· 3 min read
The Voluntary AI Safety Standard's 10 guardrails explained for SA organisations
The ten VAISS guardrails in plain English, how they map to the six practices in the Guidance for AI Adoption, and what SA organisations should do first.
Insights
Insights
Practical guidance on AI, cloud, automation and government ICT procurement in South Australia.
AI governance and assurance
How to govern every kind of AI: the Voluntary AI Safety Standard and Guidance for AI Adoption, inventories and risk tiers, guardrails, failure modes, model risk management, red-teaming and what government buyers ask suppliers.
· 2 min read
AI governance framework in practice: inventory, risk tiering and approvals
How to build a working AI governance framework: an AI register, risk tiers, RACI, an approval board and evidence that scales with risk.
· 3 min read
Types of AI and their different risks: ML, generative AI, LLMs, agents and automated decisioning
Compare machine learning, scoring models, generative AI, LLMs, RAG, AI agents, computer vision and automated decisioning, with the risks and controls for each.
· 2 min read
Guardrails for LLM applications and AI agents: the technical controls that matter
Input and output filtering, prompt-injection defence, PII redaction, grounding, tool permissions, spend limits and human approval for LLM apps and agents.
· 2 min read
AI failure modes and how to design for them
Hallucination, bias, drift, data leakage, prompt injection, tool misuse, over-reliance, deprecation and outage: how AI fails and the mitigations to build in.
· 2 min read
AI model risk management for scoring models and automated decisioning
Model inventory, independent validation, explainability, fairness testing, champion and challenger, monitoring and retraining for scoring and decisioning.
· 2 min read
Red-teaming and evaluation of LLM applications
How to build evaluation sets, adversarial tests and release gates for LLM applications, using OWASP, MITRE ATLAS and NIST guidance.
· 3 min read
AI in government procurement: what SA agencies will ask suppliers
What SA agencies and councils ask AI suppliers: responsible AI policy, transparency, data residency, testing, oversight and exit, with a checklist.
Training and team skills
Practical guides for running AI workshops and building the skills every team needs first.
· 2 min read
How to run an AI use-case workshop for your team
A practical format for an AI use-case discovery workshop: who to invite, how to generate and score ideas, tier risk and leave with a ranked shortlist.
· 2 min read
AI skills for staff: what every team should learn first
The core AI skills every team needs: how AI works, prompting, checking outputs, protecting data and knowing when not to use AI, plus role-specific next steps.
Risk, resilience and compliance
For regulated entities and the suppliers who serve them: APRA CPS 230 and CPS 234, provider due diligence and exit, resilience testing, incident reporting and a map of the standards that overlap.
· 6 min read
Privacy Act and Notifiable Data Breaches for SA organisations: what ICT leaders need to do
Practical guide for SA agencies, councils, NFPs and SMEs on APPs, NDB assessment clocks, and how privacy fits with CPS 230/234, SOCI and Essential Eight.
· 7 min read
APRA CPS 230 explained for ICT leaders: critical operations, tolerance levels and service providers
What APRA CPS 230 means for ICT leaders: critical operations, tolerance levels, continuity testing, material service providers and notification timeframes.
· 4 min read
Mapping CPS 230 to cloud architecture and resilience testing on AWS and Azure
How to turn CPS 230 tolerance levels into AWS and Azure designs and a testing program: zones, regions, backups, game days and recorded evidence.
· 5 min read
CPS 234 information security for third-party, fintech and SaaS suppliers
What APRA CPS 234 means for suppliers to banks, insurers and super funds: what customers ask for, notification timeframes and a readiness plan.
· 5 min read
Service provider due diligence and exit planning for cloud, SaaS and AI vendors
A practical guide to material service provider registers, due diligence, contract terms, concentration risk and tested exit plans for cloud, SaaS and AI.
· 6 min read
A compliance standards map for SA SMEs supplying regulated entities
CPS 230, CPS 234, SOCI, ISO 27001, Essential Eight, Privacy Act, PCI DSS and SOC 2 compared: who is bound, what overlaps and what to do first.
· 5 min read
Operational resilience testing and incident reporting runbooks
How to build a resilience test program, evidence it, write runbooks that work under pressure and line up CPS 230, CPS 234, SOCI and privacy notification clocks.
Government ICT, tenders and compliance
For SA agencies, councils and the suppliers who bid for their work: panels, security frameworks, accessibility, residency and recovery.
· 10 min read
Software testing and UAT for SA Government and council projects: a practical guide
How SA agencies, councils and small businesses plan software testing and UAT: test layers, safe test data, accessibility, security and a 90-day plan.
· 9 min read
Email security for SA councils and small businesses: SPF, DKIM, DMARC and stopping fake invoices
How SA councils and small businesses stop spoofed email and fake invoice scams: SPF, DKIM and DMARC in plain words, a safe path to reject and a 90-day plan.
· 8 min read
Council records and FOI workflows in South Australia: a practical digital design
How SA councils make FOI and records work faster and easier to defend: State Records and GDS 40 duties, the 30-day FOI clock, search, redaction, 90-day plan.
· 7 min read
Zero Trust and Conditional Access for SA Government agencies and councils
How SA agencies and councils put Zero Trust into practice with Microsoft Entra Conditional Access: MFA, device trust, risk-based policy, break-glass and a 90-day plan.
· 7 min read
Legacy application modernisation for SA agencies and councils: rehost, replatform or rebuild?
How SA agencies, councils and SMEs can modernise legacy systems: rehost, replatform, repurchase or rebuild, incremental cutover, data migration and RFT scope.
