Vivanti BDM Intelligence — Friday, 30 October 2026
B2G Variant · 31 leads · 23 HOT · 7 WARM · 1 COLD
Weekly government procurement and consulting-market intelligence for the Vivanti BDM team.
Mega Signal — the compliance clock is now the buying trigger
In 41 days, on 10 December 2026, the Privacy Act automated decision-making disclosure obligation becomes law — and the OAIC found 74% of the 23 agencies authorised to use automated decision-making could not be confirmed as using it from any public material.
APP 1.7–1.9 require every privacy policy to name the kinds of decisions made or substantially shaped by computer programs using personal information, and the kinds of information used. Penalties reach the greater of A$50M, three times the benefit obtained, or 30% of adjusted turnover. The definition is deliberately broad — a spreadsheet that scores and triages crisis-hotline calls is caught; one that calculates an age is not. This is the first already-legislated AI-adjacent deadline in Australia, it is a documentation problem with a fixed scope, and it is the anchor for this quarter's entire assurance pipeline.
1. Executive Dashboard
Run date Friday, 30 October 2026 · 31 leads scored across NSW, federal and policy sources · buy.nsw 20 live IT opportunities (184 platform-wide) · three new opportunities published in the last four days
Top 5 leads by score
Segment distribution
| Segment | Leads |
|---|
| Public Sector | 23 |
| Health | 3 |
| Infrastructure | 3 |
| Other | 1 |
| Insurance | 1 |
Week-on-week: lead count 31 versus 29 last week; HOT 23 versus 18. buy.nsw Information & Technology held flat at 20 open opportunities (was 20 on 23-Oct, 20 on 16-Oct) while the platform-wide total rose from 173 to 184. The composition changed materially: three genuinely new opportunities were published in the last four days (NSWPF Digital Adoption Platform, eHealth Linen Management, Canterbury-Bankstown Safety Software) and three carried deadlines moved.
2. Open Tenders, RFIs & Opportunities — Scored
HOT ≥ 55 · WARM 35–54 · COLD < 35. Every lead carries its source link where one was verified. Deadlines are read from the live buy.nsw listing at run time and supersede any prior-run note.
Privacy Act automated decision-making disclosure commences 10 December 2026
HOT 94 P0
Agency: OAIC — all APP entities (NSW and Federal agencies included) · Ref: ADM-10DEC · Closes: 10-Dec-2026 · Value: Statutory — penalties to A$50M / 3x benefit / 30% adjusted turnover
IN MARKET · 41 days · Public Sector / Tax & Finance
Signal — This is the only fixed, already-legislated AI-adjacent deadline in 2026. APP 1.7–1.9 commence in 41 days. OAIC's desktop review of 23 Commonwealth agencies authorised to use ADM found only 17% (4) had disclosed it, 9% (2) were identifiable users with no disclosure, and 74% (17) could not be confirmed as using ADM from any public material. The obligation is broad: a spreadsheet formula that triages a crisis hotline counts, not just machine learning.
Privacy policies must name (a) the kinds of personal information used, (b) the kinds of decisions made solely by computer programs, and (c) the kinds of decisions where an automated step substantially contributes to a human decision. Trigger: the decision could reasonably be expected to significantly affect an individual's rights or interests. No right to an explanation of a specific decision is created — the obligation is disclosure, not explainability. That is precisely why it is cheap to remediate and easy to sell.
Data & AnalyticsAI/MLDigitalPlatforms
Vivanti Angle
Sell a fixed-fee 3-week ADM Inventory & Disclosure Pack: discover decision engines and rules-based scoring across business units (not just IT), classify against APP 1.7–1.9, draft the privacy policy schedule, and stand up an evidence file. The scoping question that opens the door is not 'do you use AI' — it is 'which of your decisions could significantly affect someone, and can you prove what produced them'. Every agency answers 'we think so, but not in one place'.
Partner to position: Anthropic and OpenAI (model-level governance evidence for LLM-based decisions); Google Cloud or Databricks (catalogue lineage to trace decision inputs) · Owner: Data & AI Practice Lead
SourceView sourcethemodernregulator.com/automated-decision-making-transparency/ RFI — Future Licensing Platform and Transformation Services (Liquor & Gaming NSW)
HOT 90 P0
Agency: Dept. of Creative Industries, Tourism, Hospitality and Sport · Ref: RFI-2018189 · Closes: 20-Nov-2026 · Value: Not disclosed (multi-year platform + SI, est. $20M–$60M)
IN MARKET · 21 days · Public Sector / Regulation
Signal — Highest-value live opportunity on buy.nsw this week and the only one that is still at RFI stage — meaning the requirements are genuinely shapeable. Covers ~1.8M licences, ~5M historical records and 10+ licence schemes. Named shortlist already circulating in market: Salesforce Public Sector Solutions, Objective RegWorks and Pega. Closes 20-Nov, decision 18-Dec.
Market input sought on regulatory licensing platforms, implementation approaches, data migration, integration, security, AI, and the long-term operating model. Because this is an RFI not an RFT, a strong response can write the evaluation criteria that the subsequent RFT will use. The incumbents named are all product vendors — none of them brings an independent data and assurance layer.
DigitalData & AnalyticsAI/MLCustomerPlatforms
Vivanti Angle
Do not bid as a platform. Bid as the assurance, migration-integrity and AI-decision layer that sits between the chosen COTS product and the regulator's obligation to explain a licensing decision. 5M historical records plus a legislated ADM disclosure duty (see ADM-10DEC) is the same problem twice — pitch the joint narrative and you become the only responder addressing both.
Partner to position: Salesforce (if aligning to the likely winner); otherwise Databricks or Snowflake for the migration-integrity and decision-audit layer · Owner: Public Sector Lead
TenderView tender pagebuy.nsw.gov.au/prcOpportunity/6263340C-B874-4747-BCD4A8EC4305B9BB Federal AI Policy v2.1 — eight mandatory requirements, hard deadline 15 December 2026
HOT 86 P0
Agency: Digital Transformation Agency / digital.gov.au · Ref: AIPOL-15DEC · Closes: 15-Dec-2026 · Value: Compliance — non-corporate Commonwealth entities, Defence and NIC excepted
IN MARKET · 46 days · Public Sector / Federal
Signal — Eight mandatory requirements now bind every non-corporate Commonwealth entity: a named accountable official, a public transparency statement, an agency AI strategy, operationalised responsible-AI practice, per-use-case accountability, an internal use-case register shared with the DTA every six months, mandatory foundational staff training, and a pre-deployment impact assessment for each in-scope use case. 46 days to comply.
The AI Impact Assessment Tool is purpose-built and free — which removes the excuse but not the workload. The genuine constraint is the per-use-case assessment at scale: agencies with 40–200 use cases cannot hand-craft each one. Sitting under this is the ~200,000-public-servant foundational training mandate and the GovAI platform (training, application catalogue, sandbox; chat trials from April 2026).
AI/MLData & AnalyticsDigitalPlatforms
Vivanti Angle
Productise as a fixed-fee per-use-case 'register + impact assessment sweep' with a hard deliverable date. Win on volume economics: assess 40 use cases in four weeks using a templated harness, not a consultant-week per use case. Lead with the six-monthly register-sharing obligation — it converts a one-off assessment into a recurring managed service.
Partner to position: Anthropic and OpenAI (frontier-model use-case governance); LangChain or Vertex AI for harness implementation · Owner: Federal Practice Lead
SourceView sourcewww.digital.gov.au/ai/ai-in-government-policy Digital Adoption Platform — NSW Police Force (SAP S/4HANA anchor)
HOT 84 P0
Agency: NSW Police Force · Ref: YR-2026-0084 · Closes: 18-Nov-2026 · Value: Not disclosed (market sounding; indicative pricing sought for business case)
IN MARKET · 19 days · Public Sector / Justice & Policing
Signal — BRAND NEW — published 28-Oct-2026, two days before this run. A market-sounding EOI for a Digital Adoption Platform explicitly to support SAP S/4HANA, with stated intent to scale across other NSWPF enterprise applications. Estimated decision 15-Jan-2027. This is the change-and-adoption wedge on a SAP S/4HANA programme — the highest-failure-rate component of any ERP transformation.
Scope: DAP solution plus implementation and configuration, system integration, development of in-application guidance and learning content, training and knowledge transfer, change and adoption support, and ongoing support and maintenance. NSWPF explicitly wants to understand supplier capability, licensing and commercial models, scalability across applications, and indicative pricing for business case and funding. SCM0020 membership mandatory. Contact: Galit Kitchingman.
DigitalCustomerPlatformsData & AnalyticsAI/ML
Vivanti Angle
The prize is not the DAP licence — it is the adoption-measurement layer. SAP S/4HANA programmes fail on adoption, not configuration, and a DAP without an analytics spine cannot prove adoption. Pitch a DAP implementation bundled with an adoption-analytics dashboard and a benefits-realisation baseline. Market-sounding stage means the commercial model is still negotiable: propose an outcomes-linked structure before the RFT fixes it.
