The opening paragraph
Was: “It does not test who can lawfully switch that provider off. For a department assessing its own AI stack, that question often gets asked by no one at all.”
Now: “Two of the instruments it leans on, the Foreign Ownership, Control or Influence guidance and the Hosting Certification Framework, do not reach the question of who can lawfully compel or switch off an allied-owned provider. For a department assessing its own AI stack against those instruments, that question can go unasked.”
What was wrong: The claim was made of the whole regime, but it holds only for two instruments and for providers owned in allied countries, and no source counts how often the question goes unasked.
Classification: Wrong in part when made, and overtaken in part by later work (change 6).
Source: Department of Home Affairs, Foreign Ownership, Control or Influence Risk Assessment Guidance, printed pages 7 and 9 (Section 1 and the flowchart) and printed page 10 (Step 2); Hosting Certification Framework, March 2021; AOS-CMP-2026-001 version 1.4, section 2, for the two instruments the regime relies on.
The opening example
Was: “In June 2026 an American artificial intelligence company had two of its most capable models switched off. Not by a hacker. Not by an outage. By its own government, acting lawfully, under export control law. Access was suspended, no allied nation held an exemption, and when capability was later restored it was restored to approved American institutions first.”
Now: “In June 2026 an American artificial intelligence company disabled two of its models for every customer it had. Not because of a hacker. Not because of an outage. To comply with an export control directive issued by its own government, citing national security authorities. The directive’s terms reached any foreign national, inside or outside the United States. The company’s own account of the effect was blunter: to comply, it had to disable the models for all of its customers.”
What was wrong: The company’s statement does not mention exemptions for allied nations, any restoration of access, or “most capable” models.
Classification: Unsupported when made.
Source: Anthropic, statement of 12 June 2026: “citing national security authorities”, “any foreign national, whether inside or outside the United States”, and “we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance”.
The FOCI question
Was: “The opening question asks whether the beneficial owner sits in a Five Eyes country. If the answer is yes, the assessment routes the vendor toward cyber hygiene and never reaches the section that asks the sharper thing, whether a foreign government can lawfully compel that vendor to produce data.”
Now: “The opening question asks whether the beneficial owner of the vendor is from a Five Eyes country. If the answer is yes, the assessment routes the vendor toward cyber hygiene and closes before it reaches the section that asks the sharper thing, whether a foreign government can lawfully compel that vendor to produce data.”
What was wrong: The opening question was paraphrased, and the routing ends the review at that branch rather than passing the later section by.
Classification: Wrong when made.
Source: Foreign Ownership, Control or Influence Risk Assessment Guidance, printed page 7, Section 1: “Is the beneficial owner of the vendor from a Five Eyes country (Australia, Canada, New Zealand, UK, and United States)?” and “If YES, consider cyber security hygiene risks posed by the vendor”; printed page 9, the flowchart.
The Hosting Certification Framework
Was: “It certifies providers against a sovereignty standard and places the strongest of them at its highest tier, Strategic. Several of the providers at that tier are the Australian arms of American companies, and their parentage is not a matter of opinion. It sits on the public record in each parent's own filings with the United States Securities and Exchange Commission.”
Now: “It certifies providers against what its own text calls the ability of the government to specify and maintain stringent ownership and control conditions, and it places the strongest of them at its highest tier, Certified Strategic. At that tier, ten of the twenty-eight certified providers are under foreign control, and eight of those resolve to a United States parent. Their parentage is not a matter of opinion. It is resolved from the companies’ own filings on the public register, by anyone who cares to look.”
What was wrong: The standard and the top tier were not named in the framework’s own words, “Several of the providers at that tier” stood where counts now exist, and the parentage comes from Australian company records, not United States filings.
Classification: Unsupported when made. The counts come from AOS-HCF-2026-001, first published on 4 August 2026; no version of it existed when the text was submitted on 7 July 2026.
Source: Hosting Certification Framework, March 2021: “sovereignty refers to the ability of the government to specify and maintain stringent ownership and control conditions” and “Certified Strategic Hosting Provider represents the highest level of assurance”; AOS-HCF-2026-001 version 1.3, 25 August 2026: “Ten of the twenty-eight providers are under foreign control: eight United States, one Japan, one Canada.”
The seam
Was: “Both instruments pass over it.”
