The short answer
To sell software to the Australian government at federal level, you usually go through BuyICT, the Digital Transformation Agency's platform for whole-of-government panels such as the Digital Marketplace Panel 2, the Software and ERP Marketplace Panel and the Cloud Marketplace Panel, or respond to open tenders on AusTender. The Commonwealth Procurement Rules that took effect on 17 November 2025 raised the non-corporate entity threshold to $125,000 and require agencies to invite only Australian businesses for many smaller procurements. States run their own arrangements, such as the NSW ICT Services Scheme and Victoria's Supplier Hub. Expect security questions based on ASD's Information Security Manual, especially for cloud and AI products.
Key takeaways
- BuyICT hosts six DTA whole-of-government marketplaces; some are mandated for non-corporate Commonwealth entities in specific categories, others are opt-in.
- Under the Commonwealth Procurement Rules from 17 November 2025, the procurement threshold for non-corporate Commonwealth entities is $125,000 (GST inclusive) for non-construction work.
- Between $10,000 and that threshold, outside standing offers, non-corporate entities must invite only Australian businesses, unless an official documents why not.
- For DTA standing offers under $125,000, non-corporate entities must first invite only the SMEs on that panel.
- NSW's ICT Services Scheme is mandated for NSW agencies and always open to new suppliers; Victoria asks suppliers to register on its Supplier Hub.
How does Australian government buy software?
Australian government buys software through three main routes: whole-of-government panels, open tenders, and smaller direct procurements under the relevant procurement rules. Federal agencies use BuyICT for digital and ICT panels and AusTender for published tenders. Each state and territory runs its own schemes and portals.
The practical question for a software company is which route its buyers use for its category, and what it needs to be eligible for that route. That depends on the level of government, the size of the purchase, and what the product does.
What are the requirements to sell software to government?
There is no single licence to sell software to government; the requirements depend on the route and the buyer. For most software companies they come down to five things.
| Requirement | What it involves | Where it comes from |
|---|---|---|
| A route to the buyer | Membership of the relevant panel or scheme, or a response to a published tender | BuyICT, AusTender, state schemes such as the NSW ICT Services Scheme |
| Supplier status | Evidence that you meet the definitions of an Australian business or an SME, if you want the benefit of the preferences | Commonwealth Procurement Rules 2025 |
| Security evidence | An ISM-informed control summary, your Essential Eight position and, for sensitive cloud data, possibly an IRAP assessment | Agency requirements based on ASD guidance |
| AI information | Descriptions, test results and change notices agencies need for their own assessments | DTA policy for the responsible use of AI in government |
| Contract terms | Acceptance of the panel head agreement or state contracting framework, including liability, IP and data clauses | The panel or scheme’s terms |
The sections below cover each route in turn. It pays to have all five in place before you bid, rather than assembling them under a tender deadline.
What is BuyICT?
BuyICT is the Digital Transformation Agency’s platform connecting government buyers with digital and ICT sellers, and it hosts the DTA’s whole-of-government procurement arrangements. The DTA describes six marketplaces on it. Whether an agency must use a given panel depends on the agency type and the category:
| Arrangement | What it covers | Use by agencies (per the DTA) |
|---|---|---|
| Digital Marketplace Panel 2 | Module 1: ICT labour hire. Module 2: professional and consultancy services | Opt-in for non-corporate and corporate Commonwealth entities and state and territory entities |
| Software and ERP Marketplace Panel | Software, including enterprise resource planning | Mandatory for non-corporate Commonwealth entities buying ERP products; opt-in for corporate Commonwealth entities |
| Cloud Marketplace Panel | Cloud services | Opt-in for non-corporate and corporate Commonwealth entities and state and territory entities |
| Hardware Marketplace Panel | Desktops, laptops, monitors, printers and similar | Mandated for non-corporate Commonwealth entities for listed device types |
| Telecommunications Marketplace Panel | Data and internet carriage, enterprise mobility | Mandated for non-corporate Commonwealth entities for those services |
| Data Centre Panel 3 | Data centre services | Mandated for non-corporate Commonwealth entities |
For a custom software or AI services company, the Digital Marketplace Panel 2 is usually the relevant arrangement. For a SaaS product, the Software and ERP Marketplace Panel or the Cloud Marketplace Panel may fit, depending on what it is. Panels are established through an approach to market, so check BuyICT for when each accepts new sellers and what it requires.
What changed in the Commonwealth Procurement Rules in 2025?