Partner to position: Google Cloud or Databricks (adoption telemetry and analytics); SAP-aligned DAP vendor for the product layer · Owner: Data & AI Practice Lead
TenderView tender pagebuy.nsw.gov.au/prcOpportunity/39E3A1D0-C5AD-47F0-9989C59FBDB6456A Geological Survey of NSW Data Transformation Methodology — OGC-compliant RDF knowledge graph
HOT 82 P1
Agency: Dept. of Primary Industries and Regional Development · Ref: P_2621791 · Closes: 19-Nov-2026 · Value: Not disclosed (methodology engagement, est. $400K–$1.2M)
IN MARKET · 20 days · Public Sector / Resources & Environment
Signal — Verbatim scope, captured this run: 'Develop an OGC-compliant RDF knowledge graph architecture for GSNSW to enable AI readiness, semantic geoscience data modelling, interoperability, and future AI/ML-ready data platforms.' Decision 01-Feb-2027. Restricted to Advanced SCM0020 Category M. Explicitly excludes property graphs, agentic AI and GenAI/LLM work — so this is a semantic-modelling engagement, not an AI build.
A methodology-and-architecture engagement to make a 130-year-old geoscience archive machine-readable. The exclusion of GenAI and property graphs is unusual and deliberate: DPIRD wants defensible ontology work, not vendor experimentation. Requires Advanced Category M on SCM0020 — verify eligibility before committing bid effort.
Data & AnalyticsAI/MLPlatforms
Vivanti Angle
This is a pure Vivanti-pillar play: Data & Analytics plus AI-readiness groundwork, with no product licence to compete against. Position semantic data modelling as the precondition for the AI platform DPIRD will buy next — and offer a fixed-fee methodology phase with the option on implementation. The exclusion clause is an advantage: it keeps the big SIs, who want to sell a platform, out of the room.
Partner to position: Databricks or Google Cloud (downstream lakehouse that consumes the RDF layer); no agentic tooling given the exclusion · Owner: Data & AI Practice Lead
Joint Select Committee on AI — full report due 30 November 2026
HOT 80 P1
Agency: Parliament of Australia (bipartisan, both Houses) · Ref: JSC-30NOV · Closes: 30-Nov-2026 · Value: Policy — shapes 2027 legislation and federal AI procurement rules
IN MARKET · 31 days · Public Sector / Federal
Signal — Early advice to the PM on 12-Oct-2026 recommended a risk-based framework, mandatory incident reporting, data sovereignty rules, literacy and skills programs, and procurement reform — including 'strong pro-Australian government procurement guidelines' and a register of sovereign AI companies (thresholds still unpublished). Full report lands in 31 days and will inform bills expected in early 2027.
Fourteen terms of reference including adequacy of existing law, Commonwealth AI adoption, workforce impacts, copyright, deepfakes and children's safety, and regulator capacity. Submissions closed 14-Sep-2026. Running in parallel: the Senate Environment and Communications References Committee inquiry into AI and data centres reports 16-Nov-2026.
AI/MLDigitalData & Analytics
Vivanti Angle
This is the one signal that turns Vivanti's foreign-owned partner stack from a liability into a differentiator — but only if positioned now, before the register thresholds are written. Build the 'Australian-owned delivery, global-grade platforms' narrative into every federal pitch this quarter. Offer a fixed-fee Sovereign AI Readiness Assessment that pre-positions an agency for whatever procurement guidelines the report produces.
Partner to position: Lead with Australian-owned delivery; name Google Cloud, Databricks, Snowflake, Anthropic as the platform layer — do not let the partner brand lead the slide · Owner: Federal Practice Lead
SourceView sourcewww.aph.gov.au/Parliamentary_Business/Committees/Joint/Artificial_Intell... Identity and Access Management Platform — Sydney Opera House
HOT 78 P1
Agency: Sydney Opera House · Ref: SOH-C1545 · Closes: 17-Nov-2026 · Value: Not disclosed (enterprise IAM platform + prime contractor, est. $3M–$8M)
IN MARKET · 18 days · Public Sector / Arts & Culture
Signal — Seeks a single accountable prime contractor, or clearly governed consortium, for an enterprise cloud IAM and identity-governance platform. Migration from SailPoint IdentityIQ, with Entra ID and Oracle HCM integration, and — the detail that matters — an explicit non-human identity roadmap clause. That clause is where agentic AI meets identity governance.
Carried from last week, still open, 18 days out. Tags span cloud products, data privacy and security, infrastructure and network, managed and outsourced services, monitoring and security, software licensing, and solution design. The non-human identity requirement is the forward-looking part: service accounts, workloads and AI agents all need identities, and almost no NSW agency has a plan for it.
PlatformsData & AnalyticsDigital
Vivanti Angle
Non-human identity is the seam. Every agency about to deploy agents will discover it has no inventory of machine identities, no lifecycle policy and no revocation path — which is exactly the agent-containment problem the ASD says cannot be patched, only managed. Bundle an agent-identity governance assessment with any IAM bid.
Partner to position: Microsoft Entra (integration target); Anthropic and OpenAI (agent identity and containment evidence) · Owner: Platforms Practice Lead
DTA sovereignty register still excludes Google Cloud — while Health spends $32.8M on GCP
HOT 78 P1
Agency: DTA / Dept. of Health, Disability and Ageing · Ref: SOV-CLOUD · Closes: 31-Dec-2026 · Value: $32.8M disclosed GCP spend (incl. $13M new contracts); register governs WoG panels
IN MARKET · 62 days · Public Sector / Federal + Health
Signal — Eighth consecutive week Google Cloud is absent from the six-provider whole-of-government list (AWS, Microsoft, IBM, Oracle, SAP, Rimini Street). Simultaneously, Health has grown GCP spend to $32.8M with $13M in new contracts signed recently — routed through Accenture ($17.1M), NTT ($9.7M as GCP reseller) and Deloitte ($2.6M). The register shapes panel friction, not agency spending.
The five sovereignty tests are foreign legal reach, operational control, decision-making authority, jurisdictional control, and transparency over day-to-day operators. Physical residency in Sydney or Melbourne does not satisfy them — the test targets offshore compulsion regardless of server location. GCP holds IRAP PROTECTED certification and two Australian regions; it simply has no pre-negotiated panel-wide contract. The reseller workaround (route consumption through a panel-holding SI) is the standard mechanism, not a loophole.
PlatformsData & AnalyticsAI/ML
Vivanti Angle
Two products in one signal. First, a Sovereignty Position Assessment for agencies holding non-listed cloud workloads — quantify the exposure, document the direct-contract justification, declare the GCP conflict up front. Second, the Health pattern is the template: Accenture takes more than half of disclosed program spend as systems integrator. Vivanti competes for that integrator line, not the cloud line.
Partner to position: Google Cloud (declare the conflict explicitly — credibility depends on it); Accenture-adjacent positioning as the independent assurance layer · Owner: Platforms Practice Lead
SourceView sourcetech-insider.org/au/health-google-cloud-32-8-million-dta-snub-2026/ Linen Management Solution (LMS) Stage 1 — statewide eHealth NSW
HOT 76 P1
Agency: eHealth NSW / HealthShare NSW · Ref: HT260040 · Closes: 20-Nov-2026 · Value: Not disclosed (statewide solution, est. $5M–$15M over 5 years)
IN MARKET · 21 days · Health
Signal — BRAND NEW — published 26-Oct-2026, amended 29-Oct. Two-stage procurement: this open EOI is market discovery and will NOT result in an award; Stage 2 is a limited RFP to shortlisted respondents only. Decision 01-Feb-2027, completion 30-Jun-2027. Getting shortlisted is the entire game — there is no second chance to enter.
Scope: customer billing, order management, cost accounting, inventory management, master catalogue management, linen service operations, operational reporting, and secure API-enabled integration with NSW Health enterprise systems. Complementary but non-core: asset tracking, RFID, advanced analytics, CRM. Real-time data, visibility of linen movement and inventory, standardised processes, evidence-based decision-making and demand planning. SCM0020 mandatory.
Data & AnalyticsPlatformsDigitalCustomer
Vivanti Angle
The stated core is transactional — billing, orders, inventory. The stated ambition is analytical — demand planning and evidence-based decisions. Almost every LMS vendor will answer the transactional half and hand-wave the analytical half. Lead with the analytics and integration architecture: a demand-planning model over linen movement data, plus the API layer into NSW Health enterprise systems. That is the differentiator in a shortlist-only process.
Partner to position: Databricks or Snowflake (demand planning and inventory analytics); Google Cloud for the API/integration layer · Owner: Health Practice Lead
TenderView tender pagebuy.nsw.gov.au/prcOpportunity/3D877ECE-8EC6-4560-A785797ED3F1DA42 Visitor Attraction Commerce Platform — Taronga Conservation Society
HOT 74 P1
Agency: Taronga Conservation Society Australia · Ref: C2026.017 · Closes: 09-Nov-2026 · Value: Not disclosed (~2M annual guests; commerce platform, est. $2M–$6M)
CLOSING THIS FORTNIGHT · 10 days · Public Sector / Tourism
Signal — Ten days out and the most complete document set on the platform — AS-IS architecture and journey maps already published, which means the requirement is unusually well understood and the evaluation will be sharp. ~2M annual guests. Decision 01-Mar-2027.
Carried from prior weeks, still open. A commerce platform for ticketing, membership and visitor experience across two sites. Because the AS-IS pack is complete, bidders cannot differentiate on discovery — they must differentiate on the data and personalisation layer that turns 2M annual transactions into a visitor profile.