Now: “For an allied-owned provider, both instruments pass over it.”
What was wrong: The sentence carried the claim of the opening paragraph and is narrowed with it.
Classification: As change 1: wrong in part when made, and overtaken in part by later work.
Source: As change 1.
The Digital Transformation Agency’s principles
Was: no such paragraph.
Now: “One thing has moved, and it is worth saying plainly. Since 31 August 2026 the Digital Transformation Agency’s principles for its coordinated contracting arrangements direct the agency to consider whether a seller, including any parent company, may be subject to laws, regulatory directions or other arrangements which could create risks that override or circumvent Australian contractual protections. That is the question, asked at last, inside an instrument. Two things bound it. The principles state no method for establishing the answer. And they reach those coordinated arrangements and no other procurement.”
What was wrong: The submitted text predates the principles published on 31 August 2026, so this is an update, not a correction.
Classification: Overtaken by later work: an update, not a correction.
Source: Digital Transformation Agency, Coordinated contracting arrangements (CCA) principles, fourth principle: “the DTA will consider whether the proposed CCA: presents risk if the seller, including any parent company, may be subject to laws, regulatory directions or other arrangements which could create risks that override or circumvent Australian contractual protections”; its media release of 31 August 2026; and CCAs vs other procurement and contracting arrangements.
Defence
Was: “carries cloud and AI componentry with American parentage in the stack.”
Now: “buys cloud services from an Australian company whose declared ultimate holding company is American. The contract notices sit on the public record.”
What was wrong: No source shows AI components in Defence’s systems; the contract notices show cloud services bought from an Australian company whose ultimate holding company is American.
Classification: Unsupported when made.
Source: AusTender contract notices CN4175631, “Cloud Services”, $33,506,683.31, Defence, 16 July 2025 to 30 April 2028, and CN4124201, “Cloud and Web Services”, $17,717,709.00, Defence, 1 January 2025 to 31 December 2026, each naming Amazon Web Services Australia Pty Ltd; the ASIC current company extract for that company, ACN 605 345 891, 18 July 2026, which names its ultimate holding company as AMAZON.COM, INC.; and AOS-AWS-2026-001 version 1.1, which states that Amazon.com, Inc. is a United States company.
The inference from Defence
Was: “then the ordinary department, running a lighter assurance apparatus, holds it too. By definition it holds it worse, because it has less watching the gate.”
Now: “then a department running a lighter assurance apparatus holds it too, and holds it with less watching the gate.”
What was wrong: An inference was stated as a necessity, and “the ordinary department” described a typical case that no source describes.
Classification: Wrong when made.
Source: Removes an inference. Adds no fact. The premise rests on the records cited for change 7.
The assessment form
Was: “It is not asked. There is no field on the form for it, and no person assigned to raise it.”
Now: “The question that does get asked is where the servers are. The Government’s own AI impact assessment tool asks, of a cloud deployment, whether the servers are located in Australia or overseas, and it ties foreign law to data being taken offshore. Its guidance asks an agency to determine if data will be hosted overseas and if it could be subject to foreign laws. Whether a provider can be lawfully compelled while its servers sit in Australia is a different question, and these instruments do not put it.”
What was wrong: The form does ask about foreign law, but only through the location of the servers, so “no field on the form” was wrong in part.
Classification: Wrong in part when made.
Source: Digital Transformation Agency, AI impact assessment tool, last updated 1 December 2025: “If deploying through the cloud, are the servers located in Australia or overseas?” and “It may also result in data being subject to foreign laws where that data is taken offshore”; its Guidance, last updated 1 December 2025: “Determine if data will be hosted overseas and if it could be subject to foreign laws”.
“That is most departments”
Was: “That is most departments. That is, quite possibly, yours.”
Now: “That seat exists in any department that procures AI this way. It may well be yours.”
What was wrong: No source counts how many departments procure AI tools and assess them themselves.
Classification: Unsupported when made.
Source: Guidance for the AI impact assessment tool, last updated 1 December 2025, which places the assessment with an officer of the agency.
“Right now, across a large share”
Was: “Right now, across a large share of Commonwealth technology, it is not seen, because the instruments meant to surface it were built to ask different questions”
Now: “Wherever these two instruments are the only ones applied, it is not seen, because they were built to ask different questions”
What was wrong: The phrase “a large share of Commonwealth technology” is a measure no source makes.
