Australia's artificial intelligence boom is rapidly becoming an infrastructure story.
The Federal Government has been working towards national rules for large data centres covering electricity, water use, location and their impact on surrounding infrastructure. Following National Cabinet discussions, one of the Government's strongest proposals — effectively requiring new data centres to bring additional renewable generation with them — has been softened to accommodate different energy positions across states and territories, as reported by ACS Information Age.
That may sound like an energy-policy debate.
For Australian businesses, it is much more than that.
The decisions being made now about data centres, electricity generation and AI infrastructure will influence where computing capacity is built, what cloud and AI services ultimately cost, how resilient those services are, and potentially where organisations choose to place increasingly valuable workloads and data.
AI has a physical infrastructure problem
To most people, AI looks like software. A prompt goes in, an answer comes out. In reality, every one of those interactions depends on a long chain of physical assets:
- data centres
- GPUs and servers
- storage
- networking
- cooling
- electricity
- transmission infrastructure
- water
- telecommunications
Training and running large models is energy-intensive in a way that ordinary business software never was. The International Energy Agency has projected that global data-centre electricity consumption will roughly double by 2030, with AI the single largest driver of that growth. Australia is not exempt from that curve — it is one of the fastest-growing data-centre markets in the Asia-Pacific.
Moving workloads into a cloud platform such as Azure removes your responsibility for operating that physical infrastructure. It does not remove the dependency. Capacity, power availability, regional build-out and network paths still shape what you can run, where you can run it and what it costs. That is precisely why Managed Azure and cloud services are increasingly an architecture discipline rather than a hosting arrangement.
The Government originally wanted data centres to bring their own power
The original policy position was straightforward in principle: if a hyperscale facility is going to draw hundreds of megawatts from the grid, it should bring additional generation with it rather than compete with households and industry for existing supply.
That position has now been moderated. States and territories sit in very different places on generation mix, transmission capacity and investment appetite, and a single national requirement risked pushing investment offshore or into the handful of jurisdictions best able to absorb it.
The practical outcome is a more negotiated framework — one where energy availability, grid connection timelines and local approvals become part of the commercial equation for every large facility built in this country.
Australia has an opportunity — if we build the infrastructure properly
Australia has genuine advantages: political stability, strong legal and privacy frameworks, abundant renewable resources, land, and existing subsea cable connectivity into Asia and North America.
Those advantages only convert into digital capacity if the enabling infrastructure keeps pace — generation, transmission, water, skilled trades and planning approvals. Microsoft, AWS and Google have all announced multi-billion-dollar Australian infrastructure programs over the past two years. Whether that capacity lands here or elsewhere in the region will be decided largely by how quickly power can be connected.
Compute is now an energy question. The countries that can deliver firm, affordable power to a rack will be the countries that host the next decade of AI workloads.
Energy availability may start influencing where digital investment goes
Historically, cloud regions were chosen on latency, sovereignty and customer demand. Increasingly, they are chosen on where power can actually be delivered.
For Australian organisations, that has a quiet but real consequence: the availability of specific services, GPU capacity and newer AI features in Australian regions may lag behind larger overseas regions. That is already visible in how some AI services roll out — global regions first, Australian regions later.
Workload placement therefore becomes a design decision rather than a default. Which systems must stay in an Australian region? Which can tolerate a global endpoint? Which are latency-sensitive? Those questions belong in your Azure subscription and cost governance model, not in an ad-hoc ticket six months after go-live.
Businesses should pay attention even if they never operate a data centre
You will almost certainly never build a data centre. You are still exposed to what happens in them, in four practical ways.
Cloud cost and optimisation
Cloud migration does not automatically mean cloud optimisation. Subscriptions, virtual machines, storage tiers, networking egress, backup retention and licensing all accumulate cost quietly, and energy and capacity pressure flows through to list pricing over time.
Ongoing cost governance — right-sizing, reservation planning, orphaned resource cleanup and storage tiering — is what keeps an Azure estate defensible at budget time. It is core to how we run Azure subscription management and optimisation for clients.
AI availability and cost
GPU capacity is finite and rationed. As demand grows, expect variability in availability, throughput and per-token or per-seat pricing. Organisations that understand their actual AI usage patterns will manage that far better than those that bought licences broadly and hoped.
Data residency and sovereignty
Where your data is stored, processed and backed up is now a board-level question, not a technical footnote — particularly for healthcare, legal, financial services, government supply chain and defence-adjacent organisations.
