In a new brief, FinOps for AI: From Managing Costs to Maximising Value, Bain & Co says AI is driving a new wave of technology investment that extends far beyond model and token costs, increasing pressure on already stretched tech budgets.

“AI layers a new, highly variable cost base onto technology budgets, often with limited visibility into where the money is going and what value it’s creating.”

It’s forecasting that by 2035, IT costs could increase by 75 percent in organisations that enable AI.  (That figure, however, is drawn from a ‘typical’ US$10 billion consumer packaged goods company.)

And it won’t be courtesy of poor cost controls either, with the consulting firm warning that even organisations which successfully manage tech spending should still expect costs to rise significantly as AI adoption increases, making disciplined investment decisions more important than ever.

“AI promises significant gains in productivity, innovation and growth,” the brief says. “But it also layers a new, highly variable cost base onto technology budgets that are already under pressure, often with limited visibility into where the money is going and what value it’s creating.”

The brief argues that focusing on token costs alone substantially understates the true cost of AI adoption, with AI increasing spend across multiple parts of the tech stack, including infrastructure, software, cybersecurity, data management and new operating models. Large language model workloads in particular are increasing demand for cloud, compute and software licensing.

“Token costs are only one part of the cost equation,” the brief notes, while acknowledging the growing numbers of companies burning through their annual token budgets by the middle of the year – “You’re not alone.”

Greater architectural complexity as AI models and agents are layered into already fragmented technology environments will increase integration efforts, governance requirements and operational dependencies and risk, while faster technology lifecycles will make investments obsolete faster, increasing the cost of keeping pace and cybersecurity investment is also increasing. Data and governance requirements will also increase adding to the investments required, while organisations are also being forced to absorb the costs of reskilling talent, redesigning processes and decision rights and operating legacy and AI-enabled models in parallel during the transition.

Cost, and cost cutter

For tech leaders, that’s creating a dilemma with pressure to deploy AI to improve productivity and drive business outcomes, while simultaneously controlling costs and maintaining governance.

But while Bain & Co describe AI as ‘the largest emerging source of technology cost’, they also say it is ‘the most powerful tool available to control those costs’ – enabling better visibility on spending through automatically classifying invoices, mapping ledger entries and identifying shadow IT; optimising infrastructure and helping rationalise applications; delivering software faster and creating more productive operations.

“Senior executives must deal with both realities at once,” the report notes. “Left unchecked, rising demands for compute, data, software, security and talent will erode margins; deployed deliberately, the same technology can simplify the estate, automate work and reset productivity.”

The challenge, Bain argues, is that many organisations still lack sufficient visibility into how AI spending translates into business value. That’s a view shared by Gartner, with a recent report showing 11 percent of organisations are ‘entirely unaware’ of what their function spent on AI in 2025 – but nonetheless are continuing to pump money into AI.

Bain says to meet the challenge, leading executives are extending FinOps beyond cloud cost management into a discipline for governing AI investment, linking consumption, technology costs and business outcomes in near real time.

Spend smart

The firm argues the goal should not necessarily be reducing tech spend.

“In this environment, the goal isn’t necessarily to reduce technology spending. It’s to direct capital investment toward the AI deployments that will create the greatest business value.”

Not every tech investment deserves protection, the report notes. “Where differentiation is real, protect investment. Where commodity delivery is sufficient, mandate efficiency.”

Technology costs need to be treated as a capital allocation decision, the company says – rather than an operational line item to be managed by IT. “It is one of the largest and most consequential investment decisions many companies make. Boards, CEOs and CFOs should oversee technology costs with the same rigour applied to capital allocation, requiring clear visibility into spending, AI investments, value realisation and emerging risks.”

Transparency across tech spend, including shadow IT, is the starting point, connecting costs to business outcomes. “Without transparency, cost reduction efforts often destroy value rather than create it.”

Bain & Co also recommends designing a ‘self-funding AI investment engine’ reinvesting AI-fuelled savings from the likes of application rationalisation and productivity gains, back into the highest-value AI opportunities.

It’s also urging companies to build a capability, not a program, saying tech cost reduction programs often deliver short-term gains only to see costs rebound within a few years. “Break this pattern by embedding real-time cost visibility tools, agile funding methods and ongoing accountability structures into the operating model. The goal is a permanent capability, not a one-time result.”

Winners ahead

The findings echo Bain’s earlier research into enterprise AI spending. In a separate survey of more than 400 technology leaders, Bain found 69 percent expected AI spending to increase by more than five percent as organisations accelerated adoption. The firm also warned that AI introduces additional complexity through faster technology cycles, more demanding architecture requirements and new operating models.

Taken together, the reports suggest that while AI may ultimately improve efficiency, organisations should not expect lower technology budgets in the near term. Instead, they are likely to face growing demands for investment as AI workloads scale and become operationally embedded.

For business leaders, Bain’s message is straightforward: The issue is no longer whether organisations will spend more on AI, but whether they can clearly identify which investments are generating business value.

“Companies that treat cost optimisation as a source of growth capital can reinvest savings into the AI capabilities that create competitive advantage,” the report says.

As AI spending moves from experimentation to enterprise scale, the winners may not be those spending the most, but those with the clearest understanding of what their AI investments are actually delivering.

The post The AI bill is coming: Why tech costs could soar 75% appeared first on iStart keeping business informed on technology.

The federal-government backed Buy Australia AI Partnership, launched last week by Stone & Chalk with the National AI Centre as principal sponsor, aims to connect Australian AI providers with major enterprise buyers, initially in the financial sector. Financial institutions ANZ, Commonwealth Bank, NAB, Westpac and payments provider Cuscal.

“It gives Australian AI companies direct exposure to enterprise expectations, while helping organisations better understand the capability available locally.”

The program is designed to help local providers build a deeper understanding of how organisations evaluate, procure, govern and deploy AI, in order to hlep them meet enterprise requirements, and connecting them with potential customers.

It’s a program designed to build Australia’s AI economy, or in the words of Lee Hickin, executive director of the National AI Centre, to ensure Australia is ‘the makers, not takers’.

“It gives Australian AI companies direct exposure to enterprise expectations, while helping organisations better understand the capability available locally,” Hickin says.

Organisations including the Australian Banking Association, Customer Owned Banking Association, Insurance Council of Australia, Australian Information Industry Association, Committee for Economic Development of Australia, MYOB and blockchain provider Solana have thrown their weight behind the program.

Andrew Charlton, Minister for Science, Technology and the Digital Economy, says there are already over 1500 Australian AI companies building ‘world-class technology’. “The challenge is getting in front of the organisations that can buy their products,” he says.

In a First Take on the initiative, Gartner says government-backed supplier ecosystems are emerging as one way to develop technology capability. Rather than relying only on regulation, subsidies or public procurement, governments can connect private-sector buyers with local technology providers and improve their ability to compete for enterprise opportunities.

Open-weight for enterprise

That trend is playing out as enterprises themselves reassess how they source and deploy AI.

A new Gartner report highlights growing enterprise interest in open-weight models, with the analyst company saying the performance gap between open-weight and proprietary large language models has narrowed dramatically and is now ‘close to disappearing altogether’. Driving that is the ‘runaway spending on AI and enterprise efforts to contain those costs’.

Unlike proprietary AI services accessed through vendor APIs, open-weight models allow organisations to download, inspect and modify a model’s core numerical parameters. Gartner says they are becoming an increasingly attractive option for IT-forward organisations and their token-hungry applications.

“Beyond potential cost savings, these models provide flexibility, control and independence from API-driven large language model hyperscalers and lock-in to their platforms,” Should You Ban or Embrace Open-Weight AI Models, by Gartner’s Darin Stewart, says.

“Open-source AI and weights offer substantial benefits over their closed, proprietary cousins,” the report says. “Open LLMs can lower switching costs, both financial and technical, reducing the risk of platform and vendor lock-in. Local or private cloud deployment, deeper customisation, resilience from provider dependence, and greater freedom to test, audit and optimise models for specialised work all indicate the unique appeal of open-source AI.”

The shift is also attracting attention in New Zealand.

Earlier this year, Amanda Williamson, director of Deloitte’s New Zealand Artificial Intelligence Institute told iStart Kiwi companies were beginning to recognise the strategic importance of the technology underpinning AI deployments. She highlighted open-weight models as one option for companies to consider.

“Until now, an approach that most organisations have been using is just switching on the model that’s provided in whatever technology stack they have access to, but there are other things that can be done, such as using open weight models,” Williamson said.

Greater control, greater responsibility

For enterprises, however, greater control comes with greater responsibility.

Gartner says organisations adopting open-weight models assume responsibility for ongoing management, including patching, monitoring, access controls, compliance and governance. The report also highlights concerns around data provenance, training bias, data handling practices and the removal of safety controls. “However, most commercial AI and LLM providers involve similar risks, just abstracted away from the customer and absorbed by the vendor,” Stewart notes.

The issue becomes more complex when foreign-developed AI models enter the mix.

Australia is among several countries which have placed formal restrictions on DeepSeek and other Chinese AI offerings. While Gartner says many of the concerns about Chinese technology are ‘overblown’, it acknowledges there are legitimate dangers than need to be taken into account and addressed.

It argues enterprises should evaluate models on their architecture, training data, capabilities and governance characteristics, rather than relying solely on country-of-origin considerations, saying organisations should adopt policies that are ‘nationality-aware, but nationality-neutral’.

For procurement leaders, the message on both fronts is similar: Expanding choice does not remove the need for due diligence.

While the Buy Australian AI program will enable proactive supplier discovery, and earlier visibility of emerging local providers, Gartner warns participation in Australia’s Buy Australian AI program should not be treated as proof of enterprise readiness, while the growing availability of open-weight models should not be viewed as a shortcut to lower-cost AI. In both cases, organisations still need to assess cybersecurity, governance, scalability and commercial risk.

But, it says, expect government-backed supplier development programs to become more common. It’s predicting that by 2028 at least five major technology markets will operate ecosystems linking domestic AI providers with large enterprise buyers.

The post Australian AI vendors get enterprise pathway, while open models rise appeared first on iStart keeping business informed on technology.

While explainability in AI has been a holy grail in recent years with regulators wanting it, governance frameworks demanding it and vendors increasingly highlighting it as a ‘key differentiator’ the research, which involved 228 experienced evaluators reviewing innovation proposals, found AI recommender tools were persuasive enough to convince the evaluators to reject decisions made by an expert human panel, leading them to pass up on promising innovations.

“A convincing explanation is not necessarily evidence that a recommendation is correct.”

Offer a narrative explanation – even for incorrect AI decisions – and the evaluators being tested were found to be even more inclined to defer to the AI decision.

The findings challenge one of the most widely accepted assumptions underpinning enterprise AI adoption: That providing users with greater visibility into an AI system’s reasoning automatically leads to better decisions.

Instead researchers found  that AI recommendations on their own improved decision quality, while adding a narrative explanation increased compliance without improving outcomes. Evaluators became more likely to follow the AI’s advice, but less likely to challenge it when it was wrong.

“We find that black-box recommendations [those provided without explanations] improve decision quality, whereas narrative explanations do not, despite inducing higher compliance.”

The study examined how evaluators responded to AI assistance while screening real submissions to a global social impact challenge run through MIT Solve, comparing human-only evaluation, black-box LLM recommendations and the same LLM recommendations paired with narrative explanations.

What stood out was not that people ignored the AI. In fact, the opposite occurred.

Both recommendation-only and recommendation-plus-explanation groups became more likely to follow AI guidance. But the addition of explanations pushed that deference further. Researchers found narrative explanations created an ‘asymmetric compliance’ effect, with evaluators becoming particularly likely to follow AI recommendations to reject ideas.

That mattered because some of those rejection recommendations were wrong.

The study found narrative explanations led evaluators to disproportionately follow rejection recommendations, ‘substantially increasing false negatives’. In the context of the experiment, false negatives were ideas rejected by evaluators that the independent expert panel believed should have advanced.

For organisations increasingly using AI to support decision-making, that finding may be more important than the research’s innovation-screening setting.

Significance beyond innovation screening

Across Australia and New Zealand, AI tools are moving beyond content generation. They are being used to evaluate funding applications, prioritise projects, screen job candidates, assess risk, review procurement responses and help staff navigate complex decisions. Many of those systems are specifically designed to provide explanations alongside recommendations, with explainability often viewed as a safeguard against blind reliance on AI.

The research suggests those explanations may sometimes have the opposite effect.

According to the paper, narrative explanations can suppress what researchers call ‘productive overrides’ – instances where humans correctly identify a flawed AI recommendation and choose not to follow it. Rather than encouraging greater scrutiny, the explanations may make the recommendation feel more authoritative and complete.

“Mechanism analyses show that narratives suppress productive overrides by substituting persuasive text for independent verification,” the paper states.

In other words, people stop checking.

The researchers argue that this is because large language model explanations function differently from traditional explainability tools. Instead of exposing the underlying logic of a decision, AI-generated narratives are designed to produce coherent and persuasive language. The explanations sound like reasoning, but may not actually represent the processes that produced the recommendation.

The paper notes that these narratives are often optimised for ‘linguistic fluency and persuasiveness’ and can create an ‘illusion of explanatory depth’ where users feel they understand a decision simply because they have been presented with a convincing rationale – the old issue of AI being very confidently wrong.

That has significant implications for current AI governance efforts.

Much of the discussion around responsible AI in recent years has centred on questions of transparency and explainability. Policymakers have pushed for greater visibility into AI decisions, while vendors have responded by adding increasingly sophisticated explanation capabilities to their products.

The study doesn’t argue against explainability and it doesn’t suggest organisations remove explanations from AI systems. Instead, it raises a more uncomfortable possibility: That explanations can increase trust without increasing accuracy.

The researchers conclude that effective human-AI collaboration depends on preserving independent human judgement rather than replacing it with persuasive machine-generated reasoning. As the paper notes, ‘LLM explanations do not necessarily improve decision-making’.

For business leaders rolling out AI across their organisations, the lesson may be straightforward. A convincing explanation is not necessarily evidence that a recommendation is correct. In some cases, it may simply make it harder for employees to disagree.

The post AI explanations may do more harm than good appeared first on iStart keeping business informed on technology.

Watson, Professor of Law at the University of Auckland Business School, says companies such as Amazon, Meta and Google no longer compete within markets. Instead they own essential digital infrastructure, control platforms on which people and businesses depend, and set the rules for operating within them.

“We have the opportunity perhaps to be bold within our own jurisdiction.”

She told iStart some platform operators hold a structural advantage because they both control the infrastructure on which markets operate and compete within those same markets, citing Amazon as an example.

“”They operate as the platform where people sell goods. And also, of course, Amazon itself is one of the players that sells goods on the platform,” Watson says. “That gives Amazon a big advantage because it both holds the infrastructure of the platform and is also one of the enterprises selling on it.”

She compared the situation to New Zealand’s ongoing debate over gentailers, where electricity companies both generate and sell power.

“It’s that same issue around how can you have a platform that’s fair for everyone when you have some players that are structurally advantages.”

Rather than relying solely on conventional competition measures, Watson says policymakers should consider structural remedies.

Changing the corporate

She says corporations are often misunderstood as essentially private businesses, when in fact they are legal entities, created and empowered by states. That misunderstanding has helped obscure the source of big tech’s power and contributed to the failure to rein it in.

“The sort of difference that would really shift what is happening is saying you need to look at the corporations themselves. One obvious way that you could reduce the power of these big platform corporations is that you could disaggregate where they are vertically integrated.”

“If they’re both the virtual infrastructure and a participant in the market, maybe we just say, ‘well, you can’t do that,” she says.

She goes further, suggesting platform operators may eventually need to choose between running the infrastructure and competing on it. “You’re going to be a platform or you’re going to participate on a platform – a corporation can no longer do both.”

But a broader way of thinking is to look at what we give to corporations when we enable people to incorporate them, she says.

Very large corporations such as the platforms ‘can create new types of capital and lay a claim on it in a way that regulators struggle to stop then doing’ she notes. “If you think about technology, they’ve done that with data – no one realised or claimed data because they perhaps didn’t see the value of it. But big tech corporations are essentially turning data into capital by recognising that data allows us to predict people’s behaviour, and that has value.”

She says that’s one example of what could be regulated against. Another option would be once platform corporations reach a certain size they have different requirements placed on them.

