Reorient Sourcing for AI, Data Centres, and Outcome-Based Security

What happened

Australia’s signals intelligence agency (ASD) has opened consultation to retire the Essential Eight and replace it with outcome‑based, intent‑driven guidance. The key operational change is moving away from prescriptive checklists toward demonstrable, threat‑aligned control outcomes. Procurement should watch the draft to understand which evidence types and acceptance criteria will be expected in RFPs and renewals

Why the category manager should care

Treat the consultation as a sourcing inflection point—contracts must move from checklist attestations to demonstrable, measurable control outcomes

Key facts

• ASD consultation to retire the Essential Eight and shift to outcomes-based guidance
• New model emphasises outcomes, intent and threat‑informed controls

What happened

The market is shifting from single large LLM pilots to agentic AI—many autonomous agents interacting with enterprise systems—and vendors are building orchestration and cost‑optimisation tools to match models to task complexity. The most concrete vendor response is tooling that reduces token consumption and steers tasks to lower‑cost models. Procurement should validate token‑saving claims and portability implications before accepting premium orchestration fees

Why the category manager should care

Plan modular contracts that separate orchestration tooling from core model access and include substitution and portability protections

Key facts

• Enterprise shift from experimentation to planning for agentic AI
• Vendors emphasise model matching and token optimisation to control costs

What happened

AI‑driven demand is accelerating local data‑centre investment, creating pressure on land, power and connectivity and prompting community opposition in some locations. The operational reality is approvals, utilities and grid capacity are constraints that affect where and when hosting capacity becomes available. Procurement should evaluate energy pass‑throughs, site contingency and supplier escalation terms when sourcing hosting or colocation

Why the category manager should care

Include energy and site‑availability clauses in sourcing and assess supplier contingency plans for power and connectivity constraints

Key facts

• Large data‑centre investment plans advancing in NSW and other regions
• Projects increase demand for power, water and network capacity

What happened

Visa is expanding AI investments for security and fraud detection while insisting AI outputs remain subject to human validation and auditability. The concrete detail is pairing AI findings with human review and established risk procedures, signalling higher buyer expectations for oversight. Use Visa’s approach as a benchmark when drafting governance, validation and audit obligations in AI supplier contracts

Why the category manager should care

Require supplier governance, human validation and audit trails for AI outputs as part of contractual obligations

Key facts

• Visa expanded AI investments across security and fraud detection
• AI outputs remain subject to human validation and established risk procedures