Australia will either control the artificial intelligence that runs its critical systems, or it will rent that control from whoever holds the keys, the models, the logs and the off switch. There is no third option that lasts.
This consultation is about more than data centres. It is about whether Australia can train frontier models on its own terms, and whether the Commonwealth and operators of energy, transport, health, communications and other critical infrastructure can still command the AI they depend on when a vendor walks, a network fails, or a foreign interest wants leverage. Those are national security questions. Treat them as facilities questions alone and the country will buy the appearance of sovereignty while losing the substance.
The paper is right on energy, water, land, community and skills. That work must continue. It is not enough. A certified building on Australian soil does not tell you who holds the keys, who decides which model runs, what durable record exists of what the system did, who can stop it, or whether it keeps working when connectivity is cut or a supplier walks. Location of the facility is not control of the system. Confuse the two and Australia will certify racks while foreign ownership, foreign law and foreign operational authority sit on the stack above them.
Megawatts are not sovereignty
Sovereignty in AI is the ability to know, decide and act. Know what ran. Decide which models and data remain under Australian authority. Act to pause, continue or shut down when the national interest requires it. Megawatts power that. They do not create it.
A service in a certified Sydney facility can still have keys held offshore, models swapped without notice, logs the operator cannot see, and a remote kill path the customer does not hold. An organisation running AI under its own command, holding its own keys and its own record of what ran, including when the network is gone or untrusted, can answer for control in a way a postcode never will. Both can be legitimate. Only one is visible under standards that stop at the building line.
Allied partners will ask the same questions. Who can see the system? Who can change it? Who can stop it? Who retains a record under Australian law? Nations that cannot answer cleanly do not get the hardest workloads.
For critical infrastructure under the Security of Critical Infrastructure Act, AI in the loop is already a resilience exposure. Operators answer hard questions about power, water and communications. They should answer equally hard questions about the AI inside those systems. Continuity under coercion, licence withdrawal or supply-chain pressure is a security requirement. Miss that, and the next dependency crisis will be a model, a key, or a switch nobody in Australia holds.
What the Standards must require
Australia’s AI Standards should treat operational control of AI as a first-order national question, equal to energy and water for large facilities:
-
Require a control attestation for high-consequence AI. Any AI service supplied to a Commonwealth entity, or to a critical infrastructure operator under the SOCI Act, must state in plain language, for every party in the supply chain (application vendor, model provider, cloud or facility): who holds encryption keys and whether any supplier can obtain a copy; who chooses which models run and who can change or withdraw them; what record is kept of what ran, where it is kept, and who can read it; who can stop the system; and whether it continues to operate if the network is cut or a supplier’s service or licence ends. Answers must name parties and the law that binds them. General assurance is not an answer.
-
Keep the attestation technology-neutral and location-neutral. Cloud, on-premises, edge and hybrid must pass or fail on the same questions. Make the control chain visible so buyers can match risk to workload, and so opaque arrangements cannot hide behind a local rack.
-
Use the levers Australia already has. Bind the attestation to Commonwealth procurement, the Hosting Certification Framework and SOCI obligations. The paper already says obligations should fall on those who can influence a facility’s “operation and output”. Control of the AI is part of that output.
-
Treat continuity under failure and under pressure as a resilience standard. Ask whether the AI still functions when connectivity is lost, when a commercial relationship ends, or when a supplier is compelled by foreign authority.
-
Count AI that operators can run and control themselves as sovereign capacity. Not every nationally useful AI workload needs a new 30MW training hall. Operators can run serious AI at the edge and on infrastructure they control with no new grid connection and no new water draw, with a durable record of what ran and the ability to keep operating when the network is gone. Sovereignty is measured by what Australia can run under its own control, not only by how many megawatts it builds.
These requirements do not replace energy and water standards. They complete them. Megawatts without a clear control chain produce a false sense of sovereignty. A clear control chain makes Australia a credible place to train, buy and depend on AI.
This is industrial and security policy
A control attestation done properly is not paperwork. It is a national signal.
Serious labs and investors can answer who holds keys, who owns the model lifecycle, who keeps the evidence and who holds kill authority. Jurisdictions that force that clarity attract them. Jurisdictions that only certify the building leave Australia competing on land and power alone. Capital follows the questions Australia asks.
Allied and commercial buyers already demand visibility into foreign ownership, control and influence across the AI stack. Australia can set a standard that serious builders meet cleanly and that opaque arrangements cannot survive. That raises trust for Commonwealth and critical infrastructure procurement, and raises the bar for anyone selling AI into systems the country cannot afford to lose. Frontier training and operational control for critical systems belong in the same national story. One without the other is incomplete industrial policy and incomplete security policy. Build both, or accept that someone else will own the layer that matters.
About Sector88
Sector88 builds the control layer for AI in critical systems: AI that keeps running at the edge and when the network is gone or untrusted, under the operator’s command, with a durable record of what ran. We serve critical infrastructure, energy, defence and sovereign compute. We are an Australian company. We expect the Standards to make operational control measurable for every supplier in the chain, including us.
Close
Build the facilities. Set the energy and water rules. Require a clear answer on who controls the AI that runs inside them, who can see it, who can change it, and who can stop it when the national interest demands it. Australia should train frontier AI here. Australia should also still be in command of the AI that keeps the country running. That is the standard. Meet it.
Taskin Karlar, Founder and CEO, Sector88