The proposal reflects broader arguments in Watson’s paper Reining in Big Tech Corporations: Why Platform Governance Requires Structural Regulation, which contends that platform corporations increasingly control essential digital infrastructure and should not be viewed simply as conventional market participants. She draws comparisons between the East India company and rail and oil companies of the Gilded Age in the late 19th century and today’s big tech. The paper will form part of a Cambridge University Press collection.

While many Gilded Age companies were broken up by antitrust laws, that involves the jurisdiction the company is based in taking action – something that she admits is unlikely to happen with large US-based companies.

Getting ahead of the problem

While critics argue stronger regulation risks stifling innovation, Watson says the challenge is developing targeted responses rather than broad-brush interventions.

“I always think it’s like a scalpel, not a sledgehammer.”

Regulation should focus on specific risks and structural characteristics, rather than applying restrictions across all large corporations.

Locally, she suggests Australia and New Zealand need to get better at predicting proactively, rather than reactively, the impact big tech behaviour might have, in order to consider whether precautionary approaches are needed before harms emerge.

“What always seems to happen with regulation is it happens after the harm has happened,” Watson says, citing the classing example of actions to prevent children using social media.

“We need to proactively think about, for example AI, and how might we predict what’s going to happen and then proactively prevent some sorts of activity within our jurisdictions.”

She acknowledges the answers won’t be easy.

“The only thing we could do is regulate activities of have platform corporations in our own jurisdictions that reach a certain size, or apply pressure on the international corporations as we are now with regulating social media, saying if you don’t do these things, we will in some way control access to our jurisdictions for your corporation.”

The discussion also has implications for New Zealand’s media sector.

Asked about suggestions social media advertising revenue sold into New Zealand could be levied with that funding used to support public-interest journalism, Watson says: “On the face of it, yes.”

The A/NZ opportunity

More broadly, she notes that major technology companies actively lobby against legislation they believe could affect their interests.

“It was interesting when they proposed the social media ban in New Zealand that Meta sent down a very senior official,” she says. “They will work actively to lobby against legislation that they think will harm their interests.”

Watson says New Zealand’s size should not automatically be viewed as a disadvantage. She points to the country’s history of leading on policy issues and argues smaller nations can still shape global debates – a factor that may have prompted Meta’s sending of that official. “Why do they care about little old New Zealand? Well it’s actually more likely that you’ll get that type of legislation in New Zealand than you will in the US or the big jurisdictions,” she says.

“We have the opportunity perhaps to be bold within our own jurisdiction and that might have some influence over other jurisdictions,” she says.

For business leaders, the central message is awareness.

Big Tech platforms deliver enormous benefits and are deeply embedded in modern commerce. But, Watson argues, their growing role as both infrastructure providers and market participants means businesses, policymakers and regulators need to think beyond traditional competition rules.

“If we could see them, they’re enormous forces,” she said.

The question, she argues, is no longer whether platform corporations are powerful. It is whether regulatory frameworks built for traditional corporations are still adequate when a handful of companies increasingly control the infrastructure of the digital economy.

The post Rethinking big tech’s power appeared first on iStart keeping business informed on technology.

That’s the contradiction at the heart of new Gartner research, which predicts AI inference costs per agentic workflow will increase more than fivefold by 2028 as organisations move from simple chatbots to more sophisticated AI agents capable of reasoning, planning and executing multistep tasks. The analyst company calls it the ‘inference paradox’ with improving model economics being overwhelmed by increasingly complex AI workloads.

While model prices might be falling, that’s luring users to build ever more complex workflows – and the greater token consumption of those workflows can outweigh savings from reducing model prices and escalating inference costs.

“The harsh economics of the Inference Paradox are exemplified by the differences between a simple chatbot and an AI agent,” Gartner senior director analyst Will Sommer says. “Where a simple chatbot must read and interpret a query and quickly respond with a probabilistically reasonable answer, an AI agent must constantly reason, negotiate and question itself.”

All of that processing comes at a cost.

Gartner says routing a task to an agentic reasoning model increases inference costs by at least five times compared with a basic chatbot interaction, and often much more as complexity grows. At the same time, organisations are discovering that increasingly capable AI systems consume vastly more tokens than traditional conversational AI.

Gartner argues many organisations are making matters worse by allowing inefficient agent behaviour to creep into systems as they scale.

“There is an enormous pool of waste in any agentic system,” Gartner says in a research note. “Most of the bill in agentic systems is redundancy.”

Among the issues identified in 50% of Token Costs Can Be Cut for AI Agents With Zero Quality Loss are repeated queries, redundant processing, oversized context windows and agent loops that repeatedly consume tokens without adding value. Gartner estimates roughly 31 percent of production queries repeat work organisations have already paid for. Agents consume around 100 input tokens for every output token generated, while 40 percent to 60 percent of agent tool output tokens can often be removed without any loss of quality.

This is where Gartner believes the next AI battleground is emerging as companies move beyond the first phase of experimentation and the second of governance, trust and responsible deployment and into AI engineering efficiency, or building systems that deliver the same outcomes using fewer resources.

That starts with model selection.

“Most tasks do not require frontier intelligence,” the report notes, warning that defaulting every workload to the largest and most capable models is ‘immensely wasteful’. Instead, Gartner recommends routing requests to the cheapest model capable of completing a particular task and escalating only when more sophisticated reasoning is genuinely required.

The report report estimates organisations can reduce costs by up to 60 percent through routing and workload optimisation alone.

Gartner argues that visibility becomes increasingly important as organisations scale AI into production. It recommends tracking metrics including cost per completed task, token consumption by model, spend by customer segment and the relationship between AI expenditure and customer outcomes. Without detailed measurement, organisations often fail to identify expensive models performing basic work or AI features generating little business value.

At the centre of Gartner’s recommendations is a concept that will sound familiar to cloud veterans: AI FinOps.

The company recommends introducing AI gateways, workload routing, caching, attribution and budget controls to actively manage AI consumption rather than simply paying whatever bill arrives at the end of the month. It describes routing, caching and orchestration as critical to preventing costs from spiralling as agent complexity increases.

“Hold agents to high-value tasks and delegate the rest down a tier,” the report says.

“Product leaders cannot rely on more efficient token economics to rationalise AI costs,” Sommer says. “Each successive generation of AI capability will necessitate more, and often more expensive, tokens.” He says there is ‘no reliable, economical one-size-fits-all model on the horizon’ and that organisations will increasingly need to manage complex multimodel environments.

The move by some AI providers to usage-based billing – as previously reported by iStart – has exacerbated issues.

Gartner’s report also identifies opportunities inside the architecture of agentic systems themselves.

Rather than feeding large volumes of information into models, the report recommends retrieval-based approaches that selectively surface only relevant content. Using retrieval-augmented generation (Rag), for example, can reduce token consumption by up to 75 percent while maintaining accuracy. Context compression approaches can reduce token volumes by 60 percent to 95 percent, while redesigning agent loops can remove 40 percent to 60 percent of redundant processing.

The broader message is that AI economics are changing.

For the past two years, the primary question has been whether AI could perform useful work. Gartner suggests the more important question now may be whether organisations can afford to run increasingly sophisticated AI systems at scale – and how to control what that intelligence costs.

The post AI’s new paradox: Cheaper models, bigger bills appeared first on iStart keeping business informed on technology.

At least that’s according to a new customer experience study which found Australian organisations are more than twice as likely as New Zealand organisations to be accelerating or expanding AI deployment in customer experience operations, at 71 percent versus 33 percent. Yet Kiwi organisations report stronger gains in productivity, revenue growth and cost efficiency from their AI-driven customer experience initiatives.

“Organisations have largely won the strategic argument around CX. The next challenge is execution.”

The findings come from the 2026 CX Capability Index, produced by Concentrix in collaboration with AWS and based on a survey of 545 senior decision-makers and customer experience professionals across Australia and New Zealand.

As the report bluntly puts it: “Buying technology isn’t buying capability.”

Of course, it should be noted that Concentrix is a customer experience outsourcer and services provider, and as such only to help to solve the issue of how to operationalise tech. Even so, the survey data it commissioned does support the broader argument that AI deployment alone isn’t creating differentiation.

Across Australia and New Zealand, 89 percent of organisations expect to increase customer experience investment over the next 12 months, up from 78 percent in 2025. Yet overall customer experience maturity has fallen from 70 to 66 over the same period and the proportion of organisations classified as CX Leaders has dropped from 28 percent to 21 percent.

The result is a growing middle ground. Sixty percent of organisations now sit in the CX Follower category, up from 46 percent a year ago, while one in four organisations that previously qualified as CX Leaders have now slipped backwards.

Everybody’s spending, but fewer organisations are pulling ahead.

Australia remains ahead of New Zealand on most customer experience metrics. Australian organisations scored 74 on the overall CX Capability Index, compared with 67 for New Zealand. Australia also reports higher customer experience maturity, stronger current investment levels and a greater proportion of CX Leaders.

But despite New Zealand’s company’s slower acceleration of AI in customer adoptions, those who already have live CX initiatives are outperforming Australia on productivity gains (61 percent vs 54 percent), direct revenue growth (57 percent vs 46 percent) and cost efficiency (44 percent vs 39 percent).

The report’s most interesting finding may be what happens after organisations deploy AI, and Concentrix isn’t alone in noting that adoption is no longer the main challenge.

Recent McKinsey research found many organisations are investing heavily in AI, rolling out tools across the workforce and encouraging widespread experimentation, but still failing to create enterprise-wide value. McKinsey highlights that AI does not create meaningful business outcomes simply because more people use it. Organisations generating the strongest returns are redesigning workflows, operating models and ways of working around the technology, rather than treating AI as another software deployment.

Boston Consulting Group also reached a similar conclusion in earlier AI Radar research which found three-quarters of executives rank AI as a top-three strategic priority but only one-quarter report generating significant value from AI investments. It found the companies achieving the greatest returns focus on a small number of high-value initiatives, scale them quickly and redesign business processes around them.

The same pattern is showing up closer to home: Datacom’s 2025 State of AI Index found 87 percent of Kiwi organisations are now using AI in some form and 88 percent report positive operational impacts. But only 12 percent had successfully scaled AI across their organisation. Nearly half remained in exploratory states despite widespread adoption.

That challenge of operationalising AI and gaining true value is visible in the CX Capability Index. While 63 percent of organisations are accelerating or expanding AI deployment in customer experience, 93 percent report barriers to deploying or scaling it effectively.

Cost leads the list at 45 percent, followed by privacy, compliance and trust concerns at 44 percent. Skills shortages and data quality issues each rate 38 percent.

The report argues the biggest obstacles are organisational, rather than technical with governance, operating models, workforce capability, internal resistance and strategy emerging as larger barriers than the technology itself.

That finding is reinforce by what the report describes as a widening execution gap.

Strategic commitment to customer experience increased 75 to 77 over the past year. Investment intentions strengthened. Yet the gap between strategic importance and maturity more than doubled, increasing from 4.4 points to 10.7 points.

In short, organisations understand the opportunity. Delivering on it is proving harder.

The report also challenges a common assumption about how AI will reshape customer-facing operations. The highest ranked AI use case was not autonomous customer service. Instead, 34 percent of respondents identified real-time support for frontline employees as the area where AI creates the greatest value. Hyper-personalisation ranked second at 20 percent, while autonomous handling of routine customer enquiries ranked lower.

“The strongest use cases are centred on employee enablement rather than customer automation. This suggests organisations currently see AI less as a replacement for frontline teams and more as a tool that enables employees to deliver stronger customer experiences,” the report says.

That ties in with 2025 results which saw a shortage of talent cited as the biggest barrier to improving customer experience. “Organisations appear to be directing AI toward last year’s most pressing constraint – augmenting scarce frontline capability, rather than replacing it.”

While the report issues a warning for New Zealand, saying the country’s slower rate of adoption risks seeing it fall ‘structurally behind, not just cyclically’, there’s also a warning for Australian organisations: Leading New Zealand on AI deployment hasn’t automatically translated into stronger business outcomes from AI-powered customer experience initiatives.

“The findings suggest organisations have largely won the strategic argument around CX. The next challenge is execution,” the report says. “Those that successfully translate strategic commitment into sustained organisational capability by treating CX transformation as an operating model rather than a technology procurement decision will be best positioned to differentiate themselves.”

The post Australia wins AI adoption, NZ wins results appeared first on iStart keeping business informed on technology.

A new discussion paper from the Helen Clark Foundation and New Zealand Rural Land Company argues that information collected from sensors, drones, satellites and connected farm equipment is rapidly becoming a commercial asset, creating tension between farmers who generate the data and tech companies that use it to build products and services.

“Farmers may be sceptical of third-party access to data they have generated. Innovators, meanwhile, are incentivised to build proprietary datasets.

The report, Growing Innovation: The Next Wave of AgriTech for Rural New Zealand, identifies agricultural data as one of five critical themes to ensure that the benefits of agritech revitalise rural communities and deliver maximum economic and sustainability outcomes for New Zealand. It warns a lack of consensus around ownership, access and commercialisation could become a barrier to innovation and adoption.

“Data is the crown jewel of 21st-century commerce,” the report notes, highlighting the value being created as farms become increasingly digitised.

The report, based on interviews with farmers, co-operatives, levy bodies, venture capital firms and public sector leaders, highlights agritech not just as a productivity and efficiency booster, but as an environmental sustainability enhancer. A World Economic Forum study found a 20 percent increase in agritech adoption in the EU could improve farmers’ livelihoods by €1.9–9.3 billion annually, improve soil health by 14 percent and reduce emissions by six percent by 2030.

Today, data is being captured across New Zealand farms through technologies ranging from environmental sensors and livestock monitoring systems to drones and satellite imagery. Agritech companies use that information to develop tools that improve irrigation, fertiliser use, emissions reduction, animal welfare, product quality and farm productivity.

But as the commercial value of that information grows, so too do questions over who should control it and who should profit from it.

The report says farmers and technology providers are becoming increasingly intertwined in the data economy. Farmers generate the information, while agritech companies use it to train algorithms, refine products and create services that can be commercialised across the sector.

The relationship is not always straightforward.

“Farmers may be sceptical of third-party access to data they have generated, concerned about intent and ownership,” the report notes. “Innovators, meanwhile, are incentivised to build proprietary datasets to gain a competitive advantage by locking up data, or to generate new revenue streams by charging a fee for access.”

That can leave farmers unable to access insights derived from collective datasets, despite contributing to the underlying information.

That dynamic can create barriers to agritech adoption, the report notes.

Aiden Gent, ASB general manager rural banking and a contributor interviewed for the discussion paper, says the industry remains divided on fundamental questions around data control.

“There are people competing to own data and commercialising on the fact that they own that data, rather than an open and free market,” he says.

The debate mirrors broader discussions unfolding across industry as organisations wrestle with how AI systems, analytics platforms and software vendors generate value from data supplied by their customers.

According to the report, there is currently no agreement within New Zealand’s agritech ecosystem on who should own agricultural data.

Some stakeholders favour a data sovereignty model, arguing that farmers should directly benefit because they generate the information. Others see data as a commodity that belongs to those who collect, process or commercialise it.

“These perspectives highlight the need for clear frameworks that balance commercial opportunity with fairness and trust and maximise value to the New Zealand food and fibre sector.”

The discussion paper argues that resolving those questions will be critical if the sector is to maximise both innovation and trust.

Nick Rowe, head of customer innovation at Silver Fern Farms, says the challenge is creating mechanisms that reward both parties.

“The challenge is creating a two-way street by connecting supply of high-integrity data generated by landowners, with market demand for verified farm-level data products and enabling an exchange of that data which creates value for both sides.

To address the issue, the report recommends establishing an Open Data Insights and Benchmarking Platform that would aggregate and manage agricultural data on behalf of farmers.

Under the proposal, farmers would be able to benchmark performance metrics such as yields, emissions intensity and water-use efficiency against regional and national averages without exposing sensitive information. Researchers would gain access to aggregated datasets, while agritech companies could use the information to support product development and innovation.

The platform would operate as an independent repository governed by agreed principles around data sovereignty, transparency and de-identification. Rather than individual farmers negotiating separate arrangements with multiple technology providers, the platform would manage licensing and access arrangements on their behalf.

The report also proposes that revenue generated through commercial licensing of aggregated datasets could be returned to participating farmers and reinvested into the platform itself.

