Sovereign AI in Australia: Avoiding Lock-In as AI Changes

Twelve months ago you picked an AI model. Today it is the third-best option, costs more than its newer rivals, and your whole system depends on it. Meanwhile someone in the risk team has asked where your prompts and logs are actually stored.

Australia's AI Reference Architecture (AIRA) treats both problems, dependence and data location, as questions of trust. This sixth post in our AIRA series covers how to stay in control while the AI stack keeps changing.

What does AIRA mean by sustainability and sovereignty?

In AIRA, sustainability means an AI system can be run responsibly, affordably and safely over time, and replaced when it should be. It covers energy and cost, but also sovereignty, operational dependence, critical technology dependencies, vendor concentration, and the ability to substitute key technologies and services.

The important nuance is what AIRA doesn't ask for. It does not expect every part of a system to be under an agency's full control. Instead, it asks for three things:

• Understand the level of control you have at each layer, and the consequences of depending on external providers.
• Decide deliberately how much control a workload needs, based on its sensitivity and criticality.
• Record that decision as part of the architecture, with the controls available to manage the dependence.

AIRA's platform layer adds a related expectation. Infrastructure options should be assessed against workload needs, risk profile, sovereignty constraints and whole-of-government expectations, including edge, local and disconnected deployment where needed.

In plain terms, sovereignty is not a yes or no. It is a set of choices you can explain.

Sovereignty isn't a yes or no. It's a set of choices you can explain.

Where does your AI data actually go?

Your AI data goes to more places than most teams realise. A single request can send the user's question, retrieved documents and personal details to a model provider. It can create embeddings in a vector database, write traces and logs to a monitoring service, and land in backups. Each of those places needs a known location, owner and retention rule.

Trace one request through a typical AI agent:

The most common surprise is not the model. It is a monitoring or logging tool quietly sending full prompts offshore. Our guide to reconstructing an AI decision covers how long to keep traces and logs, and how to keep personal details out of them.

The biggest sovereignty leak usually isn't the model. It's the logging tool sending prompts offshore.

Can you run AI agents in Australia or on premises?

Yes. AI agents can run in an Australian cloud region, inside an organisation's own cloud account, in a data centre it controls, or fully disconnected from the internet. Model hosting matters just as much. A model running in an Australian region processes data here, while a public API may process it offshore.

The main options, from least to most control:

1. A public AI service hosted offshore. Fast to start, but your data leaves Australia.
2. A cloud AI service in an Australian region. Data is processed onshore, but on the provider's shared platform.
3. Your own cloud account in an Australian region. The platform runs inside your organisation's own subscription or account, under your security controls.
4. On premises. The platform runs in a data centre you control.
5. Disconnected or air-gapped. There is no external connection at all, and you host the models yourself.

The government is moving in the same direction. For models reached through GovAI's model brokerage service, the Department of Finance says "onshore Australian-hosted models remain the default", and offshore use is an exception that needs a risk assessment and controls (iTnews). Every model used by the GovAI chat service must be hosted and process data onshore.

Two certifications government buyers will ask about:

• The Hosting Certification Framework, run by the Department of Home Affairs, certifies the hosting provider. It covers who owns and controls the facility, and its supply chain. It applies to data centre and cloud providers hosting sensitive or PROTECTED government data.
• IRAP, the Infosec Registered Assessors Program run by the Australian Signals Directorate, independently assesses a specific system against the Information Security Manual. It is an assessment, not a certification.

They answer different questions, and PROTECTED government data in commercial cloud usually needs both. ASD itself notes that completing an IRAP assessment "doesn't mean the system is compliant" with the controls tested. So when a vendor says it is "IRAP compliant", ask exactly which system was assessed, at what level, and when.

What is model-agnostic architecture, and why does it matter now?

A model-agnostic architecture lets an AI system use different models without rebuilding it. The model becomes a setting you can change, not a foundation everything else depends on. It matters now because the best, cheapest and safest model for a task changes every few months.

Three forces make lock-in expensive:

• Models get retired. Providers deprecate versions on their own timeline, not yours.
• Better and cheaper models keep arriving. A model that leads today can be overtaken within a quarter, often by one that costs a fraction as much.
• Different tasks suit different models. A simple classification step rarely needs the most powerful and expensive model available.

What model-agnostic looks like in practice:

• Prompts, tools and logic aren't written around one provider's quirks.
• Each agent, or each step, can use a different model.
• Switching models is a configuration change, tested against your evaluation suite before release.
• Both commercial models and open-weight models, which you can host yourself, are supported.

The government's own AI platform follows the same principle. GovAI now offers models from OpenAI, Anthropic, Mistral, Google, Nvidia and Writer (iTnews).

Your AI model is a dependency you rent. Know exactly how much you're renting.

How do you swap AI models without breaking production?

