Legacy modernisation for Australian government, under the cloud policy and the auditors.
The Whole-of-Government Cloud Computing Policy took effect on 1 July 2026. State auditors keep finding unsupported systems. This guide covers how to sequence a modernisation that satisfies the policy, the audit and the Essential Eight, without stopping service delivery.
- Cloud policy in force for Commonwealth agencies from 1 July 2026
- Privacy Act automated-decision transparency from 10 December 2026
- Data stays in Australia, designed in from stage one
- Audit-ready evidence produced by every stage
- Your team trained to own it, no vendor lock-in
What changed in 2026
The Whole-of-Government Cloud Computing Policy requires Commonwealth agencies to adopt cloud for new digital initiatives and to put legacy systems on a decommissioning schedule. That turns an aspiration into a dated obligation with reporting attached.
State auditors were already there. South Australia's Auditor-General found that close to half of the hardware assessed across ten agencies qualified as legacy, and warned of cyber security, privacy and compliance risk. Western Australia's audits have flagged unsupported technology year after year. Councils face the same findings at smaller scale, usually around finance and asset systems.
From 10 December 2026, the Privacy Act requires privacy policies to disclose automated decisions that use personal information. Agencies that cannot trace which systems make those decisions, and on what data, will struggle to write that disclosure honestly.
What makes government different
The method is the same as for any organisation. The constraints are not, and a plan that ignores them is a plan that stalls in procurement or security review.
Data stays in Australia
Australian regions, certified hosting, and residency designed in from the first stage rather than audited in afterwards. Compassify is 100 percent Australian-owned and operated, and your data does not leave the country.
The Essential Eight and classified workloads
Maturity targets apply to the new platform from day one. PROTECTED workloads need assessed cloud services and controls that are evidenced, not asserted.
Retention is not optional
Legacy data cannot simply be deleted at decommissioning. Records obligations mean the migration plan has to include what is retained, where, and how it stays retrievable.
The one person who knows the system
Agencies run critical systems that a single long-serving officer understands. Capturing that knowledge, and training the team on what replaces it, is part of the work, not an afterthought.
How we sequence an agency modernisation
Assess. Every system and data flow is inventoried against the decommissioning schedule, support status and audit findings. The output is a sequenced plan with dates that can go straight into the agency's reporting.
Stabilise and connect. The modern data layer is built in an Australian region beside the legacy systems and connected to them. Nothing is switched off. Residency, access controls and logging are in place before any data moves.
Modernise one workload at a time. Highest value and lowest risk first, usually reporting and finance data. Old and new run side by side, outputs are reconciled, and rollback is always available. Service delivery is never paused.
Enable AI. Automated reporting, document handling and decision support go onto each modernised workload, with the automated-decision transparency the Privacy Act now requires built into the design.
Every stage includes hands-on training so the agency team runs what we build. You own everything delivered, which matters when the next audit asks about vendor dependency. See the four stages in detail.
Audit-ready evidence from day one
Each stage produces the artefacts auditors ask for: a system inventory with support status, a risk register, a decommissioning plan with dates, reconciliation evidence for every cutover, and documented access controls. Agencies that have been through a qualified audit know that the finding is rarely about the technology. It is about the absence of a credible, dated plan. The assessment gives you that plan in two to three weeks.
The questions you're already asking
Does the data leave Australia?
We have a procurement process and panels.
Does this apply to state and local government?
Can you work alongside our managed service provider?
Find out where your agency is exposed, and what a credible, dated plan looks like.
The Legacy-to-AI Readiness Assessment inventories every system against the cloud policy and audit findings, and delivers a sequenced plan with dates. Fixed scope, fixed price, no obligation to continue.
Legacy-to-AI Readiness Assessment
Fixed scope. Everything delivered is yours to keep.
- Duration
- 2 to 3 weeks
- Delivers
-
- System and data risk map
- Deadline exposure: end-of-support and policy dates that touch your systems
- Sequenced modernisation plan
- 2 to 3 AI use cases for the next 90 days
- Executive readout
- Price
- Fixed, quoted up front
- Commitment
- None beyond the assessment