The recommendations come as New Zealand’s agritech sector continues to expand. The paper cites MBIE estimates suggesting there are more than 500 agritech companies operating in New Zealand, generating annual revenue estimated at between $2 billion and $3 billion. Technologies spanning automation, AI, biotechnology and precision agriculture are increasingly being deployed across the food and fibre sector.

The report argues that agricultural data will sit at the centre of that growth.

The bigger agritech push

The issue of data ownership is one of five themes identified in the report, which argues New Zealand risks leaving economic value on the table unless it accelerates agritech adoption and addresses barriers to innovation.

It says the sector’s potential is bing held back by financing barriers that favour large operators over family farms, gaps in rural connectivity and services, the fragmented data ownership and a slow regulatory environment.

Among the themes identified is designing homegrown technologies which also target global challenges to capture international markets and creating innovation-enabling conditions with connectivity, risk-sharing, adaptive regulation and targeted incentives to accelerate adoption of new technologies and de-risk investment.

The paper outlines 13 recommendations aimed at strengthening the sector, including modernising agricultural education with digital and AI skills, creating new agritech micro-credentials, establishing a digital extension service to improve technology uptake and improving rural connectivity.

It also proposes a co-funded Agritech Adoption Fund to help farmers share the risk of investing in new technologies and a regulatory sandbox to enable faster testing of emerging innovations.

The report argues that New Zealand’s food and fibre industries are generating increasing amounts of valuable data while facing growing pressure to improve productivity, sustainability, traceability and compliance. In that environment, technologies such as AI, automation, precision agriculture and digital farm management are expected to play a larger role across the sector.

Among its more ambitious proposals are a national “Living Knowledge Bank” to capture farming expertise and an open benchmarking platform that would make agricultural insights more widely available while protecting individual farm data.

The paper’s broader message is that technology alone will not deliver better outcomes. Investment, skills, trust, connectivity and data governance will all be needed if New Zealand wants to convert agritech innovation into productivity gains and export growth.

The post Agritech’s data battleground appeared first on iStart keeping business informed on technology.

AppWrap August 2026

27.08 Australia’s financial regulators APRA and ASIC are urging organisations to move from mere awareness to taking decisive action around frontier AI risks. They says boards and executives must move beyond awareness and ensure their organisations have well-tested response plans and understand where they are vulnerable so they can respond effectively under pressure. The regulators flagged a growing interest in defensive AI, including for threat intelligence, vulnerability detection, code review and incident response along with the importance of getting cyber fundamentals right.

27.08 Woolworths has revealed an AI employee support tool is handling around 7,000 staff enquires a week and resolving nine out of 10 of them without human intervention. ITnews reports the retailer has also used AI to cut weekly catalogue production from a week to a few hours.

27.08 Xero investors have voted against adopting the board’s decision to give CEO Sukhinder Singh Cassidy a 22 percent pay rise – lifting her target remuneration to US$18 million, the majority through long-term equity awards split between performance and service, Forbes Australia reports.  The move comes amid ongoing struggles for Xero’s stock prices, which have been halved in the past year. Under NZ law the board does not require shareholder approval, but put it forward to an advisory vote as ‘a matter of good governance’.

27.08 Meta has agreed to a landmark US$18 billion settlement in a US federal case accusing it of endangering children, with a slew of new safety features now required to its platforms including Instagram and Facebook. Al Jazeera reports those changes range from night curfews to two-hour usage limits for US users under the age of 18. Other countries are also taking regulatory action against Meta and other social media platforms.

25.08 The Australian Energy Market Operator and Oxford Economics Australia are forecasting a seven-fold increase in data centre electricity demand in Australia over the next decade as AI and cloud infrastructure investment accelerates. They say under the central scenario data centre electricity consumption across the NEM is forecast to increase from 5.1TWh in FY26 to 15.5 TWh by FY30 and 33.7 TWh by FY36.

19.08 The ACCC has raided the offices of logistics software company WiseTech Global for documents and electronic data related to the supply of global logistics services and software. The search is part of an investigation into alleged contraventions of the Competition and Consumer Act 2010, WiseTech says, adding that it intends to fully cooperate with the investigation.

19.08 Quest Apartment Hotels says it is investigating a security breach which has compromised customers’ personal data relating to records before June 2025 and including full names, email addresses and contact details. Some data entries also include customers’ date of birth. Quest says unauthorised access to a database system arose from a vulnerability through a third-party service provider, ABCnews reports. The OAIC and Australian Cyber Security Centre have been notified.

18.09 The Origin Energy cyber hack which exposed the personal data of nearly a million Australians has been traced to a former Accenture employee in a Manila call centre, ABCnews reports. Information of around 900,000 current and former customers was accessed in the breach, which was confirmed last month.

11.08 Bendigo and Adelaide Bank has received an $8m fine after admitting numerous cybersecurity failures in relation to a 2023 cyber attack on its former Alliance Bank business. The attack saw a hacker access 257 customer accounts and extract funds. APRA says there were ‘significant weaknesses’ in customer authentication controls for online banking, including password settings that allowed very weak passwords, and system design features that enabled the treat actor to identify valid customer IDs. A number of the weaknesses had been identified in 2020 but not addressed, BusinessNews Australia reports.

12.08 Social media platform X (has won a lawsuit it brought against Australia’s eSafety Commissioner after the Federal Court found the company does not need to follow a new safety standard for harmful online content. InformationAge reports X successfully argued it could not be designated under Australia’s Online Safety Act as both a ‘social media service’ and a ‘relevant electronic service’ (RES). The RES standard therefore ‘does not apply’.

07.08 Australian AI infrastructure company Firmus has raised US$2 billion in equity in its latest funding round as it looks to speed up build-out of AI factories in Australia and Asia Pacific. Reuters reports the raise brings the company’s post-money valuation to more than $10.5b.

AppWrap July 2026

30.07 Total capital raise by Australian cyber startups has bounced back to $171 million in the 2026 financial year following a 2025 lull. Major rounds like a $105 million raise at risk monitoring company Upguard and $30 million at Kasada headlined the rally, AFR says.

30.07 Elon Musk’s X has accused Australia of trying to give eSafety unfair information-gathering powers and undermining US law with its plans for tougher enforcement of the under-16s social media ban, Reuters reports.

30.07 Despite a 115 percent year-on-year surge in local AI spending, only 23 percent of Australian companies have auditing processes to verify AI outputs according to research by ServiceNow. Just 17 percent have a system to manage and track governance and compliance, the vendor says.

29.07 Queensland and the Northern Territory have rejected federal government plans to mandate that AI data centres use renewable power, The Guardian reports. Their refusal comes as S&P Global warns power use from data centres could risk five-fold by 2035 to 10 percent of Australia’s total consumption and lead to energy bills skyrocketing.

20.07 The Australian Computer Society has called for a national framework to address Australia’s cyber skills shortage, following new research showing unclear pathways, inconsistent job definitions and high barriers to entry are holding back the cyber security workforce, CyberDaily reports.

15.07 Environmental and community groups are calling for a pause on data centre developments until new regulations are in place requiring data centres to underwrite new power supply, pay their full share of grid connection and add as much energy to the grid as they take out of it, The Guardian reports.

15.07 The Australian government is creating an Office of AI and introducing standards requiring large AI data centres to underwrite new power generation and limit water use. Reuters reports legislation will be introduced in Parliament early next year. The new office will sit within the Department of Prime Minister and Cabinet.

13.07 Digital customs declaration form will be phased in at all Australian international airports and seaports over the next 18 months following a successful trial with Qantas. The federal government says it will spend $56.1m over four years to modernise airport systems and introduce the digital travel declaration, the Guardian reports.

11.07 Meta has abruptly pulled a controversial AI tool which enabled people to create fake images from user content on Instagram. The feature, part of the Muse Image rollout, quickly sparked blowback due to privacy concerns as anyone with a public account could have their likeness used without their permission or knowledge, the BBC reports.

10.07 The Commonwealth Bank of Australia is planning to cut a further 176 tech and engineering jobs, according to the Financial Sector Union. InformationAge reports the FSU is accusing CBA of ‘fake redundancies’, by advertising similar roles under its Indian arm. CBA has denied the claims.

07.07 A hacker is selling what they claim is live Teletrac Navman telemetry data from almost 3,000 Australian and New Zealand organisations. CyberDaily reports the hacker claims to have exfiltrated continuous real-time GPS tracking data for 2,988 customer companies across A/NZ, over a 48 hour period, with the data including emails and mobile phone details for drivers, driver’s licenses and vehicle registration details.

07.07 Australia’s newly established AI Safety Institute is already examining some of the world’s most powerful AI models, according to assistant technology minister Andrew Charlton. The work forms part of efforts to improve understanding of emerging AI risks and capabilities.

07.07 Most Australian’s don’t want to live near an AI data centre according to a survey from Primara research. CyberDaily reports 83 percent of the 1000 surveyed would oppose having an AI data centre in their local area, with only 16 percent believing nearby communities would receive meaningful benefits from such developments.

07.07 The Queensland Government has announced a new digital investment and assurance process which will review and monitor all new digital and ICT investments over $5m, including projects supported by the $1b Queensland Government Digital Fund. The Minister for Customer Services and Open Data, Steve Minnikin, says more than $300m is being invested in ‘high-impact digital initiatives’ to modernise critical government systems and improve service delivery.

07.07 ANZ Banking Group has outlined a new technology roadmap under CIO Gerard Florian, signalling a strategic shift in how the bank approaches technology modernisation and digital delivery. ITnews reports the move comes six months into Florian’s tenure.

03.07 Microsoft has signed a deal to pay to use news content from Nine in its Copilot AI search results in a first-of-its-kind deal in Australia. The deal, enabling Copilot to reference text of Nine’s content, beyond paywalled previews during AI searches to ‘contextualise and ground’ outputs, covers content from mastheads including The AFR, Sydney Morning Herald, The Age and Brisbane Times, Microsoft says.

02.07 Australia has regained access to Anthropic’s Fable AI, but not to Mythos as the US Department of Commerce reverses its export ban on the models. InformationAge reports Fable has been redeployed for public use, but Mythos has only been restored for a specific set of US organisations.

02.07 University of Sydney academic Olivia Shen has warned Australia shouldn’t try to build its own frontier AI. Writing in The Conversation, Shen, from the US Studies Centre, says the eye-watering cost some countries have invested in training model, hasn’t yet produced AI models with comparable performance to leading US or Chinese offerings, and says Australia needs to make pragmatic investments where we have greater maturity and agency.

AppWrap June 2026

30.06 Bendigo Bank is building what it believes is Australia’s first agentic SOC. The Bank’s CSO says security operations are set to be increasingly supported and underpinned by agentic AI capabilities, with internal security teams focused on more advanced high-value work, ITnews reports.

23.06 The Australian Signals Directorate has joined other Five Eyes partners in warning government and corporate leaders that swift action is required to remain ahead of the increased risk from AI. The agencies are warning leaders to understand and assess risk, readiness and accountability, prioritise foundational cyber security practices and controls, empower cyber leaders with authority and resources and stay actively engaged. Their warning includes practical actions which while not new are now deemed ‘urgent’ by the agencies including reducing attack surfaces, accelerating patching and limiting who can access critical systems.

23.06 More than 4,000 Tasmanians have signed petitions opposing AI data centres, including 3,500 opposing Firmus Technologies planned Bell Bay facility, which will use up to 288 megawatts of power. PulseTasmania reports the facility will be the state’s second largest power user behind the aluminium smelter which draws 335 megawatts and employs more than 550 people. Firmus is also building a $2b data centre near Launceston, with a third flagged for Wesley Vale.

19.06 KPMG has been grilled by a parliamentary committee investigating whistleblower claims around the misuse of confidential client information to bid for new business. ABCnews reports senior KPMG execs fronted for the inquiry which heard about the alleged misuse of confidential information belonging to client Lendlease, its treatment of the whistleblower and a third KPMG confidentially breach involving client Optus.

18.06 The NSW government’s procurement board has issued a sweeping moratorium for all government agencies and departments on any new procurements involving KPMG. The ban comes amid ‘serious concerns’ about KPMG’s work practices. The company is embroiled in a series of allegations about misuse of confidential client information to bid for new business. An approval and reporting process for KPMG engagements has also been established in NSW.

18.06 The federal Department of Parliamentary Services has failed key cybersecurity benchmarks with protections still only ‘partly effective’ seven years after the network was breached and seven out of eight key cybersecurity controls falling short, InformationAge reports.

18.06 PsiQuantum has broken ground and started construction of its billion-dollar supercomputer facility in Melbourne. The company says it will build and deploy the world’s first utility-scale, fault-tolerant quantum computer at the Moreton Bay Central facility. It has received nearly $1b in federal and Queensland funding for the supercomputer.

17.06 The NSW Government has denied claims by ransomware group Nova that it has been breached, saying sample files provided are publicly available and historical information. CyberDaily reports Nova listed the state government as a victim on its darknet leak site, claiming to have exfiltrated sensitive data from the network.

17.06 A new Microsoft Teams feature enabling Teams to detect activity on a user’s device even when they are not actively using Teams has raised privacy concerns. Auckland University lecturer Alex Baird warns companies that the Privacy Act is clear on being thoughtful about why data is collected and using it only for that purpose. If used for checking teammates know where you are, that’s great he told RNZ. Collecting data for performance tracking however would be ‘a very different thing’.

16.06 Anthropic has disabled its new Claude Fable 5 and Mythos 5 models after a US Export Control order. Forbes reports the US Commerce Department mandated the suspension of access for all foreign nationals citing security and export control powers. The move followed reports of a jailbreak bypassing safety guardrails.

12.06 SpaceX has made the biggest stock market debut in history, making Elon Musk the world’s first trillionaire. Early trading saw share prices jump from the opening $150 a share by a double digit percentage, sending the company’s valuation above US$2tn, the Guardian reports.

11.07 Woolworths is moving IT jobs offshore to ‘remove complexity and drive efficiency’. Hundreds of jobs across the people, IT and finance teams are expected to be affected, ABCnews reports.

10.07 Tasmania’s Aurora Energy has kicked off an ERP modernisation program, replacing legacy systems with Microsoft Dynamics 365 finance, supply chain management and project operations, ITnews reports.

09.07 Anthropic has released a new version of its Claude Mythos AI model to the general public, but is restricting its use in sensitive areas. The Guardian reports Fable 5 is the first model to be made widely available from the company’s new Mythos class, unveiled in April but restricted to a small set of users over cybersecurity concerns. Anthropic says Fable 5 will be useful for writing and debugging software code, answering complex research questions and analysing images.

09.07 Perth Airport is deploying more than 70 IT and OT systems for its new terminal development. DXC, which has been selected as the master systems integrator for the program, says it includes a broad range of tech solutions including AI, cloud and cybersecurity across the new terminal for passenger processing systems, baggage tracking and reconciliation, advanced security screening integration, building management and automation, digital signage and wayfinding, public wifi and operational control systems.

04.06 Meta has accused Australia of violating a free trade agreement with the US by proposing a new 2.25% tax on tech giants who don’t have licensing deals with local media. The company claims the tax is broader than existing digital services taxes which have prompted US trade actions. Reuters reports a spokesperson for the Assistant Treasurer says the government remains committed to the change.

04.06 Australia ranks equal lowest out of 23 countries when it comes to AI sentiment according to an EY survey, which found while 51 percent of Australians like the idea of using AI to simplify life and support choices, 68 percent are worried about losing control over decisions made by AI on their behalf. ABCnews reports just one percent of Australians say they have complete trust that AI will be used responsibly.

03.06 The Department of Defence is using the Maven smart system from controversial company Palantir but says it is in a sandboxed environment and without AI functionality, ITnews reports. Defence has two active contracts with Palantir, including a $10.4m deal signed in February. It says it is using Maven to aggregate data ‘to inform targeting solutions’.

02.06 Florida has become the first US state to sue OpenAI, over the design and safety of its ChatGPT chatbot. The state is suing both OpenAI and CEO Sam Altman, alleging they know ChatGPT is not safe, especially for minors, CNN reports.

AppWrap May 2026

27.05 Today’s students may have grown up with tech, but they’ve just recorded their worst-ever results in national digital literacy tests, ABCnews reports. Just 37 percent of year 10 students and 50 percent of year 6 students were accessed as proficient – the lowest level for year 10s since testing began in 2005.

