Australia's CISC publishes 2026 Critical Infrastructure Annual Risk Review identifying AI as a growing threat multiplier

Australia's Critical Infrastructure Security Centre (part of the Department of Home Affairs) released the fourth edition of its Critical Infrastructure Annual Risk Review during Critical Infrastructure Security Month 2026 (published 6 November 2026; confirmed via json-ld datePublished on coverage). The review finds AI is rapidly uncovering cyber vulnerabilities, that defence will require AI-enabled mitigation, highlights digital supply chain risk driven by reliance on AI tools for software, flags physical security of AI infrastructure as a frontline resilience challenge, notes AI-fuelled mis/disinformation eroding public trust during natural hazards, and identifies AI governance guardrails as a key personnel-security requirement. It also sets out risk-prioritisation approaches (impact-led, likelihood-led, cost-led, resource-led) for owners/operators of critical infrastructure across energy, food, water, transport, communications, health, banking and finance.

This is authoritative national-government risk guidance for Australia's SOCI-regulated critical infrastructure operators. It signals that AI is now treated as a hazard class that extends across every risk category, and it gives owners/operators a framework for assessing AI implementation risk and prioritising mitigations. It complements the already-covered ACSC Annual Cyber Threat Report by situating AI risk within a sector-specific critical infrastructure risk posture.

Australian critical-infrastructure owners/operators should use the 2026 risk review to assess AI-implementation risk, AI supply-chain exposure and AI governance guardrails; map findings to SOCI risk-management program obligations.