate by the Digital Transformation Agency (DTA) reveal that dozens of federal bodies did not submit the required transparency statements, with those that did offering reports of markedly uneven depth. The lapse comes just over a year after Canberra deliberately rejected the European Union’s binding, horizontal AI Act in favour of a decentralised approach that tasks existing regulators—and the agencies themselves—with policing AI use. The revelations, made public on 12 June 2026, provide the first empirical stress test of that model, and the result is a conspicuous lack of compliance.

“

The lapse comes just over a year after Canberra deliberately rejected the European Union’s binding, horizontal AI Act in favour of a decentralised approach that tasks existing regulators—and the agencies themselves—with policing AI use.

The policy architecture is critical to understanding the failure. In 2025, following intense debate and a post‑election shift, the federal government concluded that a single overarching AI law was unnecessary. Instead, it directed each government agency to manage its own adoption of the technology and to oversee AI within its respective industry sector. As a foundational step, the DTA issued a policy requiring agencies to publish basic transparency statements detailing what AI systems they operated, for what purposes, and with what safeguards. The stated ambition was to build public trust through openness. However, the Senate documents show that more than half of the agencies checked by the DTA simply did not meet the first reporting deadline. Even among those that complied, the quality varied dramatically: a few were described as ‘detailed,’ many as ‘scant,’ often little more than a single sentence acknowledging that AI might be in use.

Independent senator Fatima Payman, who extracted the data through the Senate estimates process, framed the lapse as a fundamental credibility crisis. ‘If the government can’t even regulate its own AI use, how can Australians expect it to regulate AI in the private sector, which is reshaping the workplace for millions of Australians?’ she asked. Her intervention underscores the political and public stakes: opaque AI systems inside government can affect everything from welfare eligibility to immigration decisions, and without transparency, the risk of biased, erroneous or unaccountable decision‑making proliferates.

DTA deputy CEO Lucy Poole acknowledged the difficulty of keeping pace with a technology that ‘presents a rate of change’ requiring flexibility. Yet that very acknowledgment highlights the tension at the core of the soft‑touch model. If agencies cannot manage even a simple disclosure requirement, critics argue, they are unlikely to conduct the more demanding tasks of risk assessment, bias audits or adversarial testing. The European Union, by contrast, imposes binding registration for high‑risk AI systems, mandatory fundamental‑rights impact assessments, and market‑surveillance powers—tools that Australia explicitly declined.