27.05 The Federal Court of Australia has called in CyberCX to test data and security controls of the platform used by VIQ Solutions court transcription service. The work follows February’s revelation that some transcription work had been subcontracted to an Indian company, in breach of contracts, and confirmation that there had been data privacy incidents in the performance of the services, ITnews reports.

22.05 Australian quantum computing startup Diraq has signed a $53m grant agreement with the US government to establish a supply chain in the US. Forbes Australia reports much or all of the grant funding will turn into equity making the US government an investor. Diraq is also eyeing up a US Defence deal worth up to $420m.

15.05 The Federal Budget 2026 is a mixed bag for tech companies with the end of capital gains tax discounts expected to have a major impact on founders of tech companies, while an R&D tax incentive and loss refundability changes could be a powerful funding strategy for startups, accounting and advisory services company WilliamBuck says. It also applauded the expansion of VC tax incentives.

13.05 New tax breaks for innovative companies, tax deductions for workers, more funding for CSIRO, an overhaul of the migration points test and changes to capital gains taxes all feature in this year’s Federal Budget. Up to $70m in AI Accelerator grants, tens of millions of dollars to expand AI use in government departments, $654m+ over four years, and $166m/year after that, to expand the Digital ID system and $357m for the ATO’s myID mobile app were among the funding allocated InformationAge reports. The CDR will also see expansion with an additional $62m allocated over two years, while cybersecurity, defence and space also saw boosts.

13.05 The parent company of the Canvas educational tool involved in a major global hack last week has struck a deal with the hackers to secure stolen student and school data, Reuters reports. All data was returned to the company, it says, and digital confirmation of data destruction along with a promise no Instructure customers will be extorted were received Instructure says.

12.05 Xero CEO Sukhinder Singh Cassidy has apologised to customers after the accounting platform was hit with five days of outages. Xero says it has contacted the ATO about deadlines which will be affected by the outages with the ATO ‘understanding’ of the situation, SmartCompany reports.

07.05 Legal practice management platform Smokeball has taken top spot as the best medium to large tech workplace in Australia’s Best Workplaces in Technology, followed by consulting and engineering company Mantel Group and cybersecurity company Crowdstrike. In the small category Macquarie Cloud Services took top for the second consecutive year followed by data and AI consultancy V2 AI and software company Corto, while in the micro category AI Technologies was followed by Adora and Causeis, Great Place to Work says.

07.05 Australia’s largest tech startup community, Fishburners, is in voluntary liquidation, with KPMG appointed administrator. InformationAge reports KPMG is facilitating a strategic restructuring of the organisation, and will be seeking expressions of interest from parties in the innovation and tech sectors. Fishburners will continue to trade as usual while the assessment is underway.

06.05 Australian education institutions are among those caught in a worldwide cyber security attack after they Canvas learning management system, developed by US company Instructure, was subjected to a hack. ABC News reports state schools in Queensland and Tasmania, universities in NSW and South Australia and TAFE in Tasmania are affected. Instructure says it doesn’t believe birthdates, passwords, government identifiers or financial information have been impacted. Names, locations of study, email addresses and messages between users are however believed to have been compromised.

04.05 NAB has changed its capitalised software policy, reducing the value and useful life of capitalised software assets thanks in part to AI enabling software to be built or replicated quickly and cheaply. ITnews reports the bank took a $1.3b hit to its underlying profit and $949m to its cash earnings for H1 FY2026 owing to the change.

AppWrap April 2026

28.04 Minister for Employment and Workplace Relations Amanda Rishworth says her department is currently undertaking gap analysis to identify how current frameworks and institutions are interacting with the adoption of AI. Speaking at the AFR Workforce Summit, Rishworth noted the tripartite AI Employment and Workplaces Forum, which meets for the first time this week, bringing together government, employers and unions to ‘build a common understanding’ and translate themes of trust, capability, transparency, safety and productivity into actions and outcomes in workplaces.

27.04 NAB is building an AI science team to guide how AI tools are deployed across the business and the workforce’s transition. TheAussieCorporate says the team will shape which tasks are automated and which new roles are created to support them. The work includes designing systems to safely handle customer data, helping make staff decisions and streamlining back office processes.

23.04 The Australian government has signed a MoU with Microsoft which is promising to continue investment in local AI capability and cloud computing and align with the governments Expectations for Data Centres and AI Infrastructure Developers. The Department of Industry, Science and Resources says the MoU – the second under the National AI Plan – also outlines Microsoft’s intention to collaborate with government on AI safety and workforce capability, support delivery of the APS AI plan and help the government understand future infrastructure needs.

22.04 The OAIC has found that InspectRealEstate’s rent-tech platform, 2Apply, collected excessive information and did so by unfair means. The OAIC says the platform has agreed to adapt its personal information collection practices on a without-admissions basis. The decision requires IRE to cease collecting personal information just as prospective renters’ gender, student status, citizen status and visa expiry and details of previous living history.

21.04 Identity verification company Persona has announced an integration with ConnectID, the Australian digital identity exchange created by Australian Payments Plus. BiometricUpdate says the integration keeps data private, providing age verification that relies on data a financial institution has already collected from a user.

22.04 The eSafety commissioner has given legally enforceable transparency notices to Roblox, Minecraft, Fortnite and Stream amid concerns online games are being used to spread violent propaganda and radicalise young people and by sexual predators to groom children. eSafety says the notices require the providers to explain how they are identifying, preventing and responding to these harms, along with bullying and online hate.

21.04 A NSW Treasury staff member has been charged after allegedly downloading more than 5,600 government documents containing ‘confidential commercial and financial information’. NSW Government says the information covers multiple departments and projects. Police believe all the data has been located and is now secure, with no external compromise to the Treasury’s system.

16.04 Apple has granted Australian law enforcement access to user notification data for the first time. InformationAge reports a transparency report shows four push token identifiers were sought across two of the requests, with one push token request granted.

16.04 South32 Aluminium is suing Siemens alleging missing code in a programmable logic controller led to a steam turbine generator overheating and being ‘effectively destroyed’, ITnews reports.

15.04 Travel giant Booking.com has notified an unknown number of customers about a data breach which has seen hackers steal customer data. BBC reports some customers have contacted it saying they have already started receiving suspicious messages. Booking.com has declined to say how many people are affected or in what regions.

09.04 Canva has acquired Australian AI tool Simtheory and Australian marketing automation company Ortto for undisclosed sums. Canva says the deals will take it from a design tool to an ‘end-to-end’ work system and strengthen its AI capabilities, 9news reports.

09.04 Bendigo and Adelaide Bank will cut its tech and business operations teams after signing two major tech deals with Infosys and Genpact outsourcing some tech and business management capability. The cuts will save the business at least $65 million yoy, by the 2028 financial year AFR reports. It adds hundreds of roles are likely to be affected.

03.04 Artemis II astronauts experienced Microsoft Outlook failures shortly after launch, with Mission Control called in to remotely troubleshoot the issue. Commander Reid Wiseman reported that two instances of Outlook were running simultaneously on his Surface Pro, leaving both unresponsive, Mashable reports.

02.04 The ATO has launched an in-app security feature enabling users to confirm, in real-time, that they are speaking with the real ATO not a fraudster. Almost 7,500 ATO impersonation scams were reported in July 2025 alone, with impersonation scams peaking during tax time, the ATO says.

01.04 SpaceX has filed confidentially for an IPO according to reports, which say the company is committed to debuting in June, with Elon Musk aiming to raise US$50b-$75b. The NYTimes reports SpaceX values itself at more than $1 trillion and would be one of the most valuable companies to reach the stock market.

01.04 Oracle is cutting thousands of jobs from its 162,000-strong workforce, with 10,000 believed to have lost their job so far. Senior engineers, architects, operations leaders, program managers and technical specialists are among those affected, the BBC reports. Around 10,000 people are believed to have lost their jobs so far. It is unknown if the cuts are related to Oracle’s heavy AI spend.

01.04 The Federal government has signed a new MoU with Anthropic to build on the national AI plan launched in late 2025.

AppWrap March 2026

31.03 eSafety has flagged Facebook, Instagram, Snapchat, TikTok and YouTube for compliance issues with the Australian Social Media Minimum Age obligation and is gathering evidence to inform potential enforcement action, it says.

26.03 Meta and Google have lost a landmark US case, with a Los Angeles jury finding the two companies negligent for designing social media platforms that are harmful to young people. Reuters reports the jury found Meta liable for damages of US$4.2 million, with Google liable for $1.8m in the case of a US woman who sued Meta and YouTube over her childhood addiction to social media.

25.03 Delaying public disclosure of serious cyberattacks on critical infrastructure operators ‘to prevent disclosure from compromising national security’ is one of five changes proposed in a Department of Home Affairs consultation paper for amended Security of Critical Infrastructure (Soci) rules. Other reforms in the paper include changes to make it easier for the government to restrict multiple entities from using high-risk vendors or technology and clarity around the threshold for issuing a direction.

25.03 Canva has acquired Melbourne-based digital out of home advertising company Doohly in a $30m deal which adds outdoor advertising to its offering. The deal is the design company’s third acquisition this year and comes just a month after it bought US startup Mango.AI and the UK’s Cavalry notes StartupDaily.

24.03 Silicon Quantum Computing has secured $20m from the National Reconstruction Fund to support scaling of its quantum processing units and Watermelon machine learning system, SmartCompany reports.

19.03 The X Money payments service, Elon Musk’s attempt to build a ‘everything app’ will enter early public access in April. Musk’s ambitions for the embedding payments into X are broader than most Western tech companies, notes PaymentsIndustryIntelligence, with Musk talking about a system that could eventually encompass savings, payments, securities and other financial activity, reducing reliance on traditional banking channels. At launch X Money is expected to offer core wallet and payment functions, including the ability to move funds within the platform.

18.03 An attempt by the CEO of US videogame publisher Unknown Worlds to wriggle out of paying a US$250m performance has suffered a setback after the court documents showed Changhan Kim asked ChatGPT how to avoid paying the bonus. InformationAge reports Kim engaged the chatbot to draft a corporate takeover strategy, which involved stymieing the release of the highly anticipated Subnautica 2. Following ‘guidance’ from ChatGPT he also posted public ‘critical messages’ on the company website.

17.03 Google has reportedly paused plans for a $20b AI and data centre hub, warning the federal government that high taxes could cause the country to miss out on investment. DatacentreDynamics reports the company has told government it is concerned that if it set up such a hub in Australia, the ATO would consider it a ‘permanent establishment’ exposing it to a 30 percent corporate tax rate. Google is currently exploring where to establish the major APAC hub.

16.03 AI disruption is causing Australian software companies to make big job cuts, with private tech companies expected to follow in the footsteps of Atlassian and WiseTech with redundancy rounds, valuation cuts and a bottleneck for public listings, AFR reports.

12.03 Atlassian is cutting around 1,600 jobs – or 10 percent of its workforce. The company says the move is to ‘self-fund further investment in AI and enterprise sales’, while strengthening its financial profile, Forbes reports. The retrenchment will cost between $225m-$236m.

11.03 Professional body CA ANZ says it will investigate the failure of an external exam delivery platform after more than 1,300 students were locked out of one exam and another 60 experienced delays of up to 40 minutes on a second exam. CA ANZ blamed a failure in an external exam platform operated by a third-party provider.

11.03 US medtech giant Stryker has been hit by a major cyberattack, with an Iran-linked hacking group claiming responsibility, saying it is in retaliation for the killing of more than 170 people – mainly schoolgirls – in a strike on a school, and warning it marks the beginning of a new chapter in cyber warfare, Al Jazeera reports. The group says it has seized 50TB of Stryker data in the attack which it says has erased data from 200,000 devices.

10.03 Anthropic is opening a Sydney office and hiring a local team. The company says Australia ranks fourth globally in Claude.ai usage, relative to population, with strong demand from local business. It says it plans to deepen engagement with Australian institutions and collaborate on projects that advance the country’s national interests and priority sectors. It is also exploring opportunities to expand compute capacity in Australia ‘given our longstanding belief that democracies should lead in AI development’. The company is currently suing the US government over its claims that Anthropic is a ‘supply chain risk’. The row erupted after Anthropic refused to all US military to have unfettered use to its AI tools.

05.03 Privacy Commissioner Carly Kind is warning Australian organisations that a recent ruling allowing Bunnings to use facial recognition is not a green light for the technology. Kind, who says she has not filed an appeal of the Administrative Review Tribunal finding, which overturned her ruling against the technology, says the decision shows the law allows for the balancing of competing interests – privacy vs public safety – but entities will need to conduct a detailed risk assessment specific to their circumstances before deploying the technology. “Retailers should view the decision as a useful case study, rather than a green light for deployment of biometric technologies,” she says.

AppWrap February 2026

27.02 Commonwealth Bank has called in the police and corporate regulator over concerns $1b in home loans were obtained fraudulently, including with AI-created documents. AFR reports the bank reported itself to police and the regulator after a review of the compliance practices and customer lending documents, which stepped up following revelations about the Penthouse Syndicate, which allegedly defrauded NAB of around $150m. Increasingly sophisticated AI has made it easier to create authentic looking false documents and to steal identities.

26.02 Nvidia has posted blockbuster quarterly results of US$68.1 billion – up 73 percent year on year and well above analysts’ forecasts. Revenue from the data centre division, which sells the chips used to train and run AI models was up 75 percent yoy to $62.3 billion, the company says.

25.02 Australian logistics software company WiseTech is cutting around 2,000 jobs – nearly a third of its global workforce in a restructure focused on using genAI to increase efficiency in software engineering and support, Reuters reports.

25.02 Australian Peter Williams has been jailed for seven years for selling critical software and information related to cybersecurity to a broker with ties to the Russian government. Williams was working in the US. 9News reports the tools were cyber-exploit components which can be used to identify weaknesses in tech systems or infect them with viruses.

24.02 The federal government has scrapped a permanent AI advisory board appointed to develop AI guardrails. ABCnews reports the body, funded in the 2024 Budget, was scrapped only months after spending $188,000 and more than a year whittling down a list of experts to a shortlist of 12 nominees. The government says it will instead establish an AI safety institute early this year.

25.02 Commonwealth Bank is spending $90 million to get staff ‘AI-ready’. The bank says the program will help employees ‘build skills, find new opportunities and get ahead of the changing nature of work’. AI learning has already been delivered to 30,000+ staff.

24.02 The ASD has publicly released its Azul open-source malware analysis tool to help safely handle and analyse malware. Azul is designed for large-scale malware analysis and is designed to be highly scalable and store tens of millions of samples, ASD says, adding it can turn common analysis steps into analysis plugins which can be used as part of an automated workflow and assist in identifying variants of a malware family more efficiently.

18.02 Xero is restructuring with 250 jobs on the line – including in Australia. The company is creating around 280 roles in Canada as part of the restructure, BusinessDesk reports [paywalled].

18.02 YouTube suffered an outage from around 11.50am AEDT, with a spokesperson for Google saying an issue with the recommendations system prevented videos appearing.

18.02 The federal opposition has unveiled a new-look shadow ministry under Angus Taylor, with Victorian senator Sarah Henderson appointed shadow communications and digital safety minister. ABCnews reports Casey MP Aaron Violi has been promoted to the outer shadow ministry with a broad portfolio including science, technology, cyber security and the digital economy. Deputy Liberal Leader Jane Hume will be shadow minister for employment and industrial relations as well as productivity and deregulation.

18.02 Australian company Terram Astra has set its sights on a US$10m seed capital raise for a new sovereign ground-based infrastructure platform designed to strengthen communications resilience, defence readiness and space safety across the region. Manufacturers’ Monthly reports Terram Astra’s first hub is located near Alice Springs.

17.02 Highly sensitive Australian court files have been accessed by a foreign entity based in India, an ABCnews investigation has revealed, with Greens senator David Shoebridge saying access to the cases by foreign entities is ‘a national security risk’. The investigation showed Canada’s VIQ Solutions, which employs transcribers in Australia, has also subcontracted work to an Indian company specialising in automated voice-to-text technology, in breach of the VIQ contract. Thousands of court files were accessed by e24 staff with Indian email addresses.

