On 4 February 2025 Australia’s Department of Home Affairs issued PSPF Direction 001-2025 under its protective security policy framework, banning the use of the relevant products, applications and network services in Australian government entities and in projects receiving Commonwealth, state or territory government funding. The direction rests on a threat and risk analysis of the relevant public services.
How the scope is drawn
The direction’s distinguishing feature is how it draws its scope. It is not aimed at individual users but locks onto two scenarios — “government entities” and “government-funded projects” — and covers products, applications and network services. That wording extends the review object from a single app to the whole service chain, including underlying capability that may be used indirectly.
For AI companies supplying the public sector or government projects, this kind of direction directly changes the feasible range of bidding and delivery. See our notes on data export policy questions.
Different from a data compliance review
Note that the government-device ban rests on a security policy framework, not data protection law. It therefore differs in character from an investigation by a data protection authority: the former concerns state and government information security, the latter whether personal data processing is lawful. The two can start at the same time and can also be independent.
Companies often confuse the two tracks, answering both kinds of inquiry with the same materials and satisfying neither. See our notes on EDPB coordinated enforcement and on simplified measures for small processors.
Effect on the overseas route
A government-device ban is not a blanket market prohibition, but it materially changes a company’s commercial opportunity in the public sector and travels up and down the supply chain through procurement terms. A more realistic approach is to treat “government and funded projects” as a separate business line and assess whether its security compliance requirements can be met, rather than handling public-sector orders as ordinary customers.
At the same time, security requirements at the procurement and supply-chain level tend to land earlier and more concretely than statutory text. See our notes on obligations of major personal information processors.
The direction shows that generative AI applications are being drawn into routine government-device and supply-chain security review and are becoming a standing item in procurement assessment.
This article is based on Australia’s PSPF Direction 001-2025 and public information and is for reference only; it does not constitute legal advice.