You swap models safely by running your own evaluation suite against the new model, comparing the results with the current one, and rolling it out gradually with a quick way back. Without an evaluation suite, a model swap is a guess. With one, it is a decision backed by evidence. Our guide to building dependable AI around imperfect models covers how to build that suite.

A safe swap follows four steps:

1. Test offline against your real cases, including the edge cases that caused problems before.
2. Release to one channel or a small share of traffic first. Keep the rest on the current model.
3. Watch the live signals: quality, escalations, reviewer corrections and cost.
4. Keep the previous version one step away, so you can move back immediately if something regresses. Our post on AI agent performance degradation covers when to roll back first and investigate second.

Open-weight models and sovereignty. Open-weight models can be downloaded and run on infrastructure you control. They give the strongest data control, because no request leaves your environment.

One point is often misunderstood. Data jurisdiction follows where the model is hosted and run, not where it was developed. A model developed overseas but running in your Australian environment keeps your data in Australia. A domestic model called through an offshore API doesn't.

Open-weight models still need the same evaluation, security testing and guardrails as any other model. Hosting one yourself also means owning its performance, patching and running costs.

How do you control AI running costs?

You control AI running costs by choosing the smallest model that passes your evaluations for each task, keeping what you send to the model lean, and tracking spend per use case so surprises are caught early. AI bills grow with usage, not seats, so a successful pilot can become an expensive production system quickly.

Most AI cost comes from tokens: the units of text a model reads and writes. Five practical levers:

• Right-size the model for each step. Defaulting to the most powerful model for everything is the most common cost mistake. Many steps, such as classifying or extracting, work well on smaller, cheaper models.
• Send less. Retrieve only the relevant parts of documents, and trim long conversation histories.
• Reuse what you can. Caching repeated instructions or common answers cuts both cost and delay.
• Watch agent loops. An agent that retries a failing tool ten times costs ten times as much. Set limits on steps and retries.
• Track cost per use case and per outcome. "Cost per resolved case" tells you far more than a monthly bill.

Cost belongs inside your evaluation, not in a separate finance report. A model that is slightly more accurate but costs five times as much may not be the right choice.

What should an AI exit plan include?

An AI exit plan sets out how you would move away from a vendor, platform or model without losing your data, your evaluations or your ability to keep operating. Agree it before you sign, while you still have leverage, not when you need it.

A practical exit plan covers six things:

1. Your data comes back. Documents, decision records, audit logs and traces, in a usable, documented format.
2. Your evaluation suite is yours. The real cases and the judgement about right answers belong to you, not the vendor.
3. Your agent definitions are portable. Prompts, tool definitions, business rules and approval policies can be exported and understood.
4. Models aren't tied to the vendor. You can keep using the same model, or switch, without the vendor's permission.
5. There is a handover period. The vendor supports the transition for an agreed time, and your team has the skills to operate the system.
6. Records survive the exit. Decision records that must be kept under recordkeeping rules stay available for their full retention period.

A good test: if this vendor disappeared tomorrow, which of these could you still do next week?

Agree the exit plan before you sign, while you still have leverage.

How AgentOS handles hosting and model choice

Avesta AgentOS was built so organisations can choose where AI runs and which models it uses, and change their minds later.

• Deploy where you need it. AgentOS can run in your country, inside your own cloud account, or on your own servers. CHAIRS Global and Life Insurance Direct both run inside their own cloud accounts.
• Use the right model for each job. AgentOS isn't tied to a single model vendor, so each agent can use the model that passes its evaluations at the lowest cost.
• Change models safely. Each agent version packages its prompts, tools and configuration together, including the model. A new version can go live on one channel, such as the website widget, while email stays on the current one. Rolling back means moving the channel back to the previous version.
• See what it costs. Each run records the agent version, the model, the cost and the timings, so you can compare models on both quality and price.

What to ask your AI vendor

• Where is every component hosted, including the model, logs, traces, embeddings and backups?
• Does any data, including monitoring data, leave Australia? Under what circumstances?
• Can we run the platform in our own cloud account, or on premises?
• Which models can we use today, and how do we switch? What does a switch involve?
• Which system has been IRAP-assessed, at what level and when? Is the hosting provider certified under the Hosting Certification Framework?
• What happens to our data, agents and evaluation suite if we leave?

If you're working out where an AI system should run, or how to keep the option to change models and vendors, book a discovery call and we'll map it with you.

Sources

• Digital Transformation Agency, AI Reference Architecture, Version 1.0, 2026 (CC BY 4.0), sections "Sustainability" and "Platform and infrastructure layer", available at digital.gov.au
• Department of Home Affairs, Hosting Certification Framework overview
• Australian Signals Directorate, Infosec Registered Assessors Program (IRAP)
• Department of Finance, GovAI Hosting
• iTnews, Fed gov boosts GovAI with models from Google, Nvidia and more