16.02 Federal government entities are failing to report cyber incidents to the Australian Signals Directorate. InformationAge reports just 35 percent of the 200 government entities said they reported at least half of all cybersecurity incidents observed on their networks.

11.02 Service NSW has started testing a new system enabling residents to verify who they are in a single step when interacting with state government services online. ITnews reports initially the digital ID system will be used with a limited number of services, starting with a state toll rebate scheme.

06.02 Australian-founded AI data centre startup Firmus Technologies has secured another $100m to expand its local data centres. The funding, from ASX-listed Maas Group means the company, which is Singapore-based, has raised more than $900m in less than five months, StartupDaily reports.

06.02 CommBank says it has become the first bank to disclose how it is ideating, developing, deploying and managing AI at an organisational level, including ‘practical examples’ of AI in action across the business. Those examples include AI to protect against fraud and scams, strengthen cyber security, enhance customer experience and detect abuse in transaction descriptions.

05.02 Atlassian’s revenue for the quarter to December 31 was up 23 percent to US$1.58 billion, with cloud revenue growing 26 percent providing the company with its first $1b cloud revenue quarter. However, net loss also grew from $38.2m to $42.6m. Operating loss was down from $57.5m to $47.7m the company says. CEO Mike Cannon-Brookes dubbed the quarter ‘fantastic’, adding: “We’re building a bloody great business.”

03.02 The federal government has rejected a bipartisan proposal which would have allowed a parliamentary committee to cancel large consultancy contracts, saying its own reforms are doing the job. A centralised register for conflicts of interest breaches has also been ruled out.

03.02 Australia’s STEM capability is facing a ‘severe crisis’ as a result of flatlining Commonwealth funded research, Science and Technology Australia says. In a pre-budget submission it says Stem research must stop being viewed as a cost and instead be seen as an investment. It says 47 percent of Stem professionals are considering leaving their current roles, with 33 percent planning to leave the sector altogether.

03.02 Xero says more than two million subscribers are using its full AI features, with more than 300,000 using its newer GenAI features. In a market update today the company claimed customers are saving around 22 hours a month using bank feeds and automated actions, with more than 12 percent using AI Insights.

03.02 Kiwi AI startup Teacher’s Buddy has raised $2.3m in trans-Tasman seed funding. The offering aims to reduce teacher workloads, helping with marking and student report writing and producing customised, differentiated curriculum-aligned teaching and assessment materials  The company says the funding was led by Auckland’s Soul Capital and Australia’s Giant Leap.

02.02 Victoria has set its sights on being Australia’s AI capital with the launch of an AI Mission Statement setting out the Allan government’s plans across six key pillars of investment attraction and adoption, data centres and digital infrastructure, local innovation, products and services, talent and workforce, ethical AI use and public sector adoption. The plan includes a $8.1 million Digital Jobs – AI Career Conversion program to safeguard jobs in industries at risk from AI, upskilling workers to transition into AI roles and become specialists in the technology.

AppWrap January 2026

27.01 Airwallex boss Jack Zhang says the fintech is at least two years away from a public listing, despite regular references to an IPO in 2026. Zhang’s comments, reported in StartupDaily, follow news last week that Austrac has ordered an audit of the company over AML/CTF concerns.

26.01 The APS plans a whole-of-government learning technology ecosystem following a co-design involving teams from 37 Commonwealth agencies. ITnews reports a core goal of the new system is to enable interoperability and integration across learning and development environments.

23.01 TikTok has finalised agreements with backers including Oracle, Silver Lake and Emirati company MGX to establish a US joint venture. Each of the three backers will hold a 15 percent stake in the company. ByteDance keeps a 19.9 percent share. The BBC reports the content recommendation algorithm has been licensed to Oracle – headed by Trump ally Larry Ellison – which already oversees US user data under a previous arrangement set up over security concerns. The deal will enable TikTok to continue operating in the US, but is likely to continue to be scrutinised, with some Democrats voicing concerns about the ties between Trump and TikTok’s new investor group could limit what gets shared on the platform.

22.01 Australia’s financial intelligence unit, Austrac has ordered an external auditor be appointed to assess whether fintech – and unicorn – Airwallex is complying with anti-money laundering and counter terrorism financing. Austrac says it has ‘concerns’ about potential non-compliance including that Airwallex’s transaction monitoring program has not been ‘attuned to the full range of risks it faces’ and the company hasn’t demonstrated an acceptable understanding of who its customers are and what reporting may be required. The auditor must report findings within 180 days of appointment.

20.91 AI projects to improve construction safety, enhance space safety and detect speech delays, are among the 174 projects winning funding in the latest round of Australia’s Economic Accelerator (AEA) Ignite program. More than $72.5m in funding was allocated. The funding is for projects that build capability I nationally important sectors aligned with the National Reconstruction Fund’s priority areas, AEA says.

20.01 Gilmour Space has become Australia’s first space tech unicorn after raising $217m in a Series E funding round – its largest funding round to date. SpaceNews reports the round was led by the federal government’s National Reconstruction Fund and retirement savings fund Hostplus along with several other investors.

20.01 A bill cracking down on hate speech has passed the House of Representatives and Senate at a special sitting late on Tuesday, a month after 15 were killed at Bondi Beach. It includes provision to ban groups deemed to spread hate, the BBC reports. The hate speech reforms were originally part of an omnibus bill along with gun reforms, but the two were split last week. The gun reform bill, which includes a buyback scheme, was also passed.

16.01 Social media companies removed access to around 4.7 million accounts for those under 16 in the first half of December, eSafety says.

16.01 Alphabet’s Waymo robotaxi business has held discussions with Chinese car maker Geely, and other electric car makers, as it looks to enter the Sydney market. AFR reports. Waymo is stepping up its efforts in Australia, with the appointment of a lobbyist and a search for an office now underway. It has yet to lodge an application to begin testing in the city.

13.01 Advertising is hitting the AI chatbots with ads starting to show up in Google’s ‘AI Mode’ in what the Washington Post says is likely to be just the beginning of more trial-and-error attempts this year. Google has been pushing a new type of ad in AI Mode to advertisers, OpenAI has also been looking at introducing advertising in ChatGPT and Perplexity attempted ads but pulled back last year – but has left the doors open to try again.

08.01 The DTA has warned against outright bans of IT suppliers and services companies for unethical behaviour warning such bans could introduce significant operational risks and unintended consequences. ITnews reports parliament is considering an exclusion regime preventing those engaging in unethical conduct from bidding for government work, in the wake of the PwC scandal. The DTA, however, says blanket bans could block access to tech advances or skilled resources.

The post Appwrap: Regulators call for ‘decisive action’ around frontier AI risks, Data centre power increases and Woolies AI appeared first on iStart keeping business informed on technology.

As the cinema chain builds a broader data platform and prepares to move its core operational systems to the cloud, it is focusing less on creating more reports and more on turning information into action. That approach is already shaping everything from movie scheduling and demand forecasting to staffing and customer experience initiatives.

“If we can’t articulate the value we’re trying to create, adding AI doesn’t make the idea better.

A decade ago, the company wasn’t the market leader in customer experience, digital experience or marketshare, says Wrightson, Group IT director for Hoyts’ Cinema Technology Group. Then it made the decision to change that, investing first in reinventing the physical cinema experience with reclining seats and premium formats before applying the same kind of thinking to digital channels.

“More than five years ago we identified digital as an important battleground not only for growth, but for customer experience and our ability to differentiate Hoyts from our competitors,” Wrightson told iStart.

“If we wanted to deliver the best cinema experience in the market, that experience couldn’t begin when someone walked through our doors. It had to begin from their first interaction with Hoyts.”

The company rebuilt its website around streamlined customer journeys and developed its first native app, replacing an earlier white-labelled offering from long-standing technology partner Vista Group. Those investments helped establish digital as an increasingly important channel, but they also changed how the business thinks about technology.

Today, Wrightson says, Hoyts has reached a point where the challenge is no longer catching competitors, but staying ahead of them.

“Five years ago, our challenge was closing the gap. Today, our challenge is continuing to put daylight between Hoyts and our competitors.”

That pursuit is increasingly being driven by data.

In parallel with a migration of its Vista cinema management platform to Vista Cloud, Hoyts is developing a broader data strategy that will bring information together from multiple systems across the business. The goal isn’t to create another layer of reporting.

“The objective isn’t simply to create more reports or dashboards,” Wrightson says. “There’s a big difference between data that’s interesting and data that’s actionable. We want to put meaningful information into the hands of our people at the point where it can influence a decision, trigger an action or ultimately improve a business outcome.”

It’s a philosophy that will resonate with many organisations grappling with analytics initiatives that generate endless charts but few measurable outcomes.

Wrightson says businesses – including Hoyts – can easily create hundreds of reports and dashboards, but the real test is whether the information changes behaviour.

“If it doesn’t inform an action that enables you to do something that is going to allow you to, for example, be more efficient or generate more revenue, then effectively data can be interesting, but it can be a distraction.”

For Hoyts, actionable data has very real operational consequences.

Cinema is, in many respects, a business built on perishable inventory. Once a movie starts, any empty seats can never be sold. That makes forecasting, programming and operational decisions critical.

“If you go back 20 years, the programming used to be set for the week,” Wrightson notes.

Today the company has the ability to review performance data and alter programming based on how films are performing.

“We have the ability now through actionable insights to potentially change some of that programming on a daily basis if we choose to, because we might say one film’s not performing or that might perform better at a different time of day.”

The same thinking extends across staffing, food and beverage operations, pricing, auditorium allocation and demand forecasting. The objective is not to report on what happened last week, but to influence what happens tomorrow or even later today.

Underlying much of this is Vista, which Wrightson describes as effectively the company’s cinema ERP platform. The system support everything from movie scheduling and pricing to ticketing, concessions and point-of-sale operations. After nearly 20 years of use, Hoyts is now migrating that foundation to Vista Cloud under a six-year agreement with Vista Group.

But Wrightson is adamant the project shouldn’t be viewed as simply a traditional cloud migration.

“The measure of success isn’t that whether we’ve moved 60-plus cinemas into the cloud or switched off a collection of servers. It’s what Hoyts can do differently once we’re there.”

Part of that rationale comes down to customer behaviour.

Today, three out of every four Hoyts tickets are sold through self-service channels, with around 65 percent purchased online and a further 10 percent through self-service kiosks. During major blockbuster openings, that figure can exceed 90 percent.

That shift has created a mismatch between customer behaviour and legacy architecture.

Historically transactions ultimately connected back to servers located inside individual cinemas. The move to Vista Cloud will relocate the transactional source of truth into Microsoft Azure, closer to the digital channels where customers increasingly interact with the business.

“The cinema used to be the centre of our technology architecture because that’s where almost every transaction happened. Today the customer can transact with us anywhere, so our architecture has to evolve around the customer, rather than the building.”

Wrightson says the company is also looking to ensure it doesn’t simply recreate the past with its latest migration.

“When you’ve operated a platform for close to 20 years, you inevitably accumulate integrations, customisations, processes and workarounds. A modernisation program gives you a rare opportunity to challenge those rather than automatically rebuilding them.

“Modernisation is as much about what you choose not to take with you as what you migrate.”

Looking ahead, Wrightson believes the combination of data, AI and automation will create opportunities to further improve decision-making.

“If we can move from simply presenting someone with information to identifying an opportunity, recommending an action or even triggering an appropriate workflow, that’s where data starts to become incredibly powerful.”

But in keeping with the company’s broader approach, he has little interest in deploying technology for its own sake.

“Our approach to AI is business problem first, technology second,” he says. “If we can’t articulate the value we’re trying to create, adding AI doesn’t make the idea better.”

For Wrightson, that’s ultimately the distinction that matters. Cloud platforms, ERP systems, data lakes and dashboards are only useful if they help people make better decisions. Otherwise, they’re just another report no one acts on.

Just a quick note for all our readers: This case study was not a paid placement. We want to keep things transparent and share only authentic, fact-based stories about what real businesses are doing with real tech. If you’re a brand owner or an agent and have a genuine story to tell, iStart’s readers are eager to hear about it. Please don’t hesitate to get in touch if you’d like to share your experience.

Thanks for helping us showcase meaningful stories that inspire, educate and motivate businesses to invest in their productivity.

The post Hoyts: Pretty dashboards don’t fill seats appeared first on iStart keeping business informed on technology.

Released by industry body DataCentres New Zealand and backed by Tech New Zealand, the strategy argues that data centres should be recognised as essential national infrastructure and play a larger role in the country’s economic development and digital transformation agenda. It sets out a vision for New Zealand to become a ‘trusted and sustainable’ location for data centre and AI infrastructure investment and says data centre development could support productivity, improve resilience, create jobs and establish a new export industry.

“The goal is not simply more capacity; it is building the right capacity, in the right places, in a way that is good for New Zealand.”

The strategy calls for closer coordination between government, industry and the electricity sector, alongside efforts to attract international investment and accelerate the development of supporting infrastructure. It argues New Zealand’s renewable electricity systems, political stability and cool climate provide a strong foundation for future growth.

“Every digital interaction depends on data centres,” Tech New Zealand chief executive Graeme Muller, who is also a member of the DataCentres NZ establishment group, says. He describes data centres as the backbone of the digital economy, supporting everything from healthcare and education to cloud computing and artificial intelligence. Other members of the establishment group include representatives from data centre company’s DCI, CDC, Datagrid and TenPeaks (a spin-off from Spark’s data centre operations), Microsoft and energy and communications company Vector.

The strategy’s release comes as New Zealand continues to debate how to meet growing electricity demand. Over the past two years, concerns about winter generation shortages, wholesale electricity prices and the country’s reliance on thermal generation during dry years have become recurring issues for consumers, businesses and policymakers.

While the strategy argues that additional data centre investment could stimulate the development of renewable generation and supporting infrastructure, large-scale facilities are increasingly attracting attention because of their substantial electricity requirements.

Australian – and Kiwi – challenges

It’s an issue also emerging across the Tasman with increasing community and political opposition to data centres. The federal Labor government announced last month that large-scale data centres will face a legal obligation to underwrite their own renewable energy generation equivalent to what they consume and be highly water efficient, pay for additional water infrastructure and curtail power consumption during times of peak grid stress. That legislation, however isn’t expected to pass until next year.

The Australian Greens, meanwhile, have called for a moratorium on the building and approval of new data centres in Australia (their Kiwi counterparts have also called for a one-year moratorium on consenting and building new large-scale data centres in New Zealand).

A petition opposing a proposed AU$1.1 billion data centre for Singapore’s Zerra in Campbellfield, Melbourne over projected power demand, environmental impact and employment benefits, has garnered more than 1,300 signatures. The data centre would consume up to 336MW of electricity when fully operational. The petition is calling for the Victoria Government to halt plans for AI data centres until comprehensive environmental impact assessments have been conducted or alternative solutions are explored.

The New Zealand strategy acknowledges similar challenges, arguing that growth must be carefully managed and that future developments should support wider energy and environmental goals. It proposes what it describes as a ‘New Zealand way; of data centre development, with an emphasis on energy efficiency, transparency and alignment with renewable generation investment.

Two-pronged

At the centre of the strategy is a two-pronged objective.

The first is ensuring New Zealand has sufficient domestic infrastructure to support increasing demand for cloud services, AI applications and digital services. The second is attracting international investment and positioning New Zealand as a destination for what the strategy describes as ‘trusted and sustainable’ data centre capacity.

Supporters argue the country’s high proportion of renewable electricity generation, stable political environment and strong international reputation provide competitive advantages. The strategy also points to forecasts that global investment in data centres could reach US$6.7 trillion by 2030 and says New Zealand should seek to capture a share of that growth.

Questions remain, however, about how data centre expansion fits into wider energy policy.

The strategy calls for government and industry collaboration on grid connections, infrastructure planning and investment attraction, while also encouraging further renewable generation development. Among its recommendations are priority development zones, more predictable consenting processes and a ministerial advisory group focused on infrastructure planning.

DataCentres New Zealand argues that increased investment in digital infrastructure and energy generation can be complementary rather than competing priorities.

“Done well, new data centres can help drive investment in additional renewable generation and enabling infrastructure,” Muller says. “The goal is not simply more capacity; it is building the right capacity, in the right places, in a way that is good for New Zealand.”

Whether that argument gains broad support may depend on how New Zealand addresses its energy challenges over the coming decade.

