AI and software development for Canberra and federal agencies

Who do we build custom software and AI for in Canberra, and how?

Our team is based in Sydney. We work remotely with Canberra organisations and travel down for workshops, design reviews and user testing when being in the room matters. Canberra shares Sydney’s time zone and is close enough for day trips, so on-site time is easy to arrange. We don’t have a Canberra office, and we don’t list one.

The people we’re best placed to help in Canberra are:

• Suppliers to federal agencies building software or AI products that must stand up to agency procurement and security review.
• Agency teams with unclassified work, such as prototypes, internal tools on OFFICIAL data, or discovery and technical advice, engaged through an appropriate pathway.
• Corporate Commonwealth entities, peak bodies and associations based in Canberra with their own procurement rules.
• ACT Government projects, which run under territory rather than federal privacy law.

What we can and can’t offer federal buyers

We are not on a government panel and hold no security clearances. That rules some work out, and it’s better you know on the first call than in week three. Here’s the honest picture:

Question a federal buyer will ask	Our answer
Are you on BuyICT’s Digital Marketplace Panel 2?	No
Does your team hold security clearances?	No
Do you have an IRAP-assessed system?	No (IRAP explained covers what that involves)
Can you work on classified systems or data?	No
Can you work on OFFICIAL, unclassified systems?	Yes, subject to your agency’s requirements
Is delivery onshore, with data in Australian regions?	Yes, by default
Will you work under a prime contractor that holds the panel arrangement?	Yes
Can you build to the DTA AI policy and PSPF expectations?	Yes, and provide the evidence; the agency remains responsible for its own obligations

How do federal agencies buy digital services?

Most federal digital and ICT buying runs through BuyICT, the DTA’s platform connecting government buyers with digital and ICT sellers across six marketplaces. It hosts the whole-of-government arrangements for hardware, software, cloud and digital services.

For custom software and AI work, the arrangement that matters most is the Digital Marketplace Panel 2. At the time of writing it has two modules, ICT labour hire and professional and consultancy services, and it’s opt-in for non-corporate and corporate Commonwealth entities and for state and territory government entities. Some other BuyICT arrangements, such as the Data Centre Panel, are mandated for non-corporate Commonwealth entities.

If you are comparing software companies in Canberra, panel membership and clearances are usually the first filter, before price or portfolio. Because we aren’t on a panel, the realistic routes to working with an agency are as a subcontractor to a panel seller, or through an approach to market that permits non-panel suppliers. Our guide to selling software to Australian government walks through these pathways for vendors.

What does the DTA AI policy require, and when?

The Policy for the responsible use of AI in government applies to all non-corporate Commonwealth entities, with some exceptions, and version 2.0 took effect on 15 December 2025. It replaced version 1.1, which had applied since 1 September 2024. The DTA says the first new mandatory requirement began on 15 June 2026, with all remaining requirements coming into effect in December 2026.

Date	Milestone
1 September 2024	Version 1.1 takes effect: accountable officials and AI transparency statements
15 December 2025	Version 2.0 takes effect, supported by a new AI impact assessment tool
15 June 2026	First new mandatory requirement under version 2.0 begins
December 2026	All remaining version 2.0 requirements in effect

Version 2.0 adds requirements for agencies to take a strategic approach to AI adoption, operationalise responsible use, assign accountability for each AI use case, and carry out risk-based actions at the use case level, including impact assessments. The policy also points agencies to the DTA’s guidance on AI procurement and its AI model clauses for contracts.

For suppliers, the effect is that agencies will ask for more evidence about any AI in what they buy: what the model is, where it runs, how it was tested, how outputs are reviewed, and how incidents are reported. Our guide to the DTA AI policy covers each requirement in detail.

Where does the PSPF fit?

The Protective Security Policy Framework sets the Australian Government’s protective security requirements and is mandatory for non-corporate Commonwealth entities; Home Affairs updates it every year. PSPF Release 2026 was issued on 1 July 2026. The 2025 release introduced changes to personnel and information security and to the handling of technologies such as artificial intelligence and quantum computing, and gave authority to new security standards for gateway security and systems of government significance. Release 2026 adds post-quantum cryptography transition planning, AI training and bring-your-own-device obligations.

The PSPF binds agencies, not suppliers directly, but its requirements reach suppliers through contracts: personnel security, where data is hosted, who can access it and how incidents are reported. Federal agencies handling sensitive or security classified data also look for hosting providers certified under the Hosting Certification Framework, which the Department of Home Affairs runs (new certifications have been paused since 3 November 2025 while the framework is reformed). A useful companion is the ASD’s Essential Eight, covered in our guide to the Essential Eight for software projects.

A supplier evidence pack for Canberra buyers

If you sell software or AI into federal agencies, prepare these before procurement asks. We build most of them as part of delivery:

1. System description: components, data flows and every place data is stored or processed
2. Hosting statement: cloud provider, region, and certification status of the services used
3. AI use description: model, version, provider, where inference runs, and what’s logged
4. Evaluation results: test sets, accuracy measures and known limitations
5. Human oversight design: who reviews what, and how a person can override the system
6. Security controls mapped to the Essential Eight and your contract’s requirements
7. Incident and data breach response plan with named contacts
8. Transparency text an agency could adapt for its AI transparency statement

ACT Government projects

ACT Government agencies are covered by the Information Privacy Act 2014 (ACT), which the ACT Privacy Commissioner has administered since that office was appointed on 1 July 2024. Before then, the OAIC provided privacy services to the ACT under an agreement. The OAIC also notes that private health providers in the ACT must follow both federal and territory privacy law when handling health information. For software, that means designing to the territory’s principles for agency systems, and treating health data under both regimes.

Hosting for Canberra workloads

At the time of writing, Microsoft runs two Azure regions in Canberra, Australia Central and Australia Central 2, alongside Australia East and Australia Southeast. AWS and Google Cloud serve Canberra from their Sydney and Melbourne regions. Which is right depends on the certification status of the specific services an agency needs, so we check that during discovery. The data residency vs data sovereignty explainer covers the wider question.

How All Webbed Labs approaches Canberra work

Founder Andy Taleb has been building software professionally since 2019 and running All Webbed Up since 2021; All Webbed Labs launched in mid 2026 as a partnership with a group of senior developers and founders. For Canberra work we start with an NDA and paid discovery, scoped to your security and procurement constraints, then quote a fixed price. Senior engineers do the work, code lives in your repository, and data stays in Australian regions by default. See our government AI and software page and AI consulting service.