The state of information management: insights across government
Simon Froude
Director-General, National Archives of Australia
Museum of Australian Democracy (MoAD) – Canberra, ACT
14 September 2026
Introduction
Good morning all and thank you for making the time to join us, both here in the room and online all-around Australia.
I wanted to speak with you directly today because good information management is not merely a compliance exercise, nor is it solely a matter for records teams, technology teams or corporate areas.
It is an executive responsibility and a strategic control for organisational resilience, responsible AI use and trusted government. It shapes how confidently an agency can make decisions, deliver services, manage risk and account for its actions.
Yes, the rules matter, but the purpose is larger.
Good information management enables agencies to deliver their business effectively, transparently, accountably and with integrity for the benefit of all Australians.
The outcome we are working towards is trusted information and resilient agencies: agencies that can find, understand, use and protect their information, and ensure that records of enduring national value reach National Archives in good order.
Government information is a public asset we steward. Managed well, it supports:
- sound advice
- effective services
- continuity
- accountability
- integrity
- and public confidence.
It ensures that when systems fail, functions move or experienced staff leave, agencies can still find and trust the information they need.
Managed poorly, it creates operational friction, increases risk and weakens our ability to explain what was decided, by whom and on what basis.
That responsibility has become more urgent.
In June, the leaders of the Five Eyes cyber security agencies issued a joint warning that AI is accelerating the speed, scale and sophistication of cyber threats. Their message to leaders was direct: the timeline is not years, but months. They called on organisations to strengthen foundational controls, understand their exposure, reduce unnecessary attack surfaces and treat cyber resilience as a core business and leadership responsibility.
Strong information management is part of the foundation on which those controls depend.
An agency cannot manage its exposure confidently if it does not know what information it holds, where it is, how sensitive it is, who can access it or whether it still needs to be retained.
In that environment, unmanaged information becomes a risk multiplier. The more unnecessary information an agency carries, the more it must continue to control, protect and recover.
Today I want to focus on three things:
- what the latest whole-of-government evidence tells us about IM
- why information retention requires greater executive attention
- what agency leaders and National Archives can do about it.
Across government, information management maturity is improving.
But our efforts to evaluate information and determine whether to retain or dispose of it are not keeping pace with our capability to create and store it.
That imbalance creates operational, privacy, cyber, legal and financial risks that can compound over time.
If I leave you with one message today, it is this:
Keeping everything is not the safe option.
Managing your information is the safe option—knowing what information you hold, why you hold it, how long you need it and what must happen to it when that need ends.
The 2025 Check-up survey was completed by 175 agencies.
That’s not a sample, that's 99 per cent of in-scope government agencies, telling us in their own words how information management is tracking. I want to walk you through the results in the next few slides, then expand into the areas where we are looking to improve our work as the responsible agency for leading work in this area.
Check-up is the annual whole-of-government self-assessment tool submitted by all agency heads and aligned with the National Archives’ Information Management Standard and the Building trust in the public record policy. It provides a broad, longitudinal view of where agencies consider their practices to be mature and where significant work remains.
The overall maturity score has risen steadily since 2022, and agencies deserve credit for that progress.
But the average does not tell the full story.
Creating information assets was the strongest area in 2025, with a maturity score of 4.37 out of five.
Appraising or assessing and disposing of information was the weakest area at 3.28 out of five.
Those results invite two conclusions that we should question.
- The first is that a rising average means the job is nearly done.
- The second is that the lower-performing areas are the sole responsibility of information management specialists.
The strategic issue here is what happens when appraisal and disposal capability do not keep pace with our ability to create, store and manage information.
Information accumulates. Agencies migrate it across platforms and protect it through successive technology cycles, often without a clear view of its value, how long it needs to be kept or what should ultimately happen to it.
Over time, an information management weakness becomes an enterprise risk.
Creating information and introducing new platforms usually have visible and immediate business drivers. New systems, cloud migrations and digital services attract investment because agencies can see the operational result.
The benefits of effective retention and disposal of information are less visible or tangible, often taking the form of avoided or