For now, the launch of the strategy places data centres squarely within a wider national conversation that extends beyond technology, touching on electricity supply, infrastructure investment, economic development and the country’s future energy mix. As Australia is discovering, the debate over data centres is no longer just about digital infrastructure. It is increasingly a discussion about who pays for growth, where that growth occurs, and how it fits within broader community and energy priorities.

The post Data centre strategy lands amid power debate appeared first on iStart keeping business informed on technology.

The latest ACS Australia’s Digital Pulse 2026 report – the 12th edition of the annual report produced with Deloitte Access Economics – found the number of technology workers fell 0.3 percent to 967,000 in 2025, marking the first contraction since the study began.

“The findings point to a technology workforce in transition, rather than decline.”

At the same time, the report says digital skills – beyond just the technology sector – are becoming a core economic asset, contributing an estimated $476 billion to the Australian economy, more than three times the $142 billion generated directly by the technology sector itself.

The report, drawn from a workforce survey of more than 1000 Australian workers including 644 tech workers and 418 workers across various industries, along with job advertisement data, statistical data and industry consultation, notes the headline figure masks a more complex story, with growth continuing in management and professional technology roles while some others declined.

Despite the decline in workforce numbers, Australia is forecast to need another 259,000 tech workers by 2035, lifting the workforce to more than 1.2 million. ACS says demand for technology capability is continuing to expand across industries well beyond the traditional ICT sector, with tech roles growing in sectors including construction, mining and healthcare.

“The findings point to a technology workforce in transition, rather than decline,” the report notes. While employment fell in technology trades, sales and admin roles, roles in technology management and professional occupations continued to grow. Technology employment also increased outside the tech sector itself, particularly in industries such as construction, mining and healthcare.

While the technology sector generated $142 billion in economic activity in FY25 and contributed more than $12 billion in exports, the report shows digital skills now have value far beyond the technology industry itself. Building on last year’s report, which highlighted the role of digital across the economy, ACS estimates digital skills applied across the workforce were worth $476 billion to the economy in 2025, with the average Australian worker now spending around three hours a day using digital skills.

In industries including financial services, professional services and telecommunications, more than half of labour value is associated with digital tasks, while even traditionally non-technical sectors such as construction, healthcare and accommodation are becoming increasingly dependent on digital capability.

“The economic importance of technology extends well beyond the output of the technology sector.”

University dreams

But employers struggling to fill tech roles may want to take a hard look at their hiring requirements, with the report also highlighting a disconnect between what employers say they want and where tech careers are actually being built.

According to the report, 40 percent of tech workers who entered the workforce over the past five years came through alternative pathways rather than traditional university routes. Those pathways included 55,000 workers who upskilled through workplace training, 44,000 who entered through industry-recognised credentials and 34,000 self-starters.

More than half of workers who reskilled into technology careers, meanwhile, entered through non-university pathways. Two in five of those successfully transitioning into tech roles did so within their existing employer.

Despite that shift, 74 percent of tech job advertisements still require a university degree.

Beau Tydd, ACS president, says the professional is already moving beyond the traditional university pipeline has already moved beyond the traditional graduate pipeline.

“Technology careers are no longer defined by a single entry point, with university and vocational education now sitting alongside workplace training, industry credentials, skilled migration and self-directed learning as important routes into the profession,” Tydd says.

Migration also remains a major contributor to workforce growth with migrants and temporary workers accounting for 20 percent of the technology workforce inflow between 2021 and 2026. The 435,100 overseas-born tech workers contributed an estimated $56 billion in wages to the economy last year.

Game on for professionalism

But as entry pathways become more varied, ACS says professionalism becomes even more important and employers need clearer and more consistent ways to assess capability, while workers need stronger and more portable signals of skill that support both recognition and progression.

Nearly 80 percent of technology workers reported completing some form of accredited training during their careers. Almost half had completed SFIA-accredited assessments. ACS modelling found workers who undertook SFIA-accredited training earned an average wage premium of 73. Percent, equivalent to about $8,600 annually for the average worker surveyed.

For ACS chief executive Dr Prins Ralston, those figures underline the importance of recognising skills gained through multiple pathways.

“University degrees, vocational education, workplace training, industry credentials, skilled migration and self-directed learning are all now part of the pipeline, with 40 percent of new technology workers entering through alternative pathways,” he says. While that diversity is a strength, he says it also creates a new challenge in finding clear and consistent ways to recognise capability, build trust and support mobility across roles, sectors and career stages.

The report also highlights gaming as a gateway to technology careers, saying it is ‘one of the most powerful and underused entry points into technology education’. Participation in school technology courses has declined, falling from 36 percent of Year 12 students in 2012 to just 20 percent in 2024. It’s urging government and industry to support teachers to use game design and development as an accessible, creative vehicle for teaching the Digital Technologies Curriculum, especially for students who don’t see themselves in STEM.

The post Australia’s tech workforce shrinks as digital economy booms appeared first on iStart keeping business informed on technology.

Fortysouth was born out of the now One NZ’s sale of its mobile tower infrastructure in late 2022. It took out the Innovation Leadership Through an Emerging Technology award at the recent New Zealand CIO Awards for its digital twin program which is being rolled out across 1,700 telecommunications towers across New Zealand.

“We didn’t, in our wildest dreams, think it was going to be this good.”

The system, which turned a process taking six months into a 10-minute task, uses drones to capture thousands of images of each tower, creating a highly detailed virtual model that engineers, customers and operational staff can access remotely.

Clarke says the award reflected the project’s adoption, rather than just its technical sophistication.

‘The reason we won the award is not because of the technology, it’s because we’ve got everybody using it,” he told iStart.

What makes Fortysouth’s approach unusual, is who those users are.

While most organisations deploy digital twins to improve maintenance, asset inspections and operational efficiency, Clarke says Fortysouth has focused on making the technology part of the customer experience.

“For me, it’s the customer. We’re the only people I’ve found in the world that are really using digital twin to make the customer’s life easy. Most are using it for maintenance.”

The customer-first approach has transformed a traditionally slow and heavily manual process.

Historically, telecommunications companies wanting to place equipment on a tower would request engineering drawings – which could prove a challenge to find and weren’t always accurate – review site records wait for structural assessments and work through multiple iterations with engineers. Finding documentation alone could take weeks, and that documentation wasn’t always accurate, while engineering reviews could stretch the process out to six months.

Under the digital twin model, customers can access a virtual tower, choose equipment from a BIM (building information modelling) catalogue of specific equipment and place it directly onto the igital model. The system provides visibility of available space, checks structural capacity, references lease and regulatory information held in Fortysouth’s asset management system, and provides an initial engineering assessment.

“At the end of 10 minutes customers have a high degree of confidence that the whole thing will work,” Clarke says. Formal engineering calculations still follow, but customers can move ahead with planning instead of waiting for information to be gathered manually.

For customers, Clarke says the process is ‘very, very simple’. Customers select equipment from catalogues containing their actual hardware and use simple drag-and-drop tools to visualise installations and tower suitability.

“The hardest thing is getting someone to see it first,” Clarke says. “Once people see it, they love it.”

Cutting the Gordian knot

The ease of use became a major factor in adoption, both externally and internally.

When Fortysouth began the project many of its engineers were unconvinced. Adoption of digital twins was part of the conditions attached to its acquisition of the tower assets from One NZ (then Vodafone NZ), and Clarke is blunt that FortySouth initially had little sense of how valuable the technology would be.

“We didn’t really know how it would be used,” he says. “Our engineers were sceptical because they’d all grown up on paper drawings.”

The scepticism didn’t last long.

Engineers quickly discovered the digital models were often more useful than traditional records because they represented the asset as it actually existed, rather than how it appeared on drawings that may have become outdated. “They flipped overnight from being sceptical to being it’s the one thing you can trust,” Clarke says.

Customers too, ‘got it very quickly’.

The experience also highlighted another challenge familiar to infrastructure owners: Poor asset records.

When Fortysouth acquired the network, it inherited large volumes of engineering documentation.

“They won’t thank me for saying this, but they were handing over a bit of a mess. Telco’s records are terrible. I think that’s sort of a universal truth.” While those records are now organised and searchable, Clarke says traditional asset information is often difficult to locate and may not accurately reflect what was ultimately built.

Digital twins, he says, allow infrastructure companies to create an accurate current representation of the asset and work forward from there, rather than trying to progressively improve legacy records. “It’s a bit like cutting the Gordian knot. You don’t improve the record you’ve got. You just start again,” he says.

“It just cuts through any historical data issues and gives you a near perfect record of what’s there today, which is a massively valuable thing for any infrastructure owner thinking about maintenance or changes to the network.”

Beyond telecommunications

That capability is now generating interest beyond telecommunications. Clarke says infrastructure operators have approached Fortysouth to learn more about the project. He recently spoke at a US conference, sparking ‘a lot of interest’ in the project.

The company believes the opportunity extends well beyond tower networks to any organisation managing large numbers of geographically dispersed physical assets. Clarke says the value becomes particularly apparent when assets are difficult, expensive or time-consuming to visit in person. But he admits it doesn’t work for all assets. Clarke has come from the power sector where building digital twins is ‘quite a different thing’. “You can’t fly a drone for those, you actually have to build them on a computer because you can’t fly a drone inside a turbine.”

Alongside the use by customers, Fortysouth is also harnessing the twin for the more traditional maintenance activities. AI tools help identify potential issues including missing bolts and signs of rust, allowing maintenance teams to focus attention on areas requiring inspection and reducing the need for staff to climb 20m towers or travel long distances to gather information.

It’s also being used to show landowners, and councils, what a proposed tower would look like ‘in a very high definition way’. “Everybody wants mobile coverage, no one wants a tower on their land,” Clarke says. The digital twin, ironically, is ‘much more human, understandable and valuable’ than a 2D drawing.

The biggest lesson

His advice to organisations considering the technology is straightforward: Give it a go.

“You will find value in it. You probably don’t know what it is until you do it, but give it a go and pass it around your various teams and customers. I’m confident that in doing that, you’ll get value out of it,” he says.

Despite the operational benefits, Clarke says the biggest lesson from the project was not in maintenance, engineering or AI. Instead it was in discovering how much value customers derived from being able to inspect assets themselves, test options and make decisions without waiting for information to be supplied by Fortysouth.

“We didn’t, in our wildest dreams, think it was going to be this good,” he says.

The post From six months to 10 minutes: Fortysouth’s digital twin advantage appeared first on iStart keeping business informed on technology.

The reports comes as employers on both sides of the Tasman continue to report workforce challenges. In the latest Hays Salary Guide, 83 percent of Australian and 75 percent of Kiwi organisations said they have experienced a skills. Shortage in the last 12 months, with shortages concentrated in technical sectors, though the tech and software and services sectors reported slightly below average skills shortages and the ICT sector was -14 percent below average.

“This is no longer just a leaky pipeline.It is a structural challenge.”

Tech New Zealand’s fourth annual Digital Skills Aotearoa report, Digital Skills in the Age of AI, warns that New Zealand’s digital skills challenge has become structural, with declining participation in technology-related subjects, fewer ICT migrants and growing demand for digital workers creating pressure on the talent pipeline.

At the same time, Australia’s Committee for Economic Development of Australia (Ceda) says skills recognition remains a significant weakness in the Australian migration system, with overseas qualifications often going unrecognised and many migrants working in roles below their level of training. Ceda estimates that mismatch costs Australia around A$4 billion annually in lost wages – ‘a poor result for migrants and a waste of the economy’s capacity’.

Pipeline pressure

Tech NZ’s report, which is drawn from government, industry and education provider data and insights, says more than half of the surveyed organisations expect recruitment for digital roles to increase over the next 12 months, with digital capability is increasingly required across both technology and non-technology sectors. Demand for advanced digital skills, particularly in AI, cybersecurity, cloud infrastructure and software development, remains high.

The report says New Zealand’s tech sector has become one of the country’s strongest economic performers, contributing around $24 billion, or eight percent of GDP. The top 200 tech exporters, meanwhile, generated nearly $20 billion in total revenue in FY2025 according to the Technology Investment Network.

Yet it says the foundations supporting future growth are under pressure, with Tech New Zealand CEO Graeme Muller warning that continued growth can’t be taken for granted.

Participation in NCEA technology studies has been declining, fewer students are taking science, technology and mathematics subjects associated with digital careers and ICT migration has dropped with just 729 visas approved for ICT jobs in 2024, down 67 percent on the previous year.

“This is no longer just a leaky pipeline,” Muller says. “It is a structural challenge.”

There are some glimmers of hope, however, with domestic IT degree enrolments growing and Masters and PhD enrolments increasing strongly. Graduate numbers, however, remain modest and entry-level pathways remain limited, Tech NZ says.

“Technology is one of New Zealand’s clearest pathways to higher productivity, export growth and global competitiveness. But we cannot take that growth for granted,” he says.

Migration challenges

New Zealand’s declining ICT migration is mirrored in Australia where net overseas migration last year was down 45 percent from the 2023 peak. Committee for Economic Development of Australia (Ceda) data shows 300,955 migrants arrived in 2025, down from the post-pandemic surge of 555,800. Numbers are expected to decline to around 225,000 by 2027-28, roughly in line with pre-pandemic levels in keeping with Government moves to moderate net overseas migration and tighten aspects of international education and temporary visa systems. Higher migration from Kiwi citizens was one of the factors Ceda says is currently keeping migrant levels above the long-run average.

Despite that drop, Ceda warns migration remains a ‘flashpoint’ with political parties politicising cuts to migration, framing high intake as a driver of housing affordability and infrastructure strain.

It notes around one in three workers in healthcare, logistics, professional services and manufacturing were born overseas.

However, Ceda argues Australia’s migration system continues to fall short when it comes to recognising overseas qualifications and experience.

“Overseas qualifications often go unrecognised in Australia, leaving migrants in roles below their training,” the organisation says.

The Australian report also notes that the country’s permanent migration programme remains heavily weighted towards skilled migration, with around 70 percent of places allocated to skilled migrants and thousands of offshore places reserved for workers aligned with long-term workforce needs.

The AI paradox 

Back in New Zealand, the Tech NZ report also highlights an emerging ‘AI paradox’, noting the often contradictory findings when it comes to AI’s impact on ICT professionals and technical roles. While many report being able to complete some digital tasks faster, AI can also increase code complexity, technical debt and security risks while decreasing code quality when used without sufficient expertise.

“As AI tools remove some entry-level tasks, the remaining work is often raising, not reducing, the need for deep technical expertise,” the report says, noting the value of experienced practitioners who can validate outputs, manage risk and govern AI systems.

The displacement of entry-level work is also creating an experience chasm that’s harder to cross, the report says, while AI can enable junior developers to generate huge volumes of code quickly, which can overwhelm senior review capacity further increasing the value of experienced professionals who can validate and govern what is produced.

Says Muller: “New Zealand needs people who understand the technology deeply enough to use it safely, productively and responsibly: from software engineers and AI specialists to cybersecurity experts, cloud professionals, systems architects and leaders who can govern data, risk and ethics.”

The post NZ seeks digital talent, AU talent goes unused appeared first on iStart keeping business informed on technology.

From 10 December 2026, new disclosure requirements under the Privacy and Other Legislation Amendment Act will require organisations to disclose when automated decision-making systems use personal information to make, or substantially assist in making, decisions that significantly affect an individual’s rights or interests.

“The obligations will extend beyond high-risk AI systems to capture commonly deployed enterprise and customer-facing technologies.”

The change comes as financial industry regulator APRA (the Australian Prudential Regulation Authority) warns banks, insurers and superannuation funds that governance and assurance practices are not keeping pace with the scale and speed of AI adoption. It’s calling for a ‘step-change’ in how AI-related risks are managed.

The combined message from privacy and financial regulators is straightforward: Organisations required to follow the Australian Privacy Principles will need to know where AI is being used, what personal information it relies on, and the types of decisions made.

The Privacy and Other Legislation Amendment Act introduced a range of privacy reforms, including clarifying ‘reasonable steps’ to protect the security of personal information, introducing the offence of doxxing and providing ministerial powers to ‘whitelist’ countries that provide substantially similar privacy protections. Many of the changes kicked in in 2024.

What the new rules require

Law firm Macpherson Kelley says businesses that use personal information in automated or semi-automated decision-making that could reasonably be expected to have a significant effect on an individual’s rights or interests will need to update their privacy policies by December 2026. The policies will need to describe the types of personal information used and the types of decisions being made.

