The AI Reference Architecture released by the Digital Transformation Agency (DTA) on 30 October gives Australian Government agencies a shared blueprint for designing, buying and governing AI systems, and it matters well beyond Canberra. Known as AIRA, it is voluntary guidance rather than a new law, but it tells agencies how to compare vendor offerings like for like. If you sell software, data or AI services to government, or you are about to put an AI agent in front of your own customers, it is worth understanding now. Here is what the DTA published, how agencies are expected to use it and what Australian businesses should do next.
What the DTA’s AI Reference Architecture covers
According to the DTA’s media release, AIRA translates government policy and technical expectations into reusable architectural structures that agencies can adapt to their objectives, operating environments and risk profiles. The introduction says it applies across machine learning, generative AI, agentic AI and emerging frontier capabilities, and to everything from vendor-managed services to bespoke applications and internally developed models. It is built around four constructs:
- Functional stack. Five layers: experience (how people and systems interact with AI), application and orchestration (workflows, business rules, models and human decisions), intelligence and analytics (how models are developed, tested, deployed, monitored and retired), data and metadata, and platform and infrastructure.
- Communication. How AI systems connect to people and other technology, including legacy systems, without exposing sensitive information.
- Trustworthiness and assurance. Safeguards designed in from the start: continuous monitoring, records of data, models and decisions, explainability, bias reduction, security, privacy and resilience. Agencies should also consider operating costs, environmental impact and dependence on external providers.
- Human agency, oversight and control. Clearly assigned roles, extra review or escalation for higher-risk or irreversible actions, and the ability for people to monitor, pause, change or stop a system within appropriate timeframes.
The DTA’s Lucy Poole compared it to designing a building: every structure needs a foundation, utilities, access points and safety overrides, but a cottage looks very different from a skyscraper. The DTA is also clear about its limits. AIRA is meant to be used after a problem has been defined, it does not replace business cases or procurement documents, and using it is voluntary.
How agencies will use it when buying AI
The introduction lists procurement as one of AIRA’s core jobs: informing buy, build or blend decisions and supporting “consistent, like-for-like evaluation of vendor offerings”. It also feeds into the government’s AI Use Case Impact Assessment and helps agencies trace requirements from the AI technical standard, including security, privacy, human oversight and safety controls.
The companion guide works through four scenarios: turning on AI inside an existing vendor platform, building a new in-house service, procuring an agentic call centre solution and adding machine learning to case management. Each maps where the agency can exercise control, from “govern” (assessing evidence, requiring disclosures, negotiating obligations) through “configure and govern” to “design, configure and govern”.
The call centre scenario is the one suppliers should read first. It warns that procurement decisions can be swayed by “visible features and demonstrations” rather than the properties needed to govern a system over time. Instead, agencies are told to compare offerings on integration with CRM, case management and telephony systems, traceability of actions, handling of high-consequence interactions, supervisor visibility and escalation, and to identify the simplest offering that can operate within clear, reviewable limits. That includes change-notification obligations and exit provisions. Where those conditions can’t be met, the guide says agencies may narrow the scope, demand stronger contractual control or defer the purchase.
What it means for Australian AI suppliers
AIRA does not create new rules, and the DTA has not said it will be written into tender requirements. Still, as industry site Aivy points out, suppliers should expect its language to turn up in tenders, because a shared way of comparing vendors shapes the questions buyers ask. Practically, a supplier should be ready to answer:
- Which layers of the stack does your product cover, and what does it depend on?
- How does it connect to the buyer’s existing systems, and under what controls?
- Can every action an agent takes be traced and reconstructed later?
- How can a person monitor, pause or stop it, and what happens on high-risk actions?
- What happens if the underlying model or provider changes, and how would the customer exit?
That last point links to the dependence on external providers that AIRA asks agencies to weigh. A design that can switch models, or run a private LLM option for sensitive data, is easier to defend. We covered the bigger picture in our post on sovereign AI and open-weight models.
Why private businesses should use it too
The full AI Reference Architecture and companion guide are free to read and download. A business putting its first AI agent in front of customers faces the same questions about data, oversight and vendors. The human oversight construct lines up with the issues in our posts on human overrides for automated decisions and the Privacy Act’s automated decision-making rules. Three practical steps:
- Map your AI use against the five layers. Note who owns each layer, which parts a vendor controls and which you can configure.
- Design the stop button first. Decide who can pause or override an agent, how escalation works and what gets logged. If you are unsure whether you need an agent at all, read AI agent vs chatbot.
- Treat integration as the real work. Most risk sits where AI touches your CRM, finance or case systems, which is why AI integrations and custom AI development should be scoped with oversight and traceability built in. For customer-facing teams, our free AI customer service course is a practical starting point.
This is general information based on the DTA’s AI Reference Architecture, companion guide and media release of 30 October 2026, and published media reporting as at 3 November 2026. It is not legal or procurement advice. AIRA is voluntary guidance for Australian Government agencies; check current DTA pages and specific tender documents for actual requirements.
Check your AI against the blueprint
An AI business audit maps where AI fits in your business, which tools and vendors you depend on, and where human oversight and traceability need to be designed in, using the same questions the AI Reference Architecture asks. Aideveloper designs and builds AI agents and integrations with control points built in from the start. Talk to us about your next AI project or tender.
Featured image: Photo by Diego Pontes on Pexels.