CustomerDigitalPlatformsData & Analytics
Vivanti Angle
Position the customer data platform and personalisation layer rather than the commerce engine. Taronga has 2M guests a year and almost certainly no unified visitor identity across ticketing, membership and retail. Sell the identity-resolution and segmentation work that makes the commerce platform worth buying — and note that this is a Customer pillar play, the rarest in the NSW portfolio.
Partner to position: Snowflake or Databricks (visitor data platform); Google Cloud (personalisation services) · Owner: Customer Practice Lead
Rapid Patient Experience Survey RFP — Hunter New England LHD
HOT 72 P0
Agency: eHealth NSW (Hunter New England LHD) · Ref: HT26041 · Closes: 06-Nov-2026 · Value: Not disclosed (PREM SaaS, est. $500K–$2M)
CLOSING THIS WEEK · 7 days · Health
Signal — CLOSING THIS WEEK — seven days. Deadline moved from 3-Nov to 6-Nov, a three-day extension that usually signals thin respondent numbers. Seeks a Patient Reported Experience Measures (PREM) SaaS solution: survey administration, qualitative feedback, automated reporting documents and dashboards.
A SaaS buy, so the licence is not the opportunity. The opportunity is the qualitative feedback analysis and the automated reporting layer — turning free-text patient commentary into something a LHD executive can act on. Cloud products and support subcategory. eHealth NSW runs very few open opportunities, so a short extension here is worth a same-week response.
CustomerData & AnalyticsAI/ML
Vivanti Angle
Bid the analytics, partner the survey engine. Free-text patient feedback at LHD scale is a natural language processing problem, and automated report generation is a GenAI summarisation problem with a hard accuracy bar. Offer a fixed-fee qualitative-analytics module alongside any SaaS respondent — and reference the ADM disclosure duty, because patient triage scoring is precisely the kind of decision that must be disclosed from 10 December.
Partner to position: Anthropic or OpenAI (safe summarisation with citation), Google Cloud (dashboards) · Owner: Health Practice Lead
TenderView tender pagebuy.nsw.gov.au/prcOpportunity/030DCEF3-DFDA-4E78-A1EEFAA034327755 TfNSW Point to Point Vehicle Monitoring Solution (P2P VMS) RFP
HOT 72 P1
Agency: Transport for NSW · Ref: WS5440384444 · Closes: 13-Nov-2026 · Value: Not disclosed (enforcement data platform, est. $4M–$10M)
CLOSING THIS FORTNIGHT · 14 days · Infrastructure / Transport
Signal — Fourteen days out — the last week to influence. Deadline has moved repeatedly (30-Oct then 13-Nov), which is a live-listing reminder: always trust the portal over prior-run notes. This is enforcement-data integrity at scale — point-to-point camera data feeding penalty notices, where a single integrity defect becomes a ministerial problem.
A monitoring solution for point-to-point vehicle speed enforcement, covering image capture, verification, evidence chain and notice generation. The regulatory exposure is acute: enforcement decisions that significantly affect individuals are automated decision-making under APP 1.7–1.9, disclosable from 10 December 2026, with penalties to $50M.
Data & AnalyticsAI/MLDigitalPlatforms
Vivanti Angle
Lead with evidence integrity and auditability, not camera hardware. Every enforcement notice is a decision that must survive challenge, and from 10 December TfNSW must publicly describe how automated steps contribute to it. Offer an evidence-chain audit and an ADM disclosure schedule as a bundled assurance workstream — a small, fast, high-margin scope attached to a large platform buy.
Partner to position: Databricks (evidence pipeline and lineage), Google Cloud (image processing at scale) · Owner: Infrastructure Practice Lead
NSW AI Assurance Framework — annual attestation to NSW GovAI (first due 31 Oct 2027)
HOT 72 P1
Agency: NSW Office for AI / Digital NSW (DCS-2026-02) · Ref: NSW-AIAF · Closes: 31-Oct-2027 · Value: Compliance — signed annual attestation, Accountable Official + Agency Head
IN MARKET · 366 days · Public Sector / NSW
Signal — The governance architecture is now complete and mandatory: AIAF Platform in force since 30-Sep-2026, DCS-2026-02 requiring a named Accountable Official notified to NSW GovAI, all AI use cases registered, GenAI automatically classified elevated risk, high and very-high risk cases going to the NSW AI Review Committee pre-deployment, and a signed annual attestation endorsed by the Accountable Official and approved by the Agency Head.
The attestation clock starts now even though the first signature is due 31-Oct-2027 — because the register must be populated and the assessments run before anyone can sign. An extension is available only with a time-bound remediation plan, which is itself an admission of non-readiness. Roughly 31% Essential Eight compliance across NSW agencies suggests the underlying evidence base is thin.
AI/MLData & AnalyticsDigital
Vivanti Angle
Sell 'attestation-ready by design': register population, risk tiering, review-committee submission packs, and an evidence file that survives an Agency Head's signature. The deadline being twelve months out is the sales advantage, not the obstacle — this is the rare programme an agency can start calmly and finish early. Land it now, renew it annually.
Partner to position: Anthropic and OpenAI (model-risk evidence for GenAI use cases); Databricks or Google Cloud (use-case register and lineage) · Owner: NSW Public Sector Lead
Geospatial Intelligence Platform EOI — NSW Police Force
HOT 70 P1
Agency: NSW Police Force · Ref: YR-2026-0065 · Closes: 17-Nov-2026 · Value: Not disclosed (market sounding; imagery + geospatial, est. $3M–$8M)
IN MARKET · 18 days ·
Signal — Pairs directly with YR-2026-0084 (Digital Adoption Platform) — NSWPF is running two technology market-soundings in the same fortnight, which signals a coordinated enterprise-systems transformation rather than isolated buys. Treat the two as one account campaign.
NSWPF is seeking information on contemporary aerial imagery and geospatial intelligence capabilities, delivery models, commercial arrangements and future innovation opportunities. Tags span engineering and technical, cloud products, data and analytics, software licensing. An EOI, so this is requirements-shaping rather than a priced bid.
Vivanti Angle
Geospatial intelligence is an imagery-plus-model-assurance problem: capture, store, classify, and then defend the classification when it informs an operational decision. Position model assurance and provenance for the computer-vision layer, not the imagery supply. If you win the DAP conversation first, this becomes an extension of the same transformation narrative.
Partner to position: Google Cloud (geospatial and imagery services), Databricks (feature and model pipelines) · Owner: Justice & Policing Lead
TGA clinical decision support exemption amendment commences 1 November 2026
HOT 70 P0
Agency: Therapeutic Goods Administration · Ref: TGA-CDS · Closes: 01-Nov-2026 · Value: Regulatory — medical device classification exposure for clinical AI
CLOSING THIS WEEK · 2 days · Health
Signal — Commences in two days. The TGA amended the clinical decision support system exemption on 8-Sep-2026 to clarify when software is exempt from medical-device regulation. Directly continuous with the TGA digital scribe review published 16-Oct-2026, which found eight of twelve reviewed AI scribe products likely meet the medical-device definition — and zero suppliers had classified their product as one.
Affects developers and suppliers of clinical decision support software, including AI-enabled tools used by health practitioners. Action required: confirm the product still qualifies for the exemption. TGA has begun targeted risk-based compliance activity. NSW Health's $38.7M AI scribe programme for ~6,000 clinicians sits directly in scope.
AI/MLData & AnalyticsDigital
Vivanti Angle
The highest-conviction new revenue line of the last two runs, now with a hard commencement date. Sell a fixed-fee clinical AI assurance review: device-classification determination, exemption-evidence file, and a deployment-readiness opinion a health service can put in front of its clinical governance committee. Target both the health services procuring scribes and the scribe vendors themselves — the vendors have the more urgent problem.
Partner to position: Anthropic and OpenAI (model behaviour and output-safety evidence for clinical tools) · Owner: Health Practice Lead
SourceView sourcewww.responsibleaiaustralia.com.au/deadlines Office of AI established in PM&C — Australian Standards for AI bill expected end-2026
HOT 68 P2
Agency: Dept. of the Prime Minister and Cabinet / Office of AI · Ref: OFFICE-AI · Closes: 31-Dec-2026 · Value: Policy — national AI framework; legislation expected early 2027
IN MARKET · 62 days · Public Sector / Federal
Signal — The Office of AI was established inside PM&C effective 15-Jul-2026 to coordinate AI policy and consolidate work scattered across government — the PM's framing was that AI 'touches on the work of every minister and department' and the response had been issue-by-issue. A bill to legislate Australian Standards for AI is expected to be introduced by end-2026 and legislated in early 2027.
National Cabinet endorsed mandatory national data-centre standards on 26-Aug-2026 (power, water, land use, skills), with infrastructure consultation closing 9-Oct-2026. The standards are announced but not legislated — no bill has been tabled, so nothing in the standards package is a current legal obligation. Do not over-read scope: obligations on ordinary AI deployers remain unresolved until the 30-Nov report.