The requirement extends beyond generative AI tools. Mark Metzeling, principal lawyer commercial for Macpherson Kelly notes the rules apply where a computer program either makes a decision itself or performs a task that is ‘substantially and directly related’ to making that decision. An automated decision could include outcomes affecting contractual rights, access to services, eligibility determinations and other decisions that significantly affect individuals.

Among the examples of those most likely to be caught by the new requirements are financial services companies relying on credit-scoring, fraud detection and algorithmic trading, ecommerce and digital platforms using recommender systems or dynamic pricing, telcos harnessing automated customer identity checks and service provisioning, and insurers, healthtech and medtech companies using predictive analytics.

Areas including insurance eligibility assessments, recruitment screening, automated billing, hardship assessments and disconnections, and other AI-driven decisioning systems are also likely to be impacted.

The Office of the Australian Information Commissioner (OAIC) says the new transparency requirements are intended to give individuals greater visibility into how automated decision-making systems use their personal information – reducing AI’s ‘black box’ challenge. In a May consultation paper, the regulator said greater transparency would help people understand how their information is being handled and enable them to take further action where appropriate.

Veronica Scott, partner at Pinsent Masons, and Gagan Singh, associate at the law firm, say the OAIC has taken a broad, technology-neutral approach to the meaning of a ‘computer program’ that is used for ADM.

“This may include commonly used software; apps; word-processing tools; AI systems; generative AI tools; chatbots and virtual assistants; and tools that analyse, classify, summarise or generate content,” they warn.

“This signals that the obligations will extend beyond high-risk AI systems to capture commonly deployed enterprise and customer-facing technologies. This has the potential in practice to result in lengthy disclosures.”

They note many common digital business practices such as targeted advertising and content delivery, may fall within scope particularly where algorithmic curation may limit access to employment opportunities or personalised or differential pricing for significant good or services is provided.

Ashurst Perkins Coie also cautions that organisations should prepare for targeted advertising and algorithmic pricing to come under scrutiny.

The tech challenge

For tech leaders, the challenge may not be interpreting the legislation, but instead ensuring they can trace what all the systems are doing in practice, the decisions they influence and the personal information sitting behind it – and provide the plain English disclosures required.

A January review by the OAIC into how Australian government agencies use ADM in decision making and communicate that information on their websites found just 17 percent disclosed that they were using ADM and none had published guidelines or policies explaining how those systems were used.

Meanwhile an APRA review in April of large financial institutions found AI adoption accelerating across regulated industries, with organisations moving from experimentation to customer-facing use cases including claims triage, loan processing, fraud detection, customer interactions, insight generation and software engineering.

Governance, however, has not kept pace APRA warned.

The regulator says while boards showed a strong interest in AI’s strategic potential, many were still developing the technical literacy needed to effectively challenge AI-related risks and provide oversight. APRA also noted an ‘over-reliance on vendor presentations and summaries without sufficient examination of key AI risks such as unpredictable model behaviour and the impact on critical operations.”

Among APRA’s expectations is that organisations maintain an inventory of AI tooling and AI use cases, alongside clear accountability, human involvement in high-risk decisions and governance arrangements covering the full AI lifecycle.

Mapping and disclosures required

Macpherson Kelley’s Metzeling warns the ADM requirements apply to any qualifying decision made on or after 10 December 2026, regardless of when the algorithm or system was originally implemented.

He’s urged organisations to prepare early, mapping algorithms and evaluating whether – and where – automated decisions involving personal information are occurring within the organisation.

Ashurst Perkins Coie echoes that, saying organisations need to close the loop on governance and ensure they can trace what systems are actually doing in practice – and keep disclosures aligned with reality.

The post Know your ADM: New rules put automated decisions under scrutiny appeared first on iStart keeping business informed on technology.

The Talbot Mills research, conducted for Datacom, found 83 percent of senior business and tech leaders surveyed are concerned about storing data offshore or with an overseas provider, while 72 percent consider ownership and control of data an important or critical priority for their organisation. Yet despite those concerns, only 35 percent have a formal written policy governing where critical data should reside and how those decisions are made and just 41 percent have a documented exit or migration plan if their primary provider becomes unavailable or unacceptable.

“More than half were concerned foreign governments could gain access to data stored in New Zealand if the underlying infrastructure was owned by a multinational.”

The findings come as organisations across New Zealand and Australia face growing scrutiny of data governance, cybersecurity and operational resilience.

Peter Nelson, Datacom New Zealand managing director, says are paying closer attention to how and where information is managed.

“Organisations are paying much closer attention to where their critical data sits, who controls the infrastructure it relies on and what would happen if access was disrupted,” he says.

The challenge, however, is turning that awareness into practical action.

According to the survey, concerns around offshore storage extend beyond questions of location. Among respondents worried about offshore data, 77 percent cited data breaches as a concern, while 60 percent were worried about legal access by foreign governments. More than half were also concerned foreign governments could gain access to data stored in New Zealand if the underlying infrastructure was owned by a multinational provider.

At the same time, most organisations are already keeping critical information close to home. The survey found 64 percent store their most sensitive or business-critical data entirely in New Zealand, while a further 21 percent use a combination of local and offshore storage.

The survey also highlights the difference between data residency and data control, an issue increasingly discussed in regulatory and governance circles on both sides of the Tasman. Australian governance and sovereignty commentary has increasingly focused on questions of who controls data and which jurisdictions can claim legal access to it, rather than simply where data is physically hosted.

Among organisations using local or hybrid storage models, 56 percent said their data is hosted in facilities operated by hyperscale cloud providers including AWS, Microsoft Azure and Google.

Governance lags

While concern about sovereignty is widespread, formal governance appears less common, particularly among smaller businesses.

The report found 70 percent of organisations with 20 or more employees have a formal policy governing where critical data is stored and managed. Among organisations with fewer than 20 staff, just seven percent reported having such a policy.

The survey suggests a similar gap may exist between confidence and preparedness.

Eighty-five percent of respondents said they were confident their organisation could continue operating critical services during a disruption to offshore cloud access, network connectivity or a cloud control plane. However, only 41 percent had a documented exit or migration plan if their primary provider became unavailable or unacceptable and just 39 percent had tested restoration of critical systems and data within the previous six months. Thirteen percent admitted they had never tested recovery capabilities.

Nelson says organisations needed to test, rather than assume, resilience.

“A backup strategy is only as good as an organisation’s ability to restore from it when something goes wrong,” he says.

Of course, it wouldn’t be a 2026 survey if it didn’t include AI, which is placing additional demands on data governance frameworks. Forty-five percent of respondents said AI adoption had influenced data infrastructure and storage decisions during the past year. At the same time, 43 percent said legacy systems, fragmented data platforms or unclear governance were slowing their ability to adopt AI safely.

Those challenges are not unique to New Zealand. The Governance Institute of Australia’s 2025 AI Deployment and Governance Survey identified governance, privacy and implementation challenges as organisations seek to move AI projects into production environments.

Lou Compagnone, Datacom director of AI, says many organisations are discovering that AI initiatives depend on the quality of underlying governance and data management practices.

“The organisations that get the most value from AI will be the ones that have done the foundational work first – trusted data, strong governance, clear access controls and confidence in where information is stored and who can access it,” Compagnone says.

More than a third of organisations surveyed said they are already reviewing where critical data is stored and managed, or plan to begin a review within the next six months.

The post Companies worry about offshore data risks, few have a plan appeared first on iStart keeping business informed on technology.

The technology allows attendees to enter venues through facial authentication – much like unlocking your smartphone or a SmartGate at the airport – rather than scanning a barcode.

“Meaningful consent requires people to understand what they are agreeing to and retain the ability to withdraw that consent.”

Geelong Football Club has introduced an ‘express lane’ for members at its home venue, the GMHBA Stadium. Members upload a selfie to their account to be verified at the entrance.

Similar systems have been an option at the Australian Open since 2024 and the technology is used in the United States for NFL games and college sports. Other AFL clubs are also reportedly exploring the technology.

The move comes as the often controversial technology appears to be broadening beyond traditional use cases such as border control, mobile device authentication and workplace access. The latest deployments suggest biometrics are beginning to move into mainstream customer interactions with organisations exploring ways to use biometric data for access control, payments, digital identity, loyalty programs and age verification.

Replacing tickets, cards, passwords and physical identification documents with biometric authentication has the potential to reduce friction for customers while streamlining transactions and access processes. Sports venues are promoting facial authentication as a faster way to move people through entry gates, but similar opportunities are emerging across retail, financial services and customer service environments.

Face, palm, pay

In New Zealand, Eftpos New Zealand recently launched biometric-ready payment terminals designed to eventually support face and palm authentication for payments, digital identity verification and age verification. Neither Eftpos NZ nor technology provider Verifone have indicated when biometric payments will become available, or disclosed whether the biometric matching will happen on the terminal itself or through the cloud.

At the same time, New Zealand organisations are adjusting to a new regulatory environment. The Biometric Processing Privacy Code came into force in November 2025, establishing specific rules governing the collection and use of biometric information. The code requires organisations to demonstrate biometric processing is lawful, necessary and proportionate, while implementing safeguards around collection, storage and disclosure.

Consent under scrutiny

As biometric technologies move from controlled environments to customer-facing applications, questions about governance and privacy are continuing to garner attention.

Curtin University lecturer and ethics of AI researcher Adam Andreotta notes facial authentication differs from broader facial recognition systems because users voluntarily provide a selfie to verify their identity, rather than being identified from images captured in public spaces. Even so, facial images and biometric information are classified as sensitive information under Australian privacy law, requiring informed consent for collection and use. Writing in The Conversation, Andreotta argues that meaningful consent requires people to understand what they are agreeing to and retain the ability to withdraw that consent.

The debate has already played out in the Australian and New Zealand retail scene. Bunnings and Kmart both attracted attention in Australia over their use of facial recognition technology in stores with regulators examining how biometric information was collected and used.

In 2024, the Office of the Australian Information Commissioner found that Bunnings’ use of facial recognition technology on customers entering its stores – for security purposes – breached privacy law. The regulator concluded that customers had not provided informed consent for the collection of facial information and found the retailer’s use of the technology was not proportionate to the risks it was seeking to address.

Earlier this year, the Administrative Review Tribunal found, partly at least, in Bunnings favour, accepting that the use of the technology was permitted, but agreeing that the company had failed to implement adequate privacy governance practices or provide sufficient specific notice to customers about the collection of their facial images. It also confirmed that even momentary or transient processing of personal information can constitute ‘collection’.

In New Zealand, the Office of the Privacy Commissioner ran an inquiry alongside FoodStuffs’ North Islands trial use of facial recognition, finding that use complied with the Privacy Act and safeguards were in place.

The acceptance gap

Research suggests public attitudes towards facial recognition remain highly dependent on how the technology is used.

A 2024 survey conducted by researchers from Monash University and the Australian National University found Australians were generally supportive of facial recognition being used by emergency services to identify victims of disasters or war, and law enforcement agencies to catch criminal suspects but considerably less comfortable with its use in retail stores and workplaces.

Chief investigator Professor Mark Andrejevic said people want greater transparency around how facial recognition systems operate, how information is stored and used, and what accountability measures are in place. The survey also found overwhelming support for notification and consent requirements.

Academic researchers have also questioned whether existing privacy frameworks are keeping pace with rapid developments in facial recognition technology. The University of Technology Sydney’s Human Technology Institute has argued Australia needs dedicated facial recognition legislation, saying existing privacy laws were not developed with widespread biometric deployment in mind. Its proposed model law recommends a risk-based approach designed to protect privacy while allowing appropriate innovation.

Supporters of biometric systems argue the technology can reduce friction in customer interactions by replacing physical credentials such as tickets, cards and passwords. Industry advocates point to faster venue entry, streamlined payments and simplified identity verification as potential benefits.

For local technology leaders, the significance of Australia’s sports venue rollout extends beyond the stadium gate. With biometric-ready payment infrastructure now entering the local market and new privacy rules governing biometric processing, the question is no longer whether biometrics will enter mainstream customer interactions. The technology is already on that path. The challenge will be demonstrating that the benefits can be delivered while meeting increasingly stringent expectations around consent, transparency and governance.

The post Face value: Biometric ‘tickets’ for sports events appeared first on iStart keeping business informed on technology.

New research shows the shift from traditional ERP to what is being dubbed ERX – or enterprise resource experience – is creating a new decision point for CIOs.

“This a huge reimagining of ERP and what’s really exciting is that it’s achievable.”

ERX is positioned as the next evolution of ERP. Rather than acting primarily as a system of record and workflow management platform, ERX combines AI, automation and agentic capabilities to create systems able to sense changes, support decision-making and increasingly execute processes autonomously. Gartner has forecast that by 2030 more than 50 percent of foundational ERP tasks will be autonomously executed by AI, reducing human involvement in finance, supply chain and HR.

Neha Ralhan, Gartner senior principal analyst, describes ERX as a continuum, with organisations moving at different speeds towards intelligent and autonomous enterprise operations.

She told iStart the move is not a repackaging of ERP, but a reimagination.

“It is not the system of old. It’s not the system you recognised from five years ago. It won’t be, can’t be. AI has fundamentally changed ERP.”

While traditional ERP was a passive system of record and digitised ERP layered in AI to enhance insight, ERX harnesses real-time orchestration, composable extensions, user-first experiences and native intelligence to drive faster decision velocity and continuous adaptability to volatility.

Assessing the future

For CIOs and ERP leaders, however, the immediate challenge is not adopting ERX. It’s understanding whether existing ERP strategies remain fit for purpose.

“The first thing is just to assess and audit your current ERP maturing and do this without blinkers,” Ralhan says. “Lots of organisations have spent a lot of money, and not just money but effort and resourcing and strategy, on their ERP. But to have that almost dispassionate view of where ERP stands is really important.”

The assessment extends beyond technology to vendor strategy.

“People need to evaluate vendor offerings,” she says. “You might be surprised what you find, both in terms of the audit of your ERP and also the offerings.”

Existing ERP ecosystems are increasingly misaligned with the pace and complexity of AI-driven businesses, Gartner says.

As organisations begin comparing future capabilities against their own ambitions, some may discover their current platform is no longer the best fit.

“It may not be the one. That isn’t anything that’s a reflection on the vendor or organisation. It’s just that things are moving at such a rapid pace and your ambition my not be completely aligned with what the vendor’s roadmap is and vice versa,” she warns.

When it comes to ERX, Gartner is clear – the technology is not yet fully available. Yet despite that, vendor decisions made today must be ERX-aligned.

“CIOs should prioritise partners with a credible ERX vision and architectures that support composability, open integration and AI-driven evolution,” analysts write in From ERP to ERX: The CIOs Guide to AI-Powered ERP Systems. “Those that do so will position themselves as leaders in the AI era, while those that delay will face escalating costs, reduced relevance and lost market opportunities.”

Roadmap rethink

The advice comes as many organisations continue to execute ERP transformation plans developed before the surge of interest in agentic AI.

Asked whether organisations with established ERP roadmaps should simply press on with their modernisation plans and layer ERX capabilities on later, Ralhan recommends a pause for reflection.

“Take a breath,” she says. “A lot of organisations we speak to have a gorgeous roadmap developed 19 months ago and they’ve put it on the shelf.

“What ERX also forces organisations to do is to have that roadmap as a living document. It’s not a one and done exercise.”

She warns that looking to other organisations to copy their initiatives could prove futile. “It’s really important to realise that what one organisation is doing may not be right for your organisation. It is a continuum and people will have different ambitions and different starting points. For some organisations the ambition may just be scalable ERP, but for others this is a great opportunity to move from laggard status and make a quantum leap.”

Gartner is urging organisations to reject the ‘digitisation trap’ of layering AI over fragmented or legacy business processes – something that ‘merely accelerates the production of poor outcomes and limits the ability to scale’.

“Without structural transformation, your ERP will never evolve to become an ERX and will remain an expensive liability, failing to deliver a competitive insight.”

Setting a North Star

Instead the analyst company is urging businesses to identify their North Star – defining a goal as human-centric decision intelligence. “This vision is not about total human displacement, but about removing cognitive friction by repositioning subject matter experts as supervisors of contextual intelligence, delivering intelligent automation to handle routine execution while humans focus on oversight, exception management and value-based decision making.”