Classification: Unsupported when made.
Source: As changes 1, 3 and 4.
The closing
Was: “The question is the one those frameworks step around.”
Now: “The question is the one those two instruments do not reach for an allied-owned provider.”
What was wrong: The closing sentence carried the claim of the opening paragraph and is narrowed with it.
Classification: As change 1: wrong in part when made, and overtaken in part by later work.
Source: As change 1.
Hashes
The text as submitted, sent to the editor on 7 July 2026 as cyber-australia-the-question-no-framework-asks.docx, SHA-256 04697c780fb0f23f6ef76beba7dae2adbf915a6257f30b83df097efc06d3bca3. This is the text the printed edition carries.
The corrected text, sent to the editor on 21 September 2026 as The-Question-No-Framework-Asks-FINAL-2026-09-21.pdf, SHA-256 9be699b9141ae9272303996ece91192f014991a72216ecfcb25078879ead01a6. The corrected text below is the text of that file.
The dates of supply and of print, that the corrections were supplied to AISA on 20 and 21 September 2026 after the edition had gone to print, rest on the author’s correspondence with AISA of 7 July to 22 September 2026, which AustraliaOS holds and does not publish. Its printed copy is pinned as AISA-THREAD-1, SHA-256 c9f38379994eabb2b1f57d5276dbe738c6480231a30767fb50529d7428b665a1.
The Question No Framework Asks
Australia’s cloud assurance regime tests where your data lives and who owns the provider. Two of the instruments it leans on, the Foreign Ownership, Control or Influence guidance and the Hosting Certification Framework, do not reach the question of who can lawfully compel or switch off an allied-owned provider. For a department assessing its own AI stack against those instruments, that question can go unasked.
In June 2026 an American artificial intelligence company disabled two of its models for every customer it had. Not because of a hacker. Not because of an outage. To comply with an export control directive issued by its own government, citing national security authorities. The directive’s terms reached any foreign national, inside or outside the United States. The company’s own account of the effect was blunter: to comply, it had to disable the models for all of its customers.
Read that again, because the mechanism matters more than the headline. A running service, relied upon by customers outside the United States, was lawfully reachable by the country that incorporated its provider, and the reach was exercised. Nothing was breached. Nothing was stolen. The law worked exactly as written. That is the point.
Now hold that event next to a question a board is meant to be able to answer about its own technology. Who can lawfully compel, or switch off, the providers this organisation runs on. Not who might attack them. Who can order them, lawfully, and be obeyed.
Most people reach for reassurance here, and in government the reassurance has names. We have the Foreign Ownership, Control or Influence guidance. We have the Hosting Certification Framework. We assessed the vendor. We are covered.
Walk the first of those instruments and watch what it actually does. The FOCI intake begins with ownership. The opening question asks whether the beneficial owner of the vendor is from a Five Eyes country. If the answer is yes, the assessment routes the vendor toward cyber hygiene and closes before it reaches the section that asks the sharper thing, whether a foreign government can lawfully compel that vendor to produce data. A Five Eyes owned provider exits at the first branch. The instrument that looks like it screens for foreign legal reach screens for foreign ownership instead, and treats an allied owner as the end of the inquiry rather than the start of it.
The Hosting Certification Framework does something similar from the other direction. It certifies providers against what its own text calls the ability of the government to specify and maintain stringent ownership and control conditions, and it places the strongest of them at its highest tier, Certified Strategic. At that tier, ten of the twenty-eight certified providers are under foreign control, and eight of those resolve to a United States parent. Their parentage is not a matter of opinion. It is resolved from the companies’ own filings on the public register, by anyone who cares to look. The framework certifies who owns and runs the host. It does not ask whether that host can be lawfully compelled by the country its parent answers to.
Put the two instruments together and the shape appears. One screens ownership and stops at an allied owner. The other certifies the host and never asks the compulsion question. Between them sits a question that belongs to neither of them. Can the provider be lawfully compelled or switched off by a foreign government, and if it is, what happens to us. For an allied-owned provider, both instruments pass over it. It falls through the seam.
One thing has moved, and it is worth saying plainly. Since 31 August 2026 the Digital Transformation Agency’s principles for its coordinated contracting arrangements direct the agency to consider whether a seller, including any parent company, may be subject to laws, regulatory directions or other arrangements which could create risks that override or circumvent Australian contractual protections. That is the question, asked at last, inside an instrument. Two things bound it. The principles state no method for establishing the answer. And they reach those coordinated arrangements and no other procurement.