AI/MLDigitalData & Analytics
Vivanti Angle
Sell preparation, not compliance — and be scrupulous about saying which is which. A 'standards readiness' briefing that maps an agency's current posture against the six strands feeding the proposals is genuinely useful and legally safe. The credibility risk is over-claiming that the standards are law; naming that explicitly in the pitch builds trust and differentiates from vendors selling fear.
Partner to position: Vendor-neutral positioning; reference the AI Safety Institute's published research for credibility · Owner: Federal Practice Lead
Enterprise Desk Booking and Space Management System — DCS
HOT 64 P1
Agency: NSW Department of Customer Service · Ref: PAC-7419 · Closes: 06-Nov-2026 · Value: Not disclosed (est. $500K–$1.5M)
CLOSING THIS WEEK · 7 days · Public Sector / NSW
Signal — CLOSING THIS WEEK — seven days. A departmental workplace platform, small in value but inside DCS, which is the agency that owns NSW ICT procurement policy and the AIAF platform. A delivery here is a reference site inside the buyer.
Enterprise desk booking and space management for a hybrid workforce. Carried from last week, still open. The strategic value is disproportionate to the contract value: DCS sets the rules every other NSW agency follows.
DigitalPlatformsData & Analytics
Vivanti Angle
Bid for the reference, not the margin. Position occupancy analytics — space utilisation data that justifies property decisions — rather than the booking calendar, which is a commodity. Winning inside DCS gives Vivanti a credible internal advocate for the AIAF and assurance workstreams.
Partner to position: Google Cloud (workspace integration), Databricks (occupancy analytics) · Owner: NSW Public Sector Lead
Digital Platform and Services for RailSafe / Digital Protection Officer Workbook
HOT 62 P2
Agency: Sydney Trains · Ref: WS5761160158 · Closes: 23-Nov-2026 · Value: Not disclosed (est. $2M–$5M)
IN MARKET · 24 days · Infrastructure / Transport
Signal — Deadline moved from 20-Nov to 23-Nov. Two-stage EOI then RFx, with Ariba gating. Advanced SCM0020 categories M02/M04/N02/R01 required by Stage 2. A safety-critical operational platform across a network with more than 8,000 assets.
Digital platform supporting RailSafe and the Digital Protection Officer Workbook — safety workflow, worker protection and evidence of compliance. Documents gated behind Ariba via tss.bidder@transport.nsw.gov.au. Carried and extended.
DigitalPlatformsData & Analytics
Vivanti Angle
Safety-critical workflow plus evidence generation is the angle: a protection officer's workbook is an assurance artefact, and digitising it turns paper compliance into queryable evidence. Position auditability and safety-analytics, not form-filling. Confirm Ariba and Advanced SCM0020 eligibility before investing in a response.
Partner to position: Google Cloud or Databricks (safety analytics) · Owner: Infrastructure Practice Lead
Federal ICT demand has rotated back to build — Development +18, Data +13 in 30 days
HOT 62 P1
Agency: itcontractors.com.au federal market snapshot (30-Oct-2026) · Ref: ITCONTRACTORS · Closes: 30-Nov-2026 · Value: 117 open roles / 25 departments; 76 need Baseline, 36 NV1, 1 PV
IN MARKET · 31 days · Public Sector / Federal
Signal — A reversal of the last four weeks' signal. Development has jumped +18 to 38 roles (largest single-category count) and Data is +13 to 27, while the assurance-oriented categories that led through October are cooling — Analysis -2 to 16, Testing -4 to 3, Cloud -3 to 4, Change & Transformation -3 to 5. Services Australia alone holds 34 roles; NDIA 20; Health and Ageing 10; AEC 8.
Delivery states: ACT 101, VIC 81, QLD 77, NSW 68, SA 49 (roles can span states, so counts exceed the 117 total). Services Australia holds 13 of the 38 Development roles — 34% of the category in one agency. The build→assure rotation that defined October is not reversed, but the build side has re-accelerated sharply.
Data & AnalyticsAI/MLPlatformsDigital
Vivanti Angle
Read this as a demand-shape correction, not a strategy reversal: the assurance market opened in October is still live and legally mandated, but the delivery bench must be staffed again. For Vivanti the implication is sequencing — lead the assurance conversation (differentiated, high-margin, deadline-driven) and let delivery follow. Do not let a hot development market pull the firm back into body-shopping.
Partner to position: Neutral — this is a demand-shape signal, not a partner play · Owner: Federal Practice Lead
SourceView sourcewww.itcontractors.com.au/market-intelligence Migration of HR and Payroll Data to TechnologyOne CiA — Wingecarribee Shire Council
HOT 60 P1
Agency: Wingecarribee Shire Council · Ref: Q-2026-59 · Closes: 10-Nov-2026 · Value: Not disclosed (data migration specialists, est. $150K–$400K)
CLOSING THIS FORTNIGHT · 11 days · Public Sector / Local Government
Signal — Eleven days out. Council seeks appropriately qualified and experienced data migration specialists — a narrow, well-defined scope with a clear deliverable. Small value but an unusually clean entry point: data migration is where Vivanti's Data & Analytics pillar is most directly provable.
Migration of HR and payroll data into TechnologyOne CiA. Payroll data migration carries an acute accuracy obligation — a single mapping defect becomes an underpayment, and underpayment becomes a wage-theft finding. That risk is the sales lever.
Data & AnalyticsPlatformsDigital
Vivanti Angle
Sell migration assurance, not migration labour: pre-migration data quality assessment, reconciliation framework, and a post-migration parallel-run verification. Council payroll migrations fail on reconciliation, not on ETL. Offer a fixed-fee assurance wrap around whichever migration specialist is engaged — that positioning works on this tender and on the next twenty like it.
Partner to position: Databricks or Snowflake (reconciliation and parallel-run analytics) · Owner: Local Government Lead
Senate inquiry into AI and data centres reports 16 November 2026
HOT 58 P2
Agency: Senate Environment and Communications References Committee · Ref: SENATE-DC · Closes: 16-Nov-2026 · Value: Policy — informs data-centre standards and AI infrastructure rules
IN MARKET · 17 days · Public Sector / Federal
Signal — Referred 13-May-2026, submissions closed 1-Sep-2026, reports in 17 days. Runs in parallel to the Office of AI's infrastructure standards work and provides the evidentiary base for the Australian Standards for AI. Affects data-centre operators and energy and water users.
Context worth carrying into client conversations: the PM&C consultation paper on AI infrastructure closed 9-Oct-2026 and quantified roughly $150B of projected data-centre investment by 2030, with NEM data-centre power rising from 5 TWh (2025-26) to 34 TWh (2035-36) and Sydney Water estimating data centres could take up to 20% of Sydney drinking water by 2035.
AI/MLPlatformsData & Analytics
Vivanti Angle
Data-centre siting and utility load is becoming an enterprise data-architecture question: where a workload runs now has an energy, water and social-licence consequence. Position sustainable-workload placement and sovereign-architecture advisory for agencies with heavy analytics estates. Low urgency this week, high salience by Q1 2027.
Partner to position: Google Cloud and AWS (region and sustainability reporting); Microsoft Azure · Owner: Platforms Practice Lead
Competitive position — Big Four federal share down 36% YoY while consultancy notices hit $780M
HOT 58 P1
Agency: awardedtenders.au / AusTender analysis · Ref: COMPETE-FY26 · Closes: 30-Nov-2026 · Value: $415M Big Four + Scyne FY26 YTD; $780M federal consultancy notices; $122.2B expiring
IN MARKET · 31 days · Public Sector / Federal
Signal — Big Four plus Scyne federal FY26 YTD combined $415M across 477 contracts, down 36% year on year — KPMG $149M (36%), Deloitte $141M (34%), EY $103M (25%), Scyne $21M (5%). Critically for Vivanti: Computer Services is only about 8% of the Big Four federal mix against 43% Management Support. They are structurally weak in the technology-delivery categories Vivanti competes in.
Federal consultancy notices FY26 total $780M across 3,592 flagged notices — just 0.67% of notified value. Labour hire rose 51% to $3.52B while APS vacancy notices fell 35%, which is the substitution story: work is being bought as labour, not as advice. $122.2B across 36,341 contracts expires between 1-Oct-2026 and 30-Sep-2027, median contract value $222,607 — precisely Vivanti's deal size, with 54.7% panel-sourced and 41.3% carrying extension options.
Data & AnalyticsAI/MLDigital
Vivanti Angle
The competitive read is unusually favourable and should be stated plainly in pitches: the incumbents are strong in advice and weak in delivery, and the 12-month expiring pipeline is concentrated at a median contract value that matches Vivanti's sweet spot. Build a renewal-calendar campaign around the AUC-2027 expiries and lead with delivery evidence, not credentials.
Partner to position: Neutral — competitive intelligence · Owner: Federal Practice Lead
Cloudflare Web Application Firewall and related services — DCS
HOT 56 P2
Agency: NSW Department of Customer Service · Ref: PSG9903 · Closes: 09-Nov-2026 · Value: Not disclosed (est. $300K–$1M)
CLOSING THIS FORTNIGHT · 10 days · Public Sector / NSW
Signal — Ten days out. A named-product procurement — Cloudflare WAF — which means the product decision is already made and the competition is for implementation, configuration and managed service. Narrow, winnable, and again inside DCS.