Composable, event-driven technology foundations need to be architected to deliver real-time data streams, open protocols and a layered AI control plane. Business partners will need to be pulled into the mix to align strategic objectives, secure sustained funding, dismantle silos, while governance guardrails for partner and system integrator ecosystems will be needed to enforce clear configuration guardrails, open composability principles and shared performance metrics – recasting vendors and system integrators as strategic co-innovators.

Here in A/NZ the evolution is exposing weaknesses in the fragmented ERP environments many organisations have accumulated over time.

“Unfortunately, it’s sort of the ad hoc nature of ERP that a lot of organisations have, which is we’ll procure this little bit of tech here and then we’ll integrate it with this and then we’ve got a little bit of shadow ERP going as well. I think the timeline for that is numbered.

“It needs to be a little bit more strategic, which a lot of organisations in this part of the world haven’t been, either because of the legacy they’ve adopted, and also part of it is that sometimes we don’t have access to all the offerings available globally.”

There’s good news for those organisations running fragmented ERP systems with Ralhan saying they will be able to participate just as effectively, particularly for those for whom the fragmentation was done ‘mindfully’ – adding on best of breed systems – and may have greater agility now.

“Now is the time internally to set a North Star,” Ralhan says. “A lot can be achieved in a lot shorter period. I’m not saying it’s going to be easy, but this a huge reimagining of ERP and what’s really exciting is that it’s achievable.”

The post ERX forces rethink of ERP strategies appeared first on iStart keeping business informed on technology.

PwC New Zealand’s AI-powered Consumer: How shopping behaviour is changing in New Zealand report suggests AI is becoming a regular part of the shopping journey for many, influencing how customers discover products compare options and decide what to buy, with many saying they trust AI enough to let it complete purchases for them.

“Almost one-third of consumers are now comfortable allowing AI agents to complete purchases on their behalf.”

The survey of 1,000 New Zealand consumers who have used AI for shopping-related activities in the past 12 months shows AI has become the third most-used channel, behind search engines and retailer websites or apps, for product research among that group of consumers, with 56 percent of consumers who shop online using AI weekly for shopping. At the same time, 44 percent say AI has reduced their use of search engines when researching purchases.

It’s a similar story across the Tasman. The Navigators’ AI Brandscape 2026 survey earlier this year found 39 percent of Australians are already using AI to help make buying decisions, with 38 percent using AI as a complement or replacement for traditional search. The study surveyed 1,736 Australian consumers.

“Many retailers are still asking how AI can improve today’s customer experience,” says Phil Wheeler, PwC New Zealand partner, deals strategy, value creation and analytics. “An equally important question is: How will AI change the way customers buy tomorrow?”

Search is no longer the only starting point

The PwC survey found 44 percent of respondents have reduced their use of search engines, thanks to AI use. Consumers are increasingly using AI tools to compare products and prices (64 percent), research planned purchases (62 percent), or just to seek shopping inspiration (52 percent). Seventy-seven say AI helps them find better value.

The Navigators found AI is already influencing how consumers discover and evaluate brands. According to that research, 39 percent of Australians have used AI for purchasing decisions with 38 percent using it to complement or replace search. Another 41 percent say they pay attention to AI-generated search summaries, but only 29 percent say they trust those summaries.

It found 31 percent have acted on AI recommendations with the report describing generative AI as becoming part of consumer decision-making, influencing information search, option comparison and brand selection. The figures soar for those under 35 years, with 62 percent applying AI tools to help make buying decisions and 54 percent reporting they’ve used AI for buying decisions.

The new battleground

One of the strongest themes from both reports is the issue of visibility for brands.

PwC notes that consumers are increasingly using AI to simplify the process of finding and evaluating products, while the Navigators says AI is becoming part of how consumers create shortlists and recommendations.

That has implications for how product information is presented and discovered online.

PwC says retailers have spent years optimising for search engines and digital conversion. But it argues that organisations increasingly need to consider how products and services appear within AI-driven discovery and recommendation environments.

The Navigators reached a similar conclusion, describing generative AI as an emerging influence on consumer choices and highlighting the growing importance of brand visibility within AI systems.

It’s not just online shopping being impacted, with 30 percent of respondents in the Kiwi report saying AI use has led them to shop online more and visit stores less. For 20 percent, AI use had increased both online and in-store shopping activity.

The impact varied ‘significantly’ depending on the category, PwC says. AI-assisted online conversion was strongest in travel, electronics, gifts and fashion, while categories including grocery and homeware remain store-led and tactile in nature.

Agentic commerce on the horizon?

Wheeler says the research suggests the future may be closer than many businesses realise, with respondents indicating a willingness for agentic commerce, where AI systems can act for consumers throughout parts of the shopping process.

“While consumers are already using AI to research and compare products, our research suggests that almost one-third [31 percent] are now comfortable allowing AI agents to complete purchases on their behalf,” he says.

“For retailers, the opportunity is to build trusted AI-assisted shopping experiences today while preparing for a future where AI agents play a more active role in customer interactions and purchase decisions,” PwC says.

Australian consumers are showing similar levels of interest in AI purchasing. The Navigators found 27 percent are open to buying directly through AI tools – or as The Navigator terms them, AI buying agents.

“With one quarter of all Australians willing to transact online via their main AI tool, few categories will be immune from a rapid shift once buying agent capabilities roll-out,” the Australian report says.

At the same time, trust levels are high among existing AI users. PwC found 97 percent trust AI recommendations, at least to some level, while more than half also expect their use of AI for shopping to increase.

Perplexity scores twice as high for trusted outputs than Microsoft Copilot, with Claude twice as trusted as Meta AI, which was second least trust, with only DeepSeek ranking lower. Meta was also below Copilot when it came to consumer trust of reliability and accuracy of outputs.

Impressing AI

Both reports note that for retailers, the challenge now is no longer simply attracting customers to websites and apps. Increasingly the first interaction may occur inside an AI tool, long before a customer reaches a brands digital front door.

The Navigators says organisations need to treat AI as a discovery channel, managing their brand presence where AI answers are formed – while also noting fragmentation of AI ecosystems adding further challenges for companies – and establishing leading indicators for AI visibility and influence. Building trust and rewiring commercial capability – planning for compressed journeys AI-led recommendations and buying agents – is also required, it says.

PwC meanwhile advises mapping customer journeys to identify where AI is influencing discovery, research and purchase decisions, and prioritising investment toward the categories, channels and customer segments most exposed to AI-driven shopping behaviours.

It says strengthening product meta data and creating content reflecting customer needs, purchase occasions and shopping missions will become increasingly important as AI becomes a key discovery channel.

A roadmap for AI-assisted commerce and customer-facing AI experiences is also recommended by PwC.

“For retail and consumer businesses, the challenge is not simply whether to adopt AI. It is how to respond strategically to a customer journey that is already beginning to change.”

The post When AI builds the shopping list appeared first on iStart keeping business informed on technology.

That’s according to new analysis from the Stanford Institute for Human-Centred Artificial Intelligence, which examined sovereignty initiatives from Microsoft, Google, AWS, Nvidia and OpenAI and concluded that while they can increase domestic control over infrastructure, data governance and model deployment, they often ‘reconfigure, rather than eliminate dependence on these companies’.

“The tools also ensure these countries will remain structurally dependent on them for the long-term.”.

The Commercial Landscape of AI Sovereignty Offerings report notes there is no shared definition of what sovereign AI actually means and that many commercial offerings marketed as sovereign remain heavily dependent on the global technology companies providing them.

The rise of sovereign AI

The researchers describe AI sovereignty as one of the defining concepts in global AI development, saying it has rapidly become a central concept in global tech policy.

Countries around the world are looking to reduce dependence on a small number of foreign tech providers, while maintaining access to advanced AI capabilities. The result has been a wave of investments, programs and products marketed around sovereignty as commercial vendors have moved quickly to capitalise on demand.

One problem, according to the report, is that nobody agrees on precisely what sovereignty means. For some organisations it means local ownership of infrastructure. Others associate it with data residency, domestic AI models, supply chain security or national technology capability.

“The term is invoked to describe everything from investing in national language model projects to establishing domestic chip manufacturing capabilities to implementing data localisation requirements,” the researchers note.

That ambiguity has created fertile ground for vendors eager to position themselves as sovereignty partners.

Sovereignty as a service

The report maps a growing commercial market for sovereign AI offerings across every layer of the tech stack.

Hyperscalers including Microsoft, Google and AWS have developed products aimed at customers with sovereignty requirements, while opening local facilities and pushing them as ‘sovereign’. Nvidia has promoted sovereign AI infrastructure initiatives, while OpenAI has increasingly become part of government and national AI discussions.

Gartner has forecast global sovereign cloud infrastructure-as-a-service spend to increase 35.6 percent this year, hitting US$80 billion as organisations outside the US and China invest more in sovereign cloud IaaS to gain digital and technological independence and keep wealth generation within their own borders.

The Stanford researchers acknowledge that these offerings can provide genuine benefits. Many increase customer control over where data is stored and processed. Others offer governance controls designed to address regulatory requirements or support local deployment models.

But the report says the initiatives also present a ‘fundamental paradox’. “They promise that countries will own their AI stack, but at the same time they deepen dependencies on US big tech.

“While the tools these companies sell under the banner of sovereignty may genuinely improve purchaser countries’ control over certain aspects of AI development and deployment, they also ensure these countries will remain structurally dependent on them for the long-term,” the researchers wrote.

It notes that adopting Nvidia’s sovereignty offerings to power your entire AI stack could reinforce vendor-lock-in as migrating to rivals would bring high switching costs, and extensive code rewrites. OpenAi’s sovereignty offerings, meanwhile, may increase localised access to cutting-edge models, but they don’t allow for inspecting or modifying underlying systems. The close ties between OpenAI for Countries and the US government also poses risk in becoming bound to US interests.

A familiar argument

The findings echo arguments previously raised by locally-owned cloud providers and digital sovereignty advocates. They have long argued that data residency and sovereignty are not the same thing, despite hyperscalers heralding new local builds as providing ‘true digital sovereignty’. Storing workloads on infrastructure owned by multinational vendors is not the same as maintaining sovereign control, even when the workloads are hosted within national borders, they note.

Keeping data within national borders may satisfy regulatory requirements, but it does not necessarily change who owns the infrastructure, controls the platform, develops the software or sets the commercial terms.

That debate has intensified as AI has moved into the mainstream.

An organisation may deploy AI workloads in-country. Data may remain within Australia or New Zealand. Governance controls may be managed locally. Yet the underlying foundation model, cloud platform, chip architecture or software stack may still be owned and operated elsewhere.

Sovereignty vs self-sufficiency

The report notes that few sovereignty initiatives actually aim for complete independence. Instead, they focus on increasing control over parts of the AI stack while maintaining access to global technologies and supply chains.

The researchers found that even providers marketing sovereignty solutions often rely on internationally developed infrastructure, hardware, software frameworks and AI models. Complete technological independence remains rare.

As a result, sovereignty is increasingly being framed as a question of strategic diversification rather than autonomy.

That perspective may be particularly relevant as Australia continues to invest in sovereign technology capability. Federal and state governments have increasingly highlighted AI capability, digital resilience and local infrastructure as strategic priorities, while vendors have responded with a growing range of sovereignty-focused offerings.

The Stanford report does not argue against those efforts. Instead, it suggests the conversation is more nuanced than the marketing often implies.

“Decision-makers should avoid treating sovereignty as an end goal and prioritise solutions that expand strategic choice without losing access to frontier capacity,” the report says.

The post Sovereign AI: The promise, the reality and a dependency problem appeared first on iStart keeping business informed on technology.

While the incident may sound like a warning from the future, the techniques involved were anything but futuristic. According to OpenAI and Hugging Face, the attack relied on familiar tactics including vulnerability exploitation, privilege escalation and lateral movement, highlighting that AI doesn’t necessarily require an entirely new security playbook – but the existing one has never been more important.

“If their existing approach to cybersecurity defence, detection and response is strong they are capable of defending against cybersecurity attacks regardless of their origin.”

OpenAI, which says it considers the incident to be ‘an unprecedented cyber incident involving state-of-the art cyber capabilities, says the incident occurred during an internal evaluation involving a combination of its models, including GPT-5.6 Sol and a pre-release model, being tested under conditions designed to evaluate advanced cyber capabilities. During the evaluation, the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure in pursuit of solving a testing challenge.

Al evidence suggests the models were ‘going to extreme lengths to achieve a rather narrow testing goal’, OpenAI says.

According to OpenAI, the models first identified and exploited a previously unknown vulnerability in a package registry cache proxy, allowing them to obtain internet access. They then conducted a series of privilege escalation and lateral movement activities until they reached systems capable of accessing external resources. The models subsequently identified Hugging Face as a potential source of information relevant to the benchmark they were attempting to solve.

The activity ultimately resulted in unauthorised access to Hugging Face ‘a limited set of internal datasets and several credentials’ used by the company’s services. It was detected by Hugging Face’s own AI, including agents using open-weight AI models.

Hugging Face describes the intrusion as being driven ‘end to end, by an autonomous AI agent system’, calling it unlike anything the company had previously encountered. The company says the campaign involved thousands of actions executed across a network of short-lived sandboxes, matching the long-discussed ‘agentic attacker’ scenario security experts have been warning about.

Familiar tactics, new actor

But Gartner analysts say the incident shouldn’t be immediate cause for concern, and IT teams should focus on the fundamentals and ignore the hype.

In a First Take on the incident, Gartner analysts John Watts, Dennis Xu, Charlie Winckless, Wayne Hankins and Franz Hinner say while AI clearly enables less-skilled attackers and helps skilled attackers with speed and quality of attacks, there is no evidence today that AI-augmented attacks create novel threats.

“However, there is increasing evidence of rogue-agent risks based on lab and researcher observation.When AI agents are paired with frontier AI models, it raises the risk of drifting from their intended purpose and pursuing unauthorised goals such as hacking.”

Around 80 to 90 percent of AI driven attacks can be stopped with some basic security controls, Gartner says and standard cybersecurity mitigation remains an effective barrier against frontier AI-driven agentic attacks.

“CISOs should reassure executive stakeholders that if their existing approach to cybersecurity defence, detection and response is strong they are capable of defending against cybersecurity attacks regardless of their origin.”

The incident does, however, present the opportunity to strengthen defences and invest in continuous threat and exposure management capabilities.

Gartner’s advice is to double down on cybersecurity basics, maintaining a thorough asset inventory, eliminating unnecessary exposed systems, patching vulnerabilities both directly and indirectly and hardening configurations.

Standard mitigations remain an effective barrier. Likewise, Gartner says “AI-driven attacks are typically not stealthy and can be detected by existing detection capabilities.” Enhancing those detection capabilities is however advocated along with guarding source code repositories as attackers are more effective with source code access, and patching frequently.

Treat agents like privileged insiders

For organisations with access to cybersecurity-capable frontier models, Gartner says the incident is a wake-up call.

“An escape from the model’s intended purpose may result in unauthorised hacking of internal and third-party environments. This creates a new risk of rogue agents.”

Among it’s advice is a warning organisations to take a model-agnotistic approach, noting Hugging Face found a commercial frontier AI model limited capabilities, leading it to switch to the GLM 5.2 open-weight model to complete its forensic analysis.

Meanwhile, the Cloud Security Alliance industry organisation says the Hugging Face breach exposed a growing gap in enterprise security thinking: Organisations are deploying increasingly autonomous AI agents without always treating them as privileged actors inside their environments.

In its post-mortem of the incident, the CSA argues that AI agents should be viewed as ‘bounded, privileged insider identities’ with strict controls around what they can access, what actions they can perform and how their activity is monitored. The incident, it says, highlighted long-standing concerns around excessive privileges, limited visibility into agent behaviour and a lack of controls capable of stopping an agent before it acts.

The CSA’s recommendations are familiar ones. It’s advocating stronger credential management, tighter access controls, comprehensive monitoring and rapid incident response capabilities.

Rather than requiring an entirely new security framework, the incident demonstrates why existing security disciplines need to be extended to cover increasingly autonomous AI systems operating inside enterprise networks.

The post Rogue AI? Security basics still matter most appeared first on iStart keeping business informed on technology.