The Commonwealth Procurement Rules (CPRs) that took effect on 17 November 2025 introduced Australian business and SME preferences for smaller procurements and raised the non-construction threshold for the first time in 20 years. The foreword says the changes aim to prioritise Australian businesses below the thresholds and SMEs on panels including the Digital Marketplace.
The numbers that matter to software sellers (values include GST):
| Rule | What it says |
|---|---|
| Procurement threshold, non-corporate Commonwealth entities (non-construction) | $125,000. At or above it, the additional Division 2 rules apply, such as open tender unless an exemption or limited tender condition applies |
| Procurement threshold, prescribed corporate Commonwealth entities (non-construction) | $400,000 |
| Australian business preference (paragraph 5.4) | From $10,000 up to the threshold, excluding standing offers, non-corporate entities must invite only Australian businesses, unless an official documents why that isn’t appropriate |
| SME preference on panels (paragraph 5.5) | Below $125,000 from the Management Advisory Services Panel, the People Panel or any DTA standing offer, non-corporate entities must invite only the SMEs on that panel first |
| SME exemption (Appendix A, item 17) | Procurements up to $500,000 from an SME can be exempt from the Division 2 rules, after the Indigenous Procurement Policy is satisfied |
| SME targets | At least 25% of contracts by value from SMEs for contracts up to $1 billion, and a target of 40% for contracts up to $20 million |
| Contract reporting | Non-corporate entities report contracts of $10,000 or more on AusTender within 42 days |
| Open tender response time | Generally at least 25 days, and no less than 10 days where shortening is allowed |
Two definitions decide eligibility. An Australian business has 50% or more Australian ownership (or is principally traded on an Australian equities market), is an Australian tax resident, and has its principal place of business here. An SME is an Australian or New Zealand business with fewer than 200 full-time equivalent employees, including associated entities.
How do state governments buy software?
Each state and territory has its own procurement rules, schemes and tender portal, and federal panel membership doesn’t carry across.
| Jurisdiction | Main route for ICT suppliers | Notes |
|---|---|---|
| New South Wales | ICT Services Scheme (SCM0020) | A whole-of-government mandated scheme for ICT goods and services under Procurement Board Direction PBD-2021-04. Always open: suppliers can apply at any time after becoming a registered NSW Government supplier. Two lists: registered and advanced suppliers. Contracts use the Core& framework for low-risk ICT work up to $1 million (ex GST) and MICTA/ICTA for higher risk or larger work |
| Victoria | Supplier Hub and Digital Marketplace | Businesses register on Supplier Hub. The Digital Marketplace brings together state purchase contracts and registers, and only government buyers can create accounts on it |
| Queensland | QTenders | The state’s portal for published tender opportunities |
| Western Australia | Tenders WA | The state’s portal for published tender opportunities |
| Other states and territories | Their own portals and panels | Check each jurisdiction’s procurement site for ICT arrangements |
If you are targeting one state, start there rather than federally. The NSW scheme’s always-open policy, for example, makes it a common first step for ICT suppliers selling to NSW agencies.
What security evidence will agencies ask for?
Expect questions framed around ASD’s Information Security Manual (ISM), the Essential Eight and, for cloud products handling sensitive data, an IRAP assessment. The level of scrutiny rises with the sensitivity of the data your product will hold.
- IRAP. An independent assessment against the ISM by an ASD-endorsed assessor. It isn’t a certification, but agencies are most likely to ask for one where a cloud service will hold sensitive or classified information. See IRAP explained.
- Essential Eight. ASD’s baseline mitigation strategies. Agencies may ask how your product supports MFA, patching and restricted admin access. See the Essential Eight for custom software.
- Data location. Many agencies expect data, backups and logs to stay in Australia, and federal hosting for sensitive data involves the Hosting Certification Framework. See data residency vs data sovereignty.
- AI. If your product uses AI, agencies have their own obligations under the DTA’s policy for responsible use of AI in government, which flows into what they ask suppliers. See the DTA AI policy guide.
Is the government market right for your product?
Government can be a stable, long-term customer, but it suits some software companies far better than others. Be honest about the fit before you invest in panel applications and security assessments.
It tends to suit products that solve a problem many agencies share, that can meet ISM-based security expectations without a rebuild, and that come from companies able to wait. Procurement cycles are often long, budgets follow the financial year, and a contract can take months to finalise after a successful bid. The 2025 changes to the Commonwealth Procurement Rules help Australian SMEs at the smaller end, but they don’t remove the paperwork.