Business continuity
Concentrated infrastructure means concentrated risk. A regional outage, a network event or a capacity constraint affects everyone in that region simultaneously. Your continuity plan needs to account for that reality rather than assume the platform is infallible.
There is also a sovereignty question
Data sovereignty is often discussed abstractly. In practice it comes down to six questions any Australian executive should be able to answer:
- Where is our information stored?
- Where is it processed?
- Which jurisdiction governs it?
- Which third parties can access it?
- What happens if offshore capacity becomes constrained?
- What is our exit strategy?
Answering them well requires the Azure architecture, tenant configuration and identity model to be deliberate. Region selection, storage replication settings, tenant data-residency commitments and conditional access rules all contribute. This is where Managed Microsoft 365 governance and Managed Microsoft Entra ID do the real work — they determine who can reach data, from where, and under what conditions.
Cybersecurity becomes even more important
Every additional cloud and AI service expands the attack surface. Organisations accumulate more:
- identities
- applications
- endpoints
- integrations
- data flows
Identity is now the security boundary. Networks are porous, devices are mobile, and data lives across dozens of SaaS platforms — but every meaningful action still traces back to an identity.
That makes Entra ID hygiene, Conditional Access, phishing-resistant MFA, endpoint compliance enforcement and privileged access control the highest-leverage controls available. Detection matters just as much: Microsoft Defender across identity, endpoint, email and cloud apps only reduces risk if someone is watching and responding, which is the role of our 24/7 Security Operations Centre.
Resilience also involves more than redundant cloud infrastructure. Businesses should know:
- where critical information is backed up
- whether restores have actually been tested
- which applications depend on other platforms
- how users continue working during an outage
- what recovery time and recovery point objectives exist
Those answers should be documented and rehearsed as part of backup and disaster recovery, not discovered during an incident.
AI readiness starts before Copilot
AI adoption should not begin by purchasing licences. It should begin with an honest assessment of:
- existing permissions
- data quality
- SharePoint and Teams access
- identity security
- endpoint management
- information classification
- governance
- worthwhile AI use cases
This matters because Microsoft 365 Copilot generally operates within the permissions already present in your tenant. It does not create new access — it surfaces what a user could already reach, far faster and far more visibly. Oversharing that sat harmlessly in a forgotten SharePoint site for five years becomes a search result the moment AI is switched on.
Fixing that afterwards is expensive and disruptive. Establishing Microsoft 365 governance first — site permissions, sharing policies, sensitivity labels, lifecycle rules — is much cheaper. That is the purpose of an AI Readiness Assessment.
AI strategy needs to include infrastructure strategy
Before scaling AI, an organisation should be able to answer:
- What business processes are we trying to improve?
- Which data will AI need access to?
- Where is that data located?
- How will identity and access be controlled?
- Which workloads belong in Microsoft 365, Azure or another platform?
- How will AI agents and automations be governed?
- What will the environment cost as usage increases?
- How will security and compliance be monitored?
At Mycelium 365, this is where AI Strategy and Advisory, Managed AI and Automation, Microsoft 365 and Azure services intersect.
The objective is not simply to deploy more AI.
It is to build an environment where AI can be introduced securely, governed properly and measured against actual business outcomes.
The opportunity is bigger than data centres
The national conversation about data centres, energy and AI is really a conversation about capability. Compute capacity built in Australia supports Australian jobs, Australian research, Australian data residency and Australian resilience.
For individual organisations, the same logic applies at a smaller scale. The businesses that will get the most out of AI over the next five years are the ones treating their Microsoft 365 and Azure environment as strategic infrastructure — planned, governed and funded deliberately, usually through a technology roadmap or fractional CIO engagement rather than a series of disconnected projects.
What Australian organisations should take from this
Energy policy, data-centre approvals and AI capacity are not abstractions. They shape the cost, availability, resilience and sovereignty of the platforms most Australian businesses now run on.
The response is not to slow down. It is to build properly:
- deliberate cloud architecture and workload placement
- ongoing cost governance rather than one-off migration
- identity as the primary security boundary
- monitored, responsive security rather than installed tooling
- tested backup and recovery, not assumed resilience
- AI readiness established before AI deployment
This is the same principle behind Mycelium 365's Security by Design approach.
New technology should not simply be layered onto an environment and dealt with afterwards.
The foundations — identity, security, devices, cloud architecture, governance and resilience — should be designed correctly first.
Because the organisations that benefit most from the next wave of AI will not simply be those that adopt it fastest.
They will be the ones that have built an environment capable of using it securely, sustainably and at scale.