Cloudflare WAF and related Cloudflare services for the Department of Customer Service. Because the vendor is named, there is no platform battle to fight; the evaluation will turn on delivery capability and price.
PlatformsData & Analytics
Vivanti Angle
Position implementation and rule-tuning plus security analytics — WAF event data is a security-intelligence asset almost nobody operationalises. Small engagement, but a second foothold inside DCS alongside PAC/7419.
Partner to position: Cloudflare-aligned delivery; Google Cloud for log analytics · Owner: NSW Public Sector Lead
AI Safety Institute / CSIRO — epistemic safety in scalable oversight
WARM 52 P2
Agency: Dept. of Industry, Science and Resources (Australian AI Safety Institute) · Ref: AISI-OVERSIGHT · Closes: 31-Dec-2026 · Value: Research — advisory, feeds national AI capability narrative
IN MARKET · 62 days · Public Sector / Federal
Signal — Published 8-Oct-2026. CSIRO research commissioned by the Australian AI Safety Institute on scalable oversight — how an overseer can reliably evaluate and guide AI behaviour as systems become more capable. Introduces a framework and practical benchmarks for whether an overseen system is producing correct responses, and what other unintended influences its responses might carry.
Contributes to international research under the UK AI Security Institute's Alignment Project and supports the National AI Plan. The concept — epistemic safety, meaning a system can influence an overseer's beliefs while still performing the task correctly — is the technical underpinning of every assurance argument Vivanti will make about agent oversight.
AI/MLData & Analytics
Vivanti Angle
Use as intellectual authority, not as a lead. Citing the AISI/CSIRO framework in assurance proposals signals genuine technical grounding and separates Vivanti from vendors selling generic AI governance. Cite it specifically in the agent-oversight and evaluation-harness components of the Agentic AI Exposure offering.
Partner to position: Anthropic and OpenAI (evaluation harnesses); reference CSIRO framework · Owner: AI Assurance Lead
Prequalification Scheme: ICT Services (SCM0020) — gateway, open to 28 Feb 2029
WARM 52 P0
Agency: NSW Department of Customer Service · Ref: SCM0020 · Closes: 28-Feb-2029 · Value: Gateway — mandatory for all NSW ICT procurement above $250K
IN MARKET · 852 days · Public Sector / NSW
Signal — Mandatory for every NSW ICT engagement above $250K, and referenced as a hard mandatory requirement on at least seven live leads this week — YR-2026-0084, HT260040, P_2621791 (Advanced Category M), WS5761160158 (Advanced M02/M04/N02/R01), SOH-C1545 and others. Missing a category is not a scoring penalty; it is disqualification.
A panel membership is an eligibility gate, not an opportunity — but it carries the same urgency as a priced bid because a missing category cannot be remedied after a tender closes. Advanced categories in particular require evidence of prior delivery.
PlatformsData & AnalyticsDigital
Vivanti Angle
Audit Vivanti's SCM0020 categories against the live pipeline this week and remediate gaps before the November cluster closes. Specifically confirm Advanced Category M (P_2621791) and Advanced M02/M04/N02/R01 (WS5761160158) — if either is missing, those two leads are unwinnable regardless of merit.
Partner to position: Internal — bid operations · Owner: Bid & Compliance Manager
Mobile Broadband Augmentation Trial (MBAT) — NSW Telco Authority
WARM 48 P2
Agency: NSW Telco Authority · Ref: RFT-2017869 · Closes: 16-Nov-2026 · Value: Not disclosed (trial, est. $1M–$3M)
IN MARKET · 17 days · Public Sector / Emergency Services
Signal — Deadline moved from 9-Nov to 16-Nov. Evaluates deployable and resilient 4G/5G broadband for public safety use, including operation over a shared mobile network. A trial, so the value is in the follow-on, not the trial itself.
Emergency-services communications resilience. Tagged information and technology under the SCM0053 telecommunications scheme. Low direct Vivanti fit — this is network engineering, not data or AI — but the trial's evaluation data platform is an adjacent opportunity.
PlatformsDigital
Vivanti Angle
Low priority. Only pursue if a partner needs trial-evaluation analytics. Do not lead with Vivanti brand here — it dilutes the assurance positioning.
Partner to position: Telecommunications partners via SCM0053 · Owner: Infrastructure Practice Lead
Digital Mapping and Route Allocation for Waste Collection Trucks — Canterbury-Bankstown
WARM 46 P2
Agency: Canterbury-Bankstown Council · Ref: T12-27 · Closes: 03-Nov-2026 · Value: Not disclosed (est. $200K–$600K)
CLOSING THIS WEEK · 4 days · Public Sector / Local Government
Signal — CLOSING THIS WEEK — four days, the most urgent live date on the platform. Council RFT for digital mapping and route allocation across a waste collection fleet. Carried for several weeks without closing, which suggests either a quiet extension or thin interest.
Route optimisation for waste collection — a genuine geospatial optimisation problem, but a small contract with a long sales cycle relative to value. At four days out, only pursue if a response already exists.
Data & AnalyticsDigital
Vivanti Angle
Do not start now. Log it as a reference case for the local-government route-optimisation offering and watch for the award notice.
Partner to position: Google Cloud (geospatial) · Owner: Local Government Lead
Safety Software System — Canterbury-Bankstown Council
WARM 40 P2
Agency: Canterbury-Bankstown Council · Ref: T08-27 · Closes: 17-Nov-2026 · Value: Not disclosed (est. $150K–$500K)
IN MARKET · 18 days · Public Sector / Local Government
Signal — BRAND NEW this run. A council safety software system — WHS and incident management. Second simultaneous technology procurement from Canterbury-Bankstown alongside T12-27, which suggests a broader local-government systems refresh.
Safety and incident management software for a large Sydney council. Little scope detail published; the value is modest and the fit is peripheral to Vivanti's five pillars.
DigitalData & Analytics
Vivanti Angle
Monitor only. If Canterbury-Bankstown runs a third or fourth technology tender this quarter, treat the council as an account and pitch a consolidated data and integration architecture rather than bidding each system separately.
Partner to position: None specific · Owner: Local Government Lead
Operational Telecommunications Equipment, Infrastructure and Services (SCM0053)
WARM 38 P2
Agency: NSW Telco Authority · Ref: SCM0053 · Closes: 30-Apr-2027 · Value: Gateway — telecommunications scheme
IN MARKET · 182 days · Public Sector / Emergency Services
Signal — Telecommunications scheme, open to 30-Apr-2027. Relevant only as an eligibility gate for public-safety communications work such as MBAT (RFT-2017869).
Covers operational telecommunications equipment, infrastructure and services across NSW Government.
Platforms
Vivanti Angle
Check membership only if pursuing MBAT or adjacent telco work. Not a Vivanti-aligned pillar.
Partner to position: Telecommunications partners · Owner: Bid & Compliance Manager
Bundle 29 Workshop ICT Panel for the AMRF — Bradfield Development Authority
WARM 36 P2
Agency: Bradfield Development Authority · Ref: WPCA-AMRF · Closes: 30-Aug-2027 · Value: Panel — Western Sydney Aerotropolis advanced manufacturing hub
IN MARKET · 304 days · Infrastructure / Advanced Manufacturing
Signal — A long-dated panel for ICT fit-out of the Advanced Manufacturing Research Facility at Bradfield. Low urgency, but panels are eligibility gates and AMRF is a flagship NSW advanced-manufacturing investment.
Workshop ICT panel under Bundle 29 for the AMRF. Open until 30-Aug-2027.
PlatformsData & AnalyticsDigital
Vivanti Angle
Register interest and revisit in Q1 2027. The AMRF industrial-data and digital-twin opportunity will be larger than the workshop ICT scope suggests.
Partner to position: Google Cloud, Databricks (industrial data platform) · Owner: Infrastructure Practice Lead
Digital Experience Platform RFP — icare (stale listing; watch for retender)
COLD 24 P2
Agency: Insurance and Care NSW (icare) · Ref: RFP-2000217 · Closes: 12-Aug-2024 · Value: Historic — DXP implementation, delivery expected mid-2025
CLOSING TODAY · closed 809 days ago · Insurance
Signal — STALE-LISTING CATCH. This opportunity still renders as reachable on buy.nsw but published 03-Jul-2024, closed 12-Aug-2024, with a completion date of 10-Jun-2025 — all in the past. Do not treat as live. Scored COLD and logged as a watch-for-retender only.
The scope remains instructive: a composable DXP with integrated CMS, search and personalisation, transitioning off the then-current platform, with a named Implementation Service Provider and an explicit requirement that the DXP reduce technical debt and scale for evolving needs. Evaluation weighting was 30% price / 70% non-price. SCM0020 mandatory and social-procurement reporting obligations attached.
CustomerDigitalPlatforms
Vivanti Angle
Reuse the specification, not the lead. icare has been assembling a unified digital estate across multiple procurements (DMS, DXP, Informatica). The 70/30 non-price weighting and the composability language are a ready-made template for any insurance-sector DXP conversation — and icare is a repeat buyer worth an account plan.
Partner to position: Snowflake or Databricks (customer data platform), Google Cloud (personalisation) · Owner: Insurance Lead
TenderView tender pagebuy.nsw.gov.au/prcOpportunity/CD903527-7905-414A-AC044F36EC5AE2D9 3. Competitive Landscape Analysis
Who is winning what, and where the incumbents are structurally exposed.
