#Australia Gating Table

REG-AU-002 | Version 1.0.0 | Last Modified On 01 August 2026

The single reference for what actually gates an Australian deal. It exists because the most expensive mistake available in Australia is treating a soft expectation as a hard gate, buying a certification that nobody asked for, or treating a hard gate as a soft one and discovering it in week three.

---

#1. How to read this

The organising fact. There is no Australian licence, registration, certification or approval a foreign software vendor must hold to sell hospital software to an Australian private hospital. There are five government conformance programmes, and each gates connecting to a national system, not selling. DIS-AU-029 Section 2 is the status table.

---

#2. The gating table

#2.1 Legal and regulatory

Items 14 and 15 are the largest legal drafting delta between the India master and the Australian variant. Reliance on an unfair term in a standard-form small business contract is a penalisable contravention, not merely an unenforceable clause. An Indian-form agreement presented unchanged to an Australian day hospital is not simply unattractive.

#2.2 Conformance and interoperability

Items 16, 17, 20 and 24 are the entire difference between a fourteen-day Australian deal and a nine-month one. DIS-AU-029 Section 3 defines the two tracks and the two qualification questions that decide which one a prospect is.

#2.3 Security and assurance

#2.4 Commercial, fiscal and contractual

---

#3. The Privacy Act position and the section 6EA election

3.1 Pensieve is inside the Act on any sensible reading. Section 5B gives the Act extraterritorial operation where an organisation has an Australian link, and since the 2022 amendment carrying on business in Australia is sufficient: the information need not be collected or held in Australia. The Commissioner has demonstrated willingness to assert the link against a foreign entity with no Australian establishment.

3.2 Pensieve does not rely on the small business exemption, and says so in writing, at POL-AU-053 Section 2.2. It is the worst available sentence to say to a hospital privacy officer.

3.3 The election under section 6EA. An entity that would otherwise be outside the Act may elect in writing to the Commissioner to be treated as an organisation, becoming bound by the Australian Privacy Principles and subject to the Commissioner, and is entered on a public opt-in register.

This is the cheapest credibility purchase available to Pensieve in Australia, and it costs nothing. Very few entities have made the election, which is precisely why making it is a signal rather than a formality. It belongs in the pre-first-contact readiness set, and CHK-AU-001 places it there.

3.4 Penalty exposure that should change behaviour today. The 2024 amendments restructured the civil penalty regime into three tiers, and a failure to maintain a compliant APP 1.3 privacy policy is now directly penalisable by infringement notice. An out-of-date Australian privacy policy is therefore a measurable financial exposure, and the staleness monitoring on POL-AU-053 has a direct financial justification in Australia that it does not have elsewhere.

---

#4. Security and assurance: what Pensieve publishes instead of certificates

4.1 The Essential Eight is the Australian commercial ask. It scores eight mitigation strategies at maturity levels zero to three and can be self-assessed or independently assessed. Maturity Level 2 is the commercial expectation. Maturity Level 3 is a government-grade posture, and asking a company of Pensieve's size for it is a category error a good chief information officer will not make.

4.2 Pensieve's position. Pensieve publishes a self-assessed maturity statement, per control, at the honest current level, with each gap named and dated.

A vendor that publishes Maturity Level 1 on two controls and states when Level 2 lands is more credible than one claiming Level 2 with no evidence. The assessment is self-assessed and is labelled as such every time it is cited.

4.3 The transition nobody has noticed yet. The issuing authority has announced that the Essential Eight will be retired and replaced by a new "Essentials" series, with retirement beginning in 2027 and completing around 2028. The first chapter is the direct evolution of the Essential Eight, and the authority has said existing investment will not be made redundant. Pensieve tracks the transition and will re-baseline against the replacement when it is published. Almost no competing vendor will raise this, and currency is one of the substitutes Pensieve is selling in place of certification.

4.4 The sequencing argument. The security baseline the Digital Health Agency applies to systems connecting to My Health Record is aligned to the Essential Eight. The uplift Pensieve should do anyway for commercial procurement is the same work that would later underpin Agency security conformance. Do it once, use it twice. It is the only place in the Australian programme where a free early action buys down a later expensive one.

4.5 The standing evidence set. Supplied by link, not by questionnaire cycle.

---

#5. Deliberately not pursued, and why

Silence reads as a gap. Naming the instrument and explaining why it does not apply reads as literacy.

---

#6. Open engineering and verification items

---

#7. Open decisions: the founder's, and each blocks something

---

#Related documents

---

#Change history