What’s moving across your sector.

This resets the market a provider operates in, and the paperwork is the least of it. Tighter eligibility and plan resets move volume and revenue, while expanded registration changes who you are allowed to be and what you have to report. The committee reports on 14 August, which puts a date on the window. Model two or three registration and pricing positions on your own numbers before then, so the decision is made before the legislation lands and makes it for you.

CPS 230 is board accountability dressed as an operational standard. The exposure most boards miss is concentration, a single cloud or software dependency that would breach your own disruption tolerance if it failed. The register is the straightforward part. The test is whether the board can name its critical operations and the providers capable of taking them down.

The trap is reading transition to 2029 as breathing room. Ongoing due diligence and the new program structure already bite, and only parts of initial due diligence are deferred. The practical work is to confirm which clock applies to which obligation, then document your program and compliance officer arrangements to the new standard.

The disclosure is the visible part. The work that takes time is the mapping behind it, because you cannot describe what you have not found, and automated decisions hide inside eligibility screening, prioritisation and risk scoring. Starting that system map now is what makes December a routine update, and it is the same map every other AI obligation will ask you for.

Round 3 is capital that flows to whoever is ready to deliver, and an open process rewards the prepared over the fast. Being ready means a pipeline, a delivery partner and a financing position that stand up to scrutiny. The question that decides it is whether you have the capability and the balance sheet to take this up, and if not, which partnership closes that gap before 2029.

Payday Super is a cash-flow change before it is a payroll change. Moving super from quarterly to every pay run pulls a recurring outflow forward, and for a thin-margin provider that timing shift is the part to stress-test. Confirm that the first July pay runs actually delivered contributions within seven business days, because the super guarantee charge is not deductible, and the ATO’s first-year approach gives credit to employers who find and fix timing problems early.

Wages are the cost base, and they rarely move in step with the funding meant to cover them. The 4.75 per cent increase is now in your payroll, and the question for the quarter ahead is whether the indexation and price updates on each funding line arrive in time to cover it. Model the increase against your funding lines now, so any gap shows up in your forecast before it shows up in your accounts.

The duties now attach to named individuals, no longer the organisation in the abstract, so the board’s question moves from whether you are compliant on paper to whether each responsible person can evidence what they actually did. Most providers built for the start date and then stopped. The exposure now sits in the assurance layer underneath.

The exemption you have relied on for years is now something you actively confirm on a schedule, and a missed return is the kind of administrative lapse that can quietly put your tax status in question. Treat it as a recurring governance item with a named owner and a date in the calendar.

No AI Act does not mean no obligation. Privacy, consumer and anti-discrimination law and directors’ duties all already apply to how you use AI, and the voluntary guidance is the yardstick a regulator or a funder will reach for when something goes wrong. Adopting the Guidance as your baseline now is cheaper than being measured against it after an incident.

The only real question is whether the plan exists before the day it has to work. A reporting duty on a 72-hour clock tests governance and response readiness, and the time to confirm who decides, who reports and how is well ahead of the incident.