3.1 Big Four and Scyne — federal FY26 to date
| Firm | Federal value (FY26 YTD) | Share | Read |
|---|
| KPMG | $149M | 36% | Still the largest despite the March 2026 scandal. Annualised measures show Commonwealth awards nearly doubling to $59M in 2025-26. |
| Deloitte | $141M | 34% | Grew share on transformation programmes; also the delivery support line on Health's GCP programme at $2.6M. |
| EY | $103M | 25% | Steady. Strongest in risk and regulatory work, which is where the assurance demand is heading. |
| Scyne Advisory | $21M | 5% | The former PwC public sector practice. Rebuilding; +64.7% growth off a low base. |
| Combined | $415M | 477 contracts | Down 36% year on year. |
The structural exposure — Computer Services is only about 8% of the Big Four federal mix against 43% Management Support. The incumbents are paid overwhelmingly for advice, not for building or assuring technology. That is the gap Vivanti occupies, and it should be stated plainly in every federal pitch rather than softened.
3.2 The expiring-contract pipeline — where the next 12 months of revenue sits
| Metric | Value | Implication for Vivanti |
|---|
| Federal contracts expiring 1-Oct-2026 → 30-Sep-2027 | $122.2B / 36,341 | The renewal calendar is the pipeline |
| Median contract value | $222,607 | Precisely Vivanti's deal size — this is the sweet spot, not the exception |
| Panel-sourced | 54.7% | SCM0020-equivalent panel membership is a precondition, not an advantage |
| Carrying extension options | 41.3% | Roughly 41% may never come to market — target the 59% |
| Defence share | 54.2% ($66.2B) | Outside Vivanti's natural segment; do not chase the headline number |
| FY27 disclosures opened | $21.3B, −18.6% | Cycles are lengthening — expect slower awards, longer pursuit |
Caution on the total: half of the 31-Dec-2026 figure is a single Defence aircraft-support programme account ($17.3B, no ABN). Strip programme-account lines before quoting $122.2B to a client — the biddable remainder is far smaller and far more relevant.
3.3 Consultancy demand is being bought as labour, not advice
Consultancy notices
- $780M across 3,592 flagged notices in FY26
- Just 0.67% of total notified value
- Consultancy is a rounding error in federal spend, not a growth market
Labour hire substitution
- Labour hire +51% to $3.52B
- APS vacancy notices −35%
- Work is being bought as people, not outcomes — the arbitrage is outcomes-based pricing
AI procurement
- 109 federal notices named AI in FY26 (up from 40)
- +205% value to a $25.3M floor
- Floor only — AI bought inside broader licences is invisible to this measure
3.4 Cloud and cyber — the volume picture
| Category (FY26) | Value | Movement | Read |
|---|
| Cloud services | $983M | +455% | 304 contracts. AWS leads direct hyperscaler spend at $241M; Data#3 is the largest reseller at $555M. |
| Cyber security | $99M | −47% | 209 contracts. Defence the largest buyer — the decline is a mix effect, not a softening. |
| Technology (CY2025) | $22.1B | 18,979 contracts | $27B of technology contracts expire across CY2026. |
Accenture threat assessment: $6.84B across 1,698 government engagements. On Health's GCP programme it holds $17.1M of $32.8M disclosed spend — more than half — as the systems integrator, while the cloud vendor itself takes roughly $150K. The lesson is unambiguous: the integrator line is larger than the platform line, and that is the line Vivanti contests.
Mid-tier validation: mid-tier firms won $2.89B across 3,435 federal contracts, with 52 firms clearing $10M and $5.3B of mid-tier consulting expiring within twelve months. Mantel Group remains the closest structural competitor (GCP Partner of the Year ANZ for a third year, Snowflake ANZ and APJ Services Growth Partner of the Year 2026, Databricks APJ Emerging Partner).
4. Strategic Procurement Opportunities — Mega Signals
The five structural forces that will determine what government buys between now and February.
4.1 The compliance clock is now the buying trigger — 10 December 2026
This is the sharpest signal of the run, and it is law, not a proposal. From 10 December 2026 — 41 days from this report — Australian Privacy Principles 1.7 to 1.9 require every APP entity's privacy policy to disclose the kinds of decisions made, or substantially shaped, by computer programs using personal information, and the kinds of personal information those programs use. Penalties for serious or repeated breaches reach the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover.
Three things make this commercially exceptional. First, the definition is deliberately broad: per the OAIC issues paper it covers pre-programmed rule-based processes as readily as machine learning, so a spreadsheet formula that scores and triages calls to a crisis hotline is caught while one that calculates someone's age is not. Legacy scoring tools do not escape because they are not 'AI'. Second, readiness is demonstrably poor: of 23 Commonwealth agencies authorised to use automated decision-making, only 17% (four) had disclosed it, 9% (two) were identifiable users with no disclosure at all, and 74% (17) could not be confirmed as using it from any public material whatsoever. Third, the obligation is narrow enough to be cheap and wide enough to be pervasive: there is no right to demand an explanation of a specific decision and no right to insist a human redo an assessment — only a duty to name, in general terms, what the systems do. That is a documentation problem with a fixed scope and a hard date, which is the best kind of consulting engagement.
Productised offering: ADM Inventory & Disclosure Pack — fixed fee, three weeks. Discover decision engines and rules-based scoring across business units (not just IT), classify against APP 1.7–1.9, draft the privacy policy schedule, and stand up an evidence file. Cross-sells directly into RFI-2018189 (licensing decisions), WS5440384444 (enforcement notices) and HT26041 (patient triage).
4.2 Federal AI Policy v2.1 — eight mandatory requirements by 15 December 2026
Eight requirements now bind every non-corporate Commonwealth entity, with Defence and the National Intelligence Community excepted: a named accountable official; a public transparency statement; an agency AI strategy; operationalised responsible-AI practice; per-use-case accountability; an internal use-case register shared with the DTA every six months; mandatory foundational staff training; and a pre-deployment impact assessment for each in-scope use case. Sitting beneath this are the ~200,000-public-servant training mandate and the GovAI platform (training, application catalogue and sandbox, with chat trials running since April 2026). The AI Impact Assessment Tool is free and purpose-built, which removes the excuse but not the workload — the binding constraint is per-use-case assessment at volume. Productised offering: a per-use-case register and impact-assessment sweep delivered in four weeks for 40 use cases, with the six-monthly DTA register-sharing obligation converting it into a recurring managed service.
4.3 The policy stack lands inside eight weeks — 16 Nov, 30 Nov, 10 Dec, end-2026
| Date | Event | Status | Commercial consequence |
|---|
| 01-Nov-2026 | TGA clinical decision support exemption amendment commences | In force | Clinical AI vendors must re-confirm exemption — urgent, this Sunday |
| 16-Nov-2026 | Senate inquiry into AI and data centres reports | Report due | Evidentiary base for data-centre standards |
| 30-Nov-2026 | Joint Select Committee on AI full report | Report due | Shapes 2027 bills; recommends sovereign-AI procurement preference |
| 10-Dec-2026 | Privacy Act ADM disclosure commences | Law | Hard legal deadline — the anchor of this quarter's selling |
| 15-Dec-2026 | Federal AI Policy v2.1 compliance | Mandatory | Eight requirements, every non-corporate entity |
| End-2026 | Australian Standards for AI bill introduced | Expected | Not yet law — say so explicitly |
| Early-2027 | Australian Standards for AI legislated | Expected | 2027 pipeline driver |
| 30-Apr-2027 | DTA responsible-AI policy staged obligation | Mandatory | Second wave of federal compliance |
| 31-Oct-2027 | NSW AIAF annual attestation, first signature | Mandatory | Agency Head must sign — evidence must pre-exist |
The strategic point: for the past two months the market story was that AI assurance was becoming a procurement precondition. That is now superseded. It has become a statutory obligation on a fixed date. Vivanti should stop describing assurance as advisory and start describing it as compliance with a deadline — one that is already legislated (ADM), one that is already mandatory (AI Policy v2.1) and one that is imminent (TGA).
4.4 Sovereign AI — the register is coming, and it inverts Vivanti's weakness
The Joint Select Committee's early advice to the PM on 12 October recommended 'strong pro-Australian government procurement guidelines' and a government-maintained register of sovereign AI companies, with thresholds still unpublished and the register expected by end-2026. The full report is due 30 November. Simultaneously the Office of AI, established in PM&C on 15 July 2026, is consolidating AI policy across government, with a bill to legislate Australian Standards for AI expected by end-2026. For the first time this is an opportunity rather than a threat: every Vivanti platform partner — Google, Databricks, Snowflake, OpenAI, Anthropic — is foreign-owned, but Vivanti is Australian. The differentiator is Australian-owned delivery on global-grade platforms, and it must be on the slide before the thresholds are written by someone else.
The countervailing reality — the DTA sovereignty register, now in its eighth week, still lists only AWS, Microsoft, IBM, Oracle, SAP and Rimini Street. Yet the Department of Health has grown Google Cloud spend to $32.8 million, including $13 million in new contracts, routed through Accenture ($17.1M), NTT as consumption reseller ($9.7M) and Deloitte ($2.6M). The register creates panel friction; it does not stop agency spending. A sovereignty position assessment — quantifying exposure, documenting the direct-contract justification, declaring the GCP conflict up front — is a sellable product for every agency holding non-listed cloud workloads.