You might think this is a problem for the exposed edges of government, the departments handling the most sensitive material. It is worth looking there, because the answer is instructive. Even Defence, wrapped in its own security frameworks far heavier than the ones most agencies rely on, buys cloud services from an Australian company whose declared ultimate holding company is American. The contract notices sit on the public record. If the most security conscious department in the country holds this exposure inside its own walls, then a department running a lighter assurance apparatus holds it too, and holds it with less watching the gate.
And here is where it stops being someone else’s problem. At the exposed edges an assessor is often in the loop. A cloud provider undergoes a formal assessment and someone, at least, is positioned to raise locality and ownership. But a great deal of AI capability now enters government through a different door. A team procures a tool, assesses it against the frameworks itself, and no external assessor ever looks. In that seat the compellability question is not answered badly. The question that does get asked is where the servers are. The Government’s own AI impact assessment tool asks, of a cloud deployment, whether the servers are located in Australia or overseas, and it ties foreign law to data being taken offshore. Its guidance asks an agency to determine if data will be hosted overseas and if it could be subject to foreign laws. Whether a provider can be lawfully compelled while its servers sit in Australia is a different question, and these instruments do not put it.
That seat exists in any department that procures AI this way. It may well be yours.
None of this is a cyber problem, and treating it as one is how it stays hidden. Cyber controls assume a hostile party breaking a rule. This is the opposite. This is a lawful party following a rule, in another country, that reaches a provider you depend on. Nor is it solved by where the data sits. You can require every byte to remain on Australian soil, in an Australian data centre, and feel that sovereignty has been achieved. But look at what you have actually secured.
Picture a safe, bolted to the floor of an Australian building, holding your most important documents. It never leaves the country. By every locality test it is sovereign. Now suppose the company that built the safe holds a master key, and that company can be lawfully ordered by its own government to open the safe and hand over what is inside. The safe has not moved. The documents have not moved. And none of that was ever the question. The question was who holds a key, and who can lawfully make them use it. Location answered a question nobody was really asking.
This is not an argument that American providers should not be used. Many are excellent, and for much government work the exposure is acceptable once it is seen. The argument is narrower and harder to wave off. The exposure should be seen. Wherever these two instruments are the only ones applied, it is not seen, because they were built to ask different questions, and the seat where the risk bites hardest is the seat where nobody was ever asked to look.
The gap can be documented. It can be traced instrument by instrument, provider by provider, parent by parent, against primary sources anyone is free to check and rerun.
So the question for a board is not whether its systems are secure. Its existing frameworks already labour over that. The question is the one those two instruments do not reach for an allied-owned provider. Who can lawfully compel or switch off the capability this organisation depends on. And the harder one underneath it. In your department, has anyone been asked to find out.
Brunel Al-Bijwaie is the Director of AustraliaOS, an independent practice that documents and verifies the foreign legal reachability of cloud and AI providers serving Australian institutions. Its published assessments grade every claim against its primary source at australiaos.com.au.
Found by the author
The author found them by checking the article against its sources after the Digital Transformation Agency published its principles on 31 August 2026.
Sources
Anthropic 2026, Statement on the US government directive to suspend access to Fable 5 and Mythos 5, 12 June 2026, viewed 20 September 2026, https://www.anthropic.com/news/fable-mythos-access. Pinned as A-NEWS-1, SHA-256 14e79eed2f1eca79f4269ae3abfb614618c931666853bc4d1b3b3192792cc581.
Department of Home Affairs 2025, Foreign Ownership, Control or Influence Risk Assessment Guidance (without Appendices), viewed 7 August 2026, https://www.homeaffairs.gov.au/nat-security/files/foci-risk-assessment-guidance-without-appendices.pdf. Pinned as PA-1, SHA-256 d801fb93b302d571e40724f130a7a5e8eff8cc33be9990905b26039230b2ddda.
Digital Transformation Agency 2021, Hosting Certification Framework, March 2021, viewed 11 August 2026, https://www.hostingcertification.gov.au/sites/default/files/2021-11/Hosting%20Certification%20Framework%20-%20March%202021.v2.pdf. Pinned as L-HCF-3, SHA-256 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070.
