Summary

  • Australia’s statutory-review paper records 111 million authenticated AGDIS transactions from June 2025 to May 2026, and no new accreditation applications since the Digital ID Act commenced.
  • Private accredited providers and relying parties can apply to join AGDIS from December 2026. Accreditation, system admission and privacy oversight are separate steps handled by different public offices.

Two measures, one system

Australia’s public digital identity network is busy. Between 1 June 2025 and 30 May 2026, the Australian Government Digital ID System (AGDIS) recorded more than 111 million authenticated transactions. By May, 39 government agencies were using it across 266 services accessed with myID. Those figures describe transactions through the Commonwealth system; they do not count every digital identity check in Australia.

The application ledger in the same statutory-review paper is quieter. Six entities and eight services were deemed accredited when the Digital ID Act began, carried forward from the Trusted Digital Identity Framework. Since then, the paper records no new accreditation applications. One accredited entity asked to leave and received a revocation. The document gives no cause for the empty new-application column, so cost, weak demand and red tape remain questions, not answers. The Issues Paper asks whether accreditation is too costly or difficult, whether the voluntary model is right, and whether the rules support trust without discouraging providers.

Traffic and accreditation measure different layers. Existing government services can generate more authenticated transactions through an established network even when no new provider applies under the statutory scheme. The first number measures activity. The second counts applications for a legal status.

A badge is not a doorway key

The Act makes accreditation voluntary for digital identity service providers. It also keeps accreditation separate from admission to AGDIS. Starting in December 2026, private accredited entities and businesses that rely on accredited services can apply to the Australian Competition and Consumer Commission (ACCC), the Digital ID Regulator, to participate in the government system.

That application has its own tests. The ACCC may approve participation, attach conditions, or refuse it after considering compliance with the Digital ID Data Standards, the entity’s ability to follow the Act, and whether participation is appropriate. It may also consider whether an applicant is fit and proper. Before approval, the service must pass an interoperability test with the Services Australia Identity Exchange; the System Administrator coordinates that test. The law gives the regulator a gate, not a rubber stamp.

The two public registers make the distinction visible: one lists accredited entities; another lists entities approved to participate in AGDIS. A badge says the provider has an accreditation status. It does not, by itself, say the provider may connect to the government network. Businesses can also offer accredited services outside AGDIS, where the regulatory requirements may differ. The Act and the statutory-review page describe those separate permissions.

Four offices behind one login

The public sees one verification journey. The legal map divides responsibility. The ACCC handles accreditation, AGDIS participation and enforcement outside privacy safeguards. The Office of the Australian Information Commissioner (OAIC) oversees enhanced privacy obligations, complaints, investigations and privacy enforcement. The Chief Executive Centrelink is System Administrator, responsible for day-to-day operations, availability and fraud or cyber incidents. The Department of Finance owns Digital ID policy and administers the Act.

That division follows function. The Issues Paper says a memorandum of understanding among the ACCC, OAIC and System Administrator supports cooperation, consultation and lawful information-sharing. The government argues that separate oversight strengthens accountability and reduces conflicts. The test is not whether four offices appear on a chart. It is whether a user or provider can trace a decision from application, to technical test, to approval, to a privacy complaint or operational incident without being passed between authorities that each own only half the problem.

The review has a clock

Section 162 requires a review of the Act no later than two years after commencement. The reviewers must send a written report to the Minister, who must table it in each House within 15 sitting days after receiving it. The public consultation ran from 14 July to 14 August 2026. Its remit includes whether the accreditation model is proportionate and whether AGDIS oversight balances privacy, security and participation.

The same Issues Paper says private businesses can apply to participate from December. It gives a month for the new application window, not a day, and the public review material gives no publication date for the reviewer’s report. That date would settle whether Parliament sees the review before the first business application, or after the new queue begins.

The first private applicant will test the gate. The first difficult handoff will test the governance map.

Sources