Sovereignty policy is a demand guarantee for certified operators, and a live regulatory risk since November 2025
The Hosting Certification Framework, the SOCI Act and the Whole-of-Government Cloud Computing Policy make sovereignty a demand guarantee for certified operators, and a live regulatory risk since the framework's reform was paused in November 2025.
Hosting Certification Framework (HCF)
PROTECTED and whole-of-government data must sit in Certified Strategic or Certified Assured facilities; Certified Strategic imposes government-specifiable ownership and control conditions. Holders include CDC, Macquarie Data Centres (3 campuses), NEXTDC facilities and DigiCo SYD1. Certification paused for new applicants from 3 Nov 2025 pending reform, freezing the certified-supply moat while its terms are rewritten.
SOCI Act
Data centres are designated critical infrastructure (Security Legislation Amendment (Critical Infrastructure Protection) Act 2022), raising security obligations and, per M3, investor confidence in the asset class.
Demand-side mandates
- Whole-of-Government Cloud Computing Policy effective July 2026, mandatory for non-corporate Commonwealth entities.
- National AI Plan (Dec 2025): cites A$100bn+ future DC investment; launched the AI Safety Institute; chose lighter-touch settings over mandatory guardrails.
- Data Centres Australia launched Nov 2025: peak body founded by AirTrunk, AWS, CDC, Microsoft, NEXTDC, Equinix, Goodman, Schneider Electric, Stack and TikTok.
Enterprise, 5G and streaming: the base load
- Telstra, Optus and TPG deployed 12,000+ new base stations in 2024, lifting edge demand (IMARC).
- E-commerce reached 13.9% of retail transactions in 2024 (IBISWorld via M3).
- Edge is 16.8% of market revenue and the fastest-growing sub-segment (IMARC); retail colocation is underpinned by enterprise outsourcing, hybrid cloud and interconnection.
- Macquarie Data Centres claims 42% of federal government workloads, a measure of how concentrated sovereign demand already is.
The HCF pause cuts both ways
Incumbent Certified Strategic holders gain scarcity value while no new competitors can be certified; but reform could tighten ownership rules (a risk to foreign-owned platforms) or loosen them (eroding the moat). Resolution timing is unannounced; register this as a signal to watch.
Policy sequence
SOCI Act designates data centres critical infrastructure
3 Nov 2025
HCF certification paused for new applicants pending reform
Nov 2025
Data Centres Australia peak body launched
Dec 2025
National AI Plan cites A$100bn+ future DC investment
Jul 2026
Whole-of-Government Cloud Computing Policy effective
Sources
- hostingcertification.gov.au, as at Nov 2025
- Lexology, as at 17 Jun 2021
- Performance AI prospectus
- Gadens via EcoGPT, as at 4 Dec 2025
- openPR/IMARC, as at Apr 2026
- IMARC, as at 2026
- M3 Property, as at Sep 2024, Nov 2025
Related
- How much have the hyperscalers committed to Australian data centres?
- Who are the largest data centre operators in Australia?
- What are the risks in Australian data centre investment?
The full primer is published as an 85-page PDF (download) with the underlying market model as a workbook (download).
This page is one of 30 in Australian data centres: the research, indexed by the question each one answers, with the four pages where the published sources disagree set first.
The research is published by inashanu, a studio that produces fixed-scope market research for Australian private equity, priced and dated before work starts. The sample engagement is this primer in full.
This standard, on your question. Six fixed-price deliverables, A$14,000 to A$45,000 excluding GST, opening at the A$14,000 market map in 10 business days. State the decision and the date it has to be made; the written assessment of whether the evidence base will carry it follows within two business days and carries no charge. Request a brief assessment · the catalogue and its prices.