Technology procurement in Australian enterprises has changed more through regulation and supplier risk than through new buying tools. The questions a board, an auditor or a regulator now asks about a technology purchase are different from five years ago. They want to know which suppliers are critical, what happens if one fails, how data is handled, and whether the decision can be explained later. This article sets out the Australian procurement trends that affect how organisations buy technology, and what each means in practice for a procurement or technology team.
CYBORIUM is an independent technology procurement service. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.
Spending keeps growing, so scrutiny does too
Gartner’s September 2025 forecast put Australian IT spending above $172 billion for 2026, with software and IT services among the largest categories. More of that spend is recurring subscription and managed service cost rather than one-off purchases. The practical effect is that renewals and contract changes now carry as much value as new selections, and they are often given far less attention. Our guide to software licence renewals covers how to treat a renewal as a procurement event.
Supplier risk became a regulatory issue
APRA CPS 230 commenced on 1 July 2025 for banks, insurers and superannuation trustees. It requires regulated entities to identify material service providers, assess risks before entering arrangements, and manage those providers throughout the relationship. For many organisations this moved third-party risk from a questionnaire completed after selection to a set of requirements that shape selection itself.
Critical infrastructure entities face a similar shift under the SOCI Act, where risk management programs must address supply chain hazards. Organisations outside these regimes are also being asked by customers, insurers and auditors for the same kind of evidence. See APRA CPS 230 due diligence and the enhanced CIRMP rules for the detail.
What it means in practice: due diligence, exit planning and ongoing monitoring requirements need to be written into the approach to market, so providers price them and commit to them before contract.
Cyber obligations now reach into contracts
Several Australian obligations affect what an organisation needs from its technology suppliers. APRA CPS 234 requires regulated entities to notify APRA within 72 hours of becoming aware of a material information security incident. The Cyber Security Act 2024 introduced mandatory reporting of ransomware payments for many businesses. The Notifiable Data Breaches scheme requires timely assessment and notification of eligible data breaches. None of these obligations pass to a supplier, but each depends on a supplier telling the organisation quickly and providing evidence.
What it means in practice: incident notification periods, evidence access, subcontractor disclosure and data location should be scored in evaluations and settled in contracts, not left to standard terms.
AI arrived inside products already under contract
Many organisations did not choose to buy AI. It appeared as new features in software they already use. Australia does not have a dedicated AI Act for enterprise use, and the Voluntary AI Safety Standard sets out guardrails organisations can adopt. Privacy Act changes require transparency about certain automated decisions from December 2026.
What it means in practice: decision owners now need to ask how AI features use their data, whether customer data trains shared models, and how material changes will be notified. Our guide to AI procurement guardrails covers the contract terms.
Consolidation promises savings and adds dependence
Large vendors bundle security, networking, collaboration and cloud services into platforms, and many organisations are reducing supplier numbers to cut cost and complexity. Consolidation can work. It also concentrates risk and weakens the decision owner’s bargaining position at renewal, which is exactly the kind of dependence CPS 230 asks regulated entities to understand.
What it means in practice: price bundled components individually, check whether each would win its own evaluation, and plan how you would exit before signing a multi-year platform agreement.
Decisions need a record that survives review
The common thread is accountability. Boards, internal audit and regulators increasingly ask to see why a supplier was chosen, which alternatives were considered and how risks were weighed. Public sector decision owners work under the Commonwealth Procurement Rules, which make value for money and documentation explicit, and many private organisations borrow the same discipline.
What it means in practice: agree evaluation criteria and weightings before responses arrive, score evidence rather than presentations, and keep the decision record. The guide to evaluating technology vendors without bias sets out a method.
How CYBORIUM helps
CYBORIUM runs independent sourcing for cybersecurity, AI and enterprise IT purchases: defining requirements, scanning the market, evaluating providers on evidence, modelling commercial exposure and supporting negotiation. The organisation keeps the decision and contracts directly with the provider it selects. Read more about procurement as a service.
Updated 15 September 2026. This article describes market and regulatory developments for general information. It does not provide legal or regulatory advice.
Standards and further reading
Two of these describe what Australian organisations are spending. The third describes how often they regret it.
- Gartner forecast for Australian IT spending. The market size and the categories driving it, which is the backdrop to any claim about procurement transformation.
- Gartner survey on renewal decisions and decision owner regret. Findings on how often technology decision owners regret purchases they were involved in, including renewals.
- Commonwealth Procurement Rules. The public sector value for money test, widely adopted by private decision owners who need a decision to hold up later.