· 6 min read
Backup and disaster recovery for SA Government ICT: what buyers should require
What SA agencies and councils should require for backup and DR in ICT tenders: RTO/RPO, immutable copies, restore tests, Australian residency and evidence.
· 4 min read
SA ISMF for ICT suppliers: what buyers expect in tenders
What SA ISMF means for ICT suppliers bidding to agencies and councils: how it shows up in RFTs, Essential Eight links, evidence and a bid checklist.
· 5 min read
WCAG 2.2 for SA Government and council websites: what buyers should require
What WCAG 2.2 Level AA means for South Australian agency and council websites, common audit failures, and how to write accessibility into tenders and CMS migrations.
· 6 min read
SA Industry Participation Policy for ICT SMEs: how Adelaide suppliers show local economic benefit
How the SA Industry Participation Policy and Economic Contribution Test apply to ICT tenders, and how Adelaide SMEs can evidence local jobs and supply chains.
· 5 min read
Australian data residency for SA Government ICT projects: what buyers and suppliers should ask
Why SA agencies ask for Australian cloud regions, how AWS and Azure residency works in practice, Privacy Act basics, and tender questions that go beyond a residency checkbox.
· 4 min read
Essential Eight for SA SMEs: what buyers expect when you bid for government ICT work
A practical overview of the ACSC Essential Eight for Adelaide small IT suppliers preparing capability statements and SA Government tender responses.
· 1 min read
SA Government ICT panels explained: Low Risk ICT, eProjects Plus and Cyber Security Services
A plain-English guide for small IT suppliers to South Australia's ICT supplier panels, what each covers and how to prepare an application.
· 1 min read
How small IT businesses can win SA Government ICT work
A practical guide for small and medium businesses on SA Government ICT procurement, panels, SA Tenders and capability statements.
AI and automation
Where AI, LLM applications and automation fit, how to adopt them responsibly, and how to choose the right technique.
· 7 min read
Microsoft 365 Copilot readiness: a guide for SA councils and small organisations
How SA councils, not-for-profits and small businesses prepare Microsoft 365 for Copilot: fix oversharing, label sensitive data, set policy and run a pilot.
· 3 min read
Designing chatbot conversations: intents, slot filling and retries
How to design a chatbot that completes tasks: detect intent, ask for missing details, validate answers, retry with better wording and hand over cleanly.
· 5 min read
Guardrails for customer-facing chatbots: profanity, prompt injection and personal data
A layered guardrail catalog for public chatbots: input, context, model, tool, output and human oversight, mapped to VAISS, OWASP LLM 2025 and NIST AI RMF.
· 1 min read
AI for South Australian councils: practical, low-risk use cases
Where artificial intelligence can help SA local government today, from customer requests to planning documents, and how to manage the risks.
· 1 min read
Government process automation: RPA, workflow or AI agents?
How public sector and enterprise teams can choose between workflow automation, RPA and AI agents, and build an automation program that lasts.
· 1 min read
A responsible AI adoption checklist for Australian organisations
Steps to adopt generative AI safely in line with Australia's AI Ethics Principles and the Voluntary AI Safety Standard.
· 1 min read
RAG vs fine-tuning: choosing the right LLM approach
A plain-English comparison of retrieval-augmented generation and fine-tuning for business LLM applications.
Business systems, data and websites
For councils, small businesses and not-for-profits choosing software, moving forms and payments online, keeping cloud bills under control, building trusted reporting, connecting the tools they already use, or moving to a new website.
· 10 min read
Cloud cost control for SA councils and small businesses: a practical FinOps guide
How SA councils, agencies and small businesses avoid cloud bill surprises: tagging, budgets and alerts, safe savings, commitments, AI caps and a 90-day plan.
· 8 min read
Online forms and payments for SA councils and small businesses: a practical guide
How SA councils and small businesses replace PDF forms with accessible online forms and payments: PCI DSS scope, privacy, records and a 90-day plan.
· 7 min read
From spreadsheets to Power BI: a data and reporting guide for SA councils and small organisations
How SA councils, not-for-profits and small businesses move from spreadsheet reports to trusted dashboards: platform choice, design, privacy and a 90-day plan.
· 7 min read
Custom software or off-the-shelf SaaS? A build-vs-buy guide for SA small businesses
How South Australian small businesses decide between SaaS, integrating existing tools and custom software: five-year cost, risks, data ownership and questions to ask.
· 1 min read
Website CMS migration checklist for government and councils
A practical checklist for migrating a public sector website to a new content management system without losing content, SEO or accessibility.
Examples
Solution designs
Shapes we use on larger engagements. Each example shows how a solution is put together. These are not named client projects. The Learn section has detailed reference architectures for cloud, CRM, integration and industry, each with a diagram, numbered flow and design decisions.
Application Development
Customer and citizen portal
- Sign in with the organisation's identity
- Submit an application or request
- Track status, with an audit trail
Secure self-service for bookings, applications, payments and case tracking, with single sign-on and accessibility built in.
See Application DevelopmentAI Agents & Chatbots
Internal knowledge assistant
- Ask in plain language
- Search approved documents only
- Answer with a citation, or hand over
Staff find answers in policies, procedures and contracts in seconds, with a source citation or a hand-over to a person.
See AI Agents & ChatbotsDevOps & Cloud Engineering
Cloud landing zone
- Identity and network foundation
- Guardrails, logging and backups
- Repeatable environments in code
A secure foundation for a larger build: identity, logging, guardrails and environments defined in code.
See DevOps & Cloud EngineeringHave a question an article didn't answer?
Ask us directly. We reply within one business day, and the first conversation is free.