Digital Transformation Agency 2026, Coordinated contracting arrangements (CCA) principles, viewed 20 September 2026, https://www.digital.gov.au/coordinated-contracting-arrangements-cca-principles. Pinned as D-CCA-1, SHA-256 e987fcb79c8d04dca9e5a8a9e9b725225ad5fa56e52e178bba9c46dfdb94f60e.
Digital Transformation Agency 2026, CCAs vs other procurement and contracting arrangements, viewed 20 September 2026, https://www.digital.gov.au/ccas-vs-other-procurement-and-contracting-arrangements. Pinned as D-CCA-2, SHA-256 1c9817a1dff1d524fc91ba6569a911a4ff9cda6d75046a524c014056fde049de.
Digital Transformation Agency 2026, Insights from our consultation shape new principles for the coordinated contracting arrangement suitability framework, media release, 31 August 2026, viewed 20 September 2026, https://www.dta.gov.au/media-releases/insights-our-consultation-shape-new-principles-coordinated-contracting-arrangement-suitability-framework. Pinned as T-REL-1, SHA-256 6e69fc28d667783b116453fd9986043fbe96a6c94eb105f9b9940adfddb792f8.
Digital Transformation Agency 2025, AI impact assessment tool, last updated 1 December 2025, viewed 11 August 2026, https://www.digital.gov.au/sites/default/files/documents/2025-12/AI%20impact%20assessment%20tool_1.docx. Pinned as A-IAT-T, SHA-256 9589fce3a00993a0bad81b809a9b6bd315df761b43b2199cbd030e54d8376f93.
Digital Transformation Agency 2025, Guidance for the AI impact assessment tool, last updated 1 December 2025, viewed 11 August 2026, https://www.digital.gov.au/sites/default/files/documents/2025-12/Guidance%20for%20the%20AI%20impact%20assessment%20tool_0.pdf. Pinned as A-IAT-G, SHA-256 4f7a322b26e4f42e87d5d3003038d91a5205bdf56c923ac62a9a468d9d0f0908.
AusTender n.d., Contract notice CN4175631, Cloud Services, Department of Defence, viewed 10 September 2026, https://www.tenders.gov.au/Cn/Show/b0d011e8-89fd-4254-a3c6-0f29fbbccd8f. Pinned as L-TSC-20, SHA-256 e2b6ddad7f34182e2b035fc796ad7a381f5eba714a99eb49ef1afa28657682db.
AusTender n.d., Contract notice CN4124201-A2, Cloud and Web Services, Department of Defence, viewed 10 September 2026, https://www.tenders.gov.au/Cn/Show/f4c7bc4a-d851-4325-a5c0-48759fb07b8d. Pinned as L-TSC-22, SHA-256 d54ea827039f6ca10fdcdf0536d7f0e6cf95f73a6e41d13cfee46dea3fb900fd.
Australian Securities and Investments Commission 2026, Current company extract, Amazon Web Services Australia Pty Ltd, ACN 605 345 891, 18 July 2026. Pinned as H-AWS-1, SHA-256 69eda18e3696b3358db70013d20953749b36e81cc8e3611eb87bf2f589ea08a7.
AustraliaOS 2026, AOS-HCF-2026-001, version 1.3, 25 August 2026, australiaos.com.au/verify/AOS-HCF-2026-001. SHA-256 7a545b3316667905c78b52ec6b6c7dbf38eb9627953453c67fd6abd99c513a22.
AustraliaOS 2026, AOS-CMP-2026-001, version 1.4, australiaos.com.au/verify/AOS-CMP-2026-001. SHA-256 d964c1ad31d43a788bd579430bd72483f5662ec895063eda45bc241a8dce4b5d.
AustraliaOS 2026, AOS-AWS-2026-001, version 1.1, 9 September 2026, australiaos.com.au/verify/AOS-AWS-2026-001. SHA-256 31208dba64e1c3b88eba9075a2ff65cb69924a06624493f1bc3f73e110e74c12.
AustraliaOS 2026, AOS-TSC-2026-001, version 1.1, 11 September 2026, australiaos.com.au/verify/AOS-TSC-2026-001. SHA-256 b8957c14e5fb30d517b80b06f7d32db9ca718d95323771a8be289dd225b13ac4.