Foreign control of AI vendors raised as board-level risk, new ASD guidance on AI sovereignty for critical sectors.

The Australian Signals Directorate and Australian Institute of Company Directors have released new guidance recommending that boards treat the foreign ownership, control, and influence of AI providers as a cyber risk in its own right. The advice comes in the context of broader AI sovereignty concerns, particularly following the US government's access restriction order on Anthropic's Mythos-class models in June 2025.

The guidance identifies four key action items for boards. First, organizations should assess the risks of relying on foreign-controlled AI providers. Nearly all leading frontier AI model developers are currently headquartered in the United States, with China as the only other country developing competitive models at scale. Outside these two powers, France's Mistral represents one of the few credible independent alternatives.

Second, boards must review how frontier AI models could affect their organizations' security posture, including exposure to AI-enabled threats. Third, they should develop capabilities to counter agentic AI-powered threat environments. Fourth, organizations need to improve governance, processes, and capabilities to manage AI technology use internally.

The guidance emphasizes that frontier models accelerate attack tempos, compressing vulnerability discovery and exploitation timelines from days to hours. This compression lowers the technical skill barrier for malicious actors and enables AI systems to chain multiple low-severity vulnerabilities into high-impact compromises. Models can now conduct malicious activity with little to no human oversight, making access controls critical.

Prime Minister Anthony Albanese has echoed these sovereignty concerns, stating at the University of Sydney on July 15: "The inescapable lesson of the global instability of the 2020s is that if we are always dependent on someone else, somewhere else, we will always be vulnerable." The guidance advises that AI agents operating within an organization should be granted only the minimum access their duties require.