Australia’s government agencies have just over a year of breathing room left before cloud becomes the default setting for nearly all new IT projects, and industry experts are already warning that rushing into it could do more harm than good.
The Digital Transformation Agency‘s policy takes effect July 1, 2026, and pushes agencies to favor cloud solutions whenever they modernize systems, unless they can justify doing otherwise. On paper, that sounds reasonable. Gartner analyst Adrian Wong notes that plenty of legacy applications simply were not built for cloud computing, and forcing them there anyway can end up costing agencies more than leaving them in place.
That tension runs through the entire rollout. Agencies under pressure to hit deadlines tend to default to lift-and-shift migrations, moving old systems to the cloud with minimal redesign, and those migrations have a well-documented habit of falling short. Wong cited a Gartner report tying these failures to mismatched workloads, weak provider choices, and cost estimates that didn’t survive contact with reality.
Vinayak Sreedhar of ManageEngine raised a more basic concern: many agencies don’t even have a clear inventory of what they’re retiring or what depends on it. Without that, he said, moving fast is exactly how outages happen.
Vendor lock-in adds another layer of risk. SUSE‘s Ben Henshaw argued that major cloud providers have little motivation to make it easy for customers to leave once their data and workloads settle in. Because the policy only encourages, rather than requires, support for open standards and data portability, agencies could end up boxed into a single provider without realizing it until much later.
Security and workforce gaps round out the warning list. Sreedhar noted that the real vulnerability during a migration often isn’t technical at all, but the disconnect between IT and security teams trying to coordinate the move in real time.
For agencies racing toward the July deadline, the message from experts stays consistent: speed without planning is the actual risk, not the cloud mandate itself.