It tends not to suit early-stage products still finding their market, products that depend on offshore processing of sensitive data, or companies without the cash flow to carry a long sales cycle. For those, commercial customers are usually a faster path, with government as a later step once the product and its security evidence are mature.
A middle path many software companies take is to partner with an established panel supplier as a subcontractor. That can work well, but read the panel’s head agreement first, because subcontractors often inherit its obligations on security, data and liability.
How to sell software to government: a step-by-step checklist
Most software companies get further by choosing one buyer group and one route, getting eligible, and building evidence, rather than applying everywhere at once.
- Pick the buyer. Federal, one state, or local government. Each has different rules and channels.
- Find the route for your category. Check the DTA’s BuyICT arrangements for federal buyers, or the relevant state scheme.
- Confirm your status. Check whether you meet the CPR definitions of an Australian business and an SME, and gather the evidence.
- Register. Create supplier accounts on BuyICT, AusTender and the relevant state portal, and set alerts for your categories.
- Apply to the panel or scheme when it’s open, following its rules exactly.
- Prepare security documentation. Architecture and data flow diagrams, hosting regions, an ISM-informed control summary, and your Essential Eight position.
- Decide on IRAP. If your target buyers will put sensitive data in your product, plan and budget for an assessment.
- Get your contracts ready. Read the panel’s head agreement or the state contracting framework before you bid, especially liability, IP and data clauses. Our software development contract checklist covers the common issues.
- Respond well. Answer the evaluation criteria directly, with evidence, and meet every deadline. Late responses may not be considered.
- Report and deliver. Once contracted, expect reporting, audit rights and performance management.
How All Webbed Labs fits in
All Webbed Labs isn’t on BuyICT, the Digital Marketplace Panel 2, the NSW ICT Services Scheme or any other government panel, and it doesn’t hold security clearances or an IRAP assessment. Please don’t read this guide as a claim otherwise.
Where we can help is on the product side: building SaaS and AI products for companies that want to sell to government, with Australian hosting regions by default, documented architecture and data flows, and the engineering the Essential Eight and ISM point to. See our SaaS development service and AI and software for government.
Frequently asked questions
Do I need to be on a panel to sell software to the federal government?
Not always. Panels are the most common route for many categories, and some are mandated for non-corporate Commonwealth entities in specific cases, such as enterprise resource planning products through the Software and ERP Marketplace Panel. Agencies can also buy through open tenders published on AusTender, and some smaller procurements happen outside panels. Check the DTA's list of mandated and opt-in arrangements for your category.
What counts as an Australian business under the Commonwealth Procurement Rules?
The 2025 rules define an Australian business as one that, including any parent, has 50% or more Australian ownership or is principally traded on an Australian equities market, is an Australian resident for tax purposes, and has its principal place of business in Australia. For the paragraph 5.4 rule on smaller procurements only, New Zealand businesses are included too.
What is an SME for government procurement?
Under the Commonwealth Procurement Rules, an SME is an Australian or New Zealand business with fewer than 200 full-time equivalent employees, counting employees of associated entities such as parent companies and subsidiaries.
Do I need an IRAP assessment to sell to government?
It depends on the data your product will handle and the agency's requirements. Agencies are most likely to ask for an IRAP assessment where a cloud service will hold sensitive or classified information. Many smaller or lower-risk purchases won't require one, but you should expect questions about ASD's Information Security Manual and the Essential Eight.
How do I register as a government supplier in Australia?
There's no single national register. For federal work, create accounts on BuyICT and AusTender and apply to the relevant panel when it opens. For states, register with each jurisdiction: for example, become a registered NSW Government supplier before applying to the NSW ICT Services Scheme, or register on Victoria's Supplier Hub.
Is All Webbed Labs on BuyICT or a state panel?
No. All Webbed Labs isn't a seller on any BuyICT marketplace panel, the NSW ICT Services Scheme or any other government panel or scheme. This guide is general information for software companies considering the government market.
How long do agencies give suppliers to respond to an open tender?
For procurements at or above the threshold, the Commonwealth Procurement Rules generally require at least 25 days from publication of the approach to market to the submission deadline, which can be shortened to no less than 10 days in limited circumstances.
Sources
- BuyICT , Digital Transformation Agency
- Commonwealth Procurement Rules , Department of Finance
- Commonwealth Procurement Rules, 17 November 2025 (PDF) , Department of Finance
- AusTender , Australian Government
- ICT Services Scheme (SCM0020) , NSW Government
- Access the Digital Marketplace , Victorian Government
- QTenders , Queensland Government
- Tenders WA , Government of Western Australia