4.5 NSW — the governance architecture is complete, and the evidence base is thin
The NSW AI Assurance Framework has been mandatory since 30 September 2026, and DCS-2026-02 requires a named Accountable Official notified to NSW GovAI, all AI use cases registered, GenAI automatically classified elevated risk, high and very-high risk cases reviewed by the NSW AI Review Committee pre-deployment, and a signed annual attestation to NSW GovAI by 31 October each year, endorsed by the Accountable Official and approved by the Agency Head — first due 31 October 2027, with an extension available only via a time-bound remediation plan. Against roughly 31% Essential Eight compliance across NSW agencies, the evidence base that would support an Agency Head's signature does not yet exist. Twelve months is the sales advantage, not the obstacle.
4.6 Health — a two-front assurance problem with a deadline attached
The TGA published its digital scribe review on 16 October following a survey of around 100 suppliers (40 responses, 12 products reviewed including Heidi, Lyrebird Health, Microsoft, Abby Health, Carepatron and iMedX). Eight of the twelve likely meet the medical-device definition, and zero suppliers had classified their product as one. The TGA states some may be supplied in breach of the Act and has begun targeted risk-based compliance activity. NSW Health is deploying $38.7 million of AI scribes to roughly 6,000 clinicians. On 1 November the amended clinical decision support exemption commences. Any organisation deploying clinical AI in NSW now has a classification question, a supplier-evidence question and a governance-sign-off question, all at once — and the suppliers have the more urgent version of all three.
5. Consulting Market Intelligence & Industry Movements
Leadership movements, demand shifts and partner-ecosystem intelligence.
Leadership & People
- Federal ICT bench re-accelerates: Development +18 to 38 roles, the largest category; Data +13 to 27. Services Australia alone holds 34 of 117 open roles.
- Assurance categories cool: Analysis −2, Testing −4 to 3, Cloud −3, Change & Transformation −3 to 5. The October assurance surge is not reversing, but the delivery bench is being rebuilt.
- Clearance mix: 76 roles need Baseline, 36 NV1, only 1 PV. Baseline unlocks 65% of the federal contract market.
- APS workforce: vacancy notices −35%, promotions −34%, median time from vacancy to promotion 162 days (up 29%). Hiring is slower and more senior.
Market Trends
- Compliance is the new demand driver. Three fixed dates (1 Nov, 10 Dec, 15 Dec) now generate more urgency than any technology narrative.
- Consultancy bought as labour: labour hire +51% to $3.52B while APS vacancies fall. Outcomes-based pricing is the arbitrage.
- Integrator beats platform: on Health's GCP programme the SI takes 52% of disclosed spend and the cloud vendor ~0.5%.
- AI procurement tripled — 109 federal notices, +205% value — but remains a $25.3M floor inside far larger licences.
- Cycles lengthening: FY27 disclosures opened −18.6%. Expect longer pursuits and more extensions (three deadline moves this week alone).
Partner Ecosystem
- Google Cloud: excluded from the DTA register for an eighth week, yet Health commits $32.8M. The reseller/ SI route is the standard workaround — and the reason a sovereignty assessment sells.
- Data#3: record ~$3B federal haul as largest cloud reseller ($555M); fuels Azure lock-in concerns in Canberra.
- Accenture: $6.84B / 1,698 government engagements; $17.1M on Health's GCP programme.
- Mantel Group: closest structural competitor — GCP Partner of the Year ANZ (3rd year), Snowflake ANZ + APJ Services Growth Partner 2026, Databricks APJ Emerging Partner.
- Anthropic: seeking to make Australia its second-largest training market, with investment linked to copyright settings.
6. Vertical Opportunities Map
Where the addressable demand sits, by segment, this week.
Public Sector — NSW (dominant)
- 20 live IT opportunities on buy.nsw against 184 platform-wide — flat week on week, but three brand-new leads published in the last four days.
- Two NSWPF market soundings in one fortnight (Digital Adoption Platform, Geospatial Intelligence) — treat as a single enterprise-transformation account campaign.
- eHealth NSW running two open items (Linen Management EOI, Patient Experience RFP) after months of near-zero flow — a reopening window.
- Seven live leads carry a mandatory SCM0020 requirement. Category gaps are disqualification, not deduction.
- DCS appears twice (desk booking, Cloudflare WAF) — the agency that writes the rules is buying.
Federal — compliance-led
- AI Policy v2.1 (15 Dec) is the single largest compliance workload in the market: eight requirements across every non-corporate entity.
- ADM disclosure (10 Dec) cuts across every federal agency with a decision engine — Services Australia, ATO, licensing regulators.
- 117 open ICT roles / 25 departments; baseline clearance unlocks 65%.
- $122.2B expiring to 30-Sep-2027 at a median $222,607 — the renewal calendar is the pipeline.
- JSC report (30 Nov) will recommend sovereign-AI procurement preference — position now.
Health
- Highest-conviction assurance market. TGA scribe review: 8 of 12 products likely medical devices, zero classified. $38.7M NSW deployment to ~6,000 clinicians.
- TGA CDS exemption commences 1 November — two days.
- eHealth Statewide Services buying linen management and patient-experience analytics simultaneously.
- Patient triage scoring is automated decision-making — disclosable from 10 December.
- Health is also the clearest Google Cloud beachhead ($32.8M) despite the DTA exclusion.
Infrastructure, Transport & Insurance
- TfNSW P2P VMS (13 Nov) — enforcement-data integrity plus ADM disclosure, a natural bundled assurance scope.
- Sydney Trains RailSafe DXP (23 Nov) — safety workflow as queryable evidence; Ariba and Advanced SCM0020 gating.
- Sydney Opera House IAM (17 Nov) — non-human identity roadmap is the agent-governance seam.
- Insurance: icare remains the anchor account (DMS, DXP, Informatica across three procurements) but has no live item this week; the DXP listing is stale from 2024. Watch for retender.
7. Weekly BDM Playbook — Action Queue
Eight prioritised plays. P0 means contact this week — two of the three P0 plays are governed by a date, not a sales cycle.
P0 · The 41-day compliance sprint — ADM disclosure
Why now: APP 1.7–1.9 commence 10 December 2026, 41 days out. Penalties to A$50M or 30% of turnover. OAIC found 74% of 23 authorised agencies could not be confirmed as using ADM from any public material. This is the only already-legislated AI-adjacent deadline in 2026.
Action: Contact every account with a decision engine in the next five business days. Offer a fixed-fee three-week ADM Inventory & Disclosure Pack. Open with the scoping question, not the product pitch: which of your decisions could significantly affect someone, and can you prove what produced them?
Leads: ADM-10DEC; cross-sells into RFI-2018189 (licensing), WS5440384444 (enforcement notices), HT26041 (patient triage)
Partner positioning: Anthropic and OpenAI for model-level governance evidence; Databricks or Google Cloud for decision lineage
Subject: 10 December — automated decision-making disclosure, 41 days out
Hi [Name],
From 10 December 2026, APP 1.7-1.9 require a privacy policy to disclose the kinds of decisions made or substantially shaped by computer programs using personal information. The OAIC's own review found that of 23 authorised Commonwealth agencies, only four had disclosed their use — and 17 could not be confirmed as using automated decision-making at all.
The obligation is narrower than most agencies assume: it is disclosure, not explainability. Which is what makes it achievable in three weeks rather than three quarters. We run a fixed-fee ADM Inventory & Disclosure Pack — discovery across business units, classification against 1.7-1.9, privacy-policy schedule, and an evidence file that stands up.
Worth 30 minutes this week to see whether [Agency] is exposed?
Regards,
[BDM name] | Vivanti
P0 · NSWPF enterprise transformation — two soundings, one account
Why now: NSW Police Force published a Digital Adoption Platform EOI on 28 October (SAP S/4HANA anchor, decision 15-Jan-2027) while running a Geospatial Intelligence EOI closing 17 November. Two market soundings in one fortnight means a coordinated enterprise systems transformation, not two isolated buys — and market-sounding stage means the commercial model is still negotiable.
Action: Build one NSWPF transformation narrative and put it in front of both contact points (Galit Kitchingman for DAP). For the DAP, pitch adoption analytics as a bundle: SAP S/4HANA programmes fail on adoption, not configuration. Skip the licence-only response — a DAP without an analytics spine cannot prove adoption.
Leads: YR-2026-0084; YR-2026-0065
Partner positioning: Google Cloud or Databricks for adoption telemetry; SAP-aligned DAP vendor for the product layer
Subject: NSWPF DAP — the adoption-measurement question before the 18 November close
Hi Galit,
We read the Digital Adoption Platform EOI with interest, particularly the intent to scale beyond the first application set. Two observations that may be useful at market-sounding stage, before the RFT fixes the commercial model.
First, on SAP S/4HANA programmes the failure mode is rarely configuration — it is adoption. A DAP tells you whether people are using the system; it does not tell you whether the business outcome moved. Second, licensing models that look cheapest at EOI stage tend to be priced per-seat at scale, which becomes a problem exactly when you scale across enterprise applications as intended.
We would propose an adoption-analytics layer alongside the platform, with an outcomes-linked commercial structure you can put in front of the funding committee. Could we send a two-page note ahead of the EOI close?
Regards,
[BDM name] | Vivanti
P0 · TGA clinical AI — the two-day deadline and the vendor side
Why now: The amended clinical decision support exemption commences 1 November. On 16 October the TGA found 8 of 12 reviewed AI scribe products likely meet the medical-device definition and zero suppliers had classified theirs as one; targeted compliance activity has begun. NSW Health is deploying $38.7M of scribes to ~6,000 clinicians.
Action: Two campaigns, one week. Target NSW Health and the LHDs as buyers needing a deployment-readiness opinion for clinical governance; target the scribe vendors (Heidi, Lyrebird, Abby, Carepatron, iMedX) as sellers needing a classification determination urgently. The vendors have the more acute problem and the faster decision cycle.
Leads: TGA-CDS; HT260040; HT26041
Partner positioning: Anthropic and OpenAI for output-safety and model-behaviour evidence
Subject: TGA scribe review — has your product been classified?
Hi [Name],
The TGA published its digital scribe review on 16 October. Of twelve products reviewed, eight likely meet the medical-device definition — and none of the suppliers had classified their product as one. The TGA has begun targeted risk-based compliance activity, and the amended clinical decision support exemption commences 1 November.
This is a classification problem with a short clock and a well-defined answer. We run a fixed-fee clinical AI assurance review: device-classification determination, exemption-evidence file, and a deployment-readiness opinion you can put in front of customers and their clinical governance committees.
Those customer committees are already asking. Worth a short call?
Regards,
[BDM name] | Vivanti
P1 · Liquor & Gaming — write the criteria before the RFT exists
Why now: RFI closes 20 November, decision 18 December, on a platform touching ~1.8M licences and ~5M historical records across 10+ schemes. Named shortlist already circulating: Salesforce Public Sector Solutions, Objective RegWorks, Pega. An RFI is the only stage at which a responder can shape the evaluation criteria.
Action: Do not bid as a platform. Bid as the independent migration-integrity, decision-audit and AI-assurance layer between the chosen COTS product and the regulator's obligation to explain a licensing decision. Join it explicitly to the 10 December ADM duty — 5M historical records and a legislated disclosure obligation is the same problem twice.
Leads: RFI-2018189; ADM-10DEC
Partner positioning: Salesforce if aligning to the likely winner; otherwise Databricks or Snowflake for migration integrity
Subject: Liquor & Gaming licensing platform RFI — the decision-evidence question
Hi [Name],
Ahead of the 20 November RFI close, one observation that may not arrive through the product respondents.
Whichever licensing platform you select, the regulator carries a standing obligation to explain how a licensing decision was reached — and from 10 December 2026, APP 1.7-1.9 require public disclosure of the kinds of decisions substantially shaped by automated steps. With roughly 5 million historical records migrating across 10 or more schemes, the decision-evidence trail is the part of the programme most likely to be discovered late and cost most to retrofit.
We would respond as the independent assurance layer between the platform and that obligation, not as a competing platform. Would a short briefing before you finalise the RFI scope be useful?
Regards,
[BDM name] | Vivanti
P1 · Federal AI Policy v2.1 — sell the volume economics
Why now: Eight mandatory requirements bind every non-corporate Commonwealth entity by 15 December 2026, including a pre-deployment impact assessment for every in-scope use case and an internal register shared with the DTA every six months. The tool is free; the workload at 40 to 200 use cases is not.
Action: Lead with the volume problem, not the policy. Offer a four-week per-use-case register and impact-assessment sweep covering 40 use cases. Land the six-monthly register-sharing obligation as the recurring managed-service hook so the engagement renews rather than closes.
Leads: AIPOL-15DEC; OFFICE-AI; SENATE-DC; JSC-30NOV
Partner positioning: Anthropic and OpenAI for use-case governance; LangChain or Vertex AI for harness implementation
Subject: AI Policy v2.1 — 46 days and a per-use-case assessment backlog
Hi [Name],
Policy v2.1 requires a pre-deployment impact assessment for every in-scope use case, plus an internal register shared with the DTA every six months, by 15 December.
The tool is free and well-built. The constraint is arithmetic: at 40 to 200 use cases, a consultant-week per assessment does not close before the date. We deliver the register and the assessment set in four weeks on a templated harness, with the six-monthly register-sharing obligation handled as a managed service rather than a fresh project each time.
Happy to run a free two-hour scoping session on your current use-case count so you can see whether the date is a problem.
Regards,
[BDM name] | Vivanti
P1 · SCM0020 category audit — do this before anything else this week
Why now: Seven live leads this week carry a mandatory SCM0020 requirement, two of them restricted to Advanced categories: P_2621791 requires Advanced Category M, and WS5761160158 requires Advanced M02/M04/N02/R01 by Stage 2. A missing category is disqualification, not a scoring penalty, and it cannot be remedied after close.
Action: Audit Vivanti's SCM0020 categories against this week's live pipeline today. If Advanced Category M or M02/M04/N02/R01 is missing, either remediate immediately or stand down from those two bids — bidding is wasted effort and damages credibility with the buyer.
Leads: SCM0020; P_2621791; WS5761160158; YR-2026-0084; HT260040; SOH-C1545; SCM0053
Partner positioning: Internal — bid and compliance
Subject: SCM0020 category gap check — two live bids at risk
Hi [Bid team],
Before we commit effort to the November cluster, confirm our SCM0020 category coverage.
Two live opportunities are category-restricted: P_2621791 (DPIRD Geological Survey data transformation) requires Advanced Category M, and WS5761160158 (Sydney Trains RailSafe) requires Advanced M02/M04/N02/R01 by Stage 2. Five further leads require base SCM0020 membership.
If either Advanced category is absent, we should stand down from those bids this week rather than at submission. Please confirm coverage by [date].
Regards,
[BDM name]
P1 · The expiring-contract calendar — build the renewal campaign
Why now: $122.2B across 36,341 federal contracts expires between 1 October 2026 and 30 September 2027, at a median contract value of $222,607 — precisely Vivanti's deal size. Big Four federal share is down 36% year on year and Computer Services is only 8% of their mix against 43% Management Support.
Action: Build a renewal-calendar campaign now, filtering out the 41.3% carrying extension options and the Defence programme accounts that dominate the headline total. Target the biddable mid-value remainder in Vivanti's categories, leading with delivery evidence rather than credentials — the incumbents are structurally weak precisely there.
Leads: COMPETE-FY26; ITCONTRACTORS
Partner positioning: Neutral — competitive positioning
Subject: Your [system] contract expires [date] — a delivery alternative
Hi [Name],
Your current arrangement for [scope] runs to [date]. Across the federal portfolio, roughly 41% of expiring contracts carry extension options — so the honest first question is whether this one will actually come to market.
If it does, the competitive picture is worth knowing: the large incumbents are down 36% year on year in federal work, and only about 8% of their federal mix is technology delivery against 43% management advisory. That is a structural gap, not a temporary one.
We would welcome 30 minutes to show delivery evidence in [specific capability] rather than credentials. Would [date] suit?
Regards,
[BDM name] | Vivanti
P2 · Sovereign positioning — get the narrative on the slide before the thresholds are written
Why now: The Joint Select Committee reports 30 November and has recommended a register of sovereign AI companies with 'strong pro-Australian government procurement guidelines'. Thresholds are unpublished. Google Cloud remains outside the DTA sovereignty panel for an eighth week while Health spends $32.8M on it via Accenture and NTT.
Action: Rewrite the standard federal pitch opening this quarter: Australian-owned delivery on global-grade platforms. Do not let the partner brand lead the slide. Offer a fixed-fee Sovereignty Position Assessment to any agency holding non-listed cloud workloads — quantify the exposure and declare the GCP conflict up front, because credibility depends on it.
Leads: JSC-30NOV; SOV-CLOUD; OFFICE-AI
Partner positioning: Google Cloud with the conflict declared explicitly; Australian-owned delivery as the differentiator
Subject: Sovereign AI procurement — what changes after 30 November
Hi [Name],
The Joint Select Committee reports on 30 November, and its early advice to the Prime Minister already recommends a register of sovereign AI companies and pro-Australian procurement guidelines. The thresholds are not published yet — which is precisely why the next few weeks matter.
There is also a live tension worth naming: Google Cloud has been outside the DTA's sovereignty panel for eight weeks, yet Health has committed $32.8 million to it through Accenture and NTT. The register creates panel friction; it does not end agency-level spending. Knowing where you sit against the five sovereignty tests is now a procurement question, not an academic one.
We run a fixed-fee Sovereignty Position Assessment. Vivanti is Australian-owned, and we will tell you plainly where each platform partner stands. Worth a conversation?
Regards,
[BDM name] | Vivanti
Generated Friday, 30 October 2026 01:08 AEST · Sources: buy.nsw (live listing), itcontractors.com.au, awardedtenders.au, digital.gov.au, dta.gov.au, industry.gov.au, themodernregulator.com, responsibleaiaustralia.com.au, tech-insider.org, aph.gov.au
Confidential — internal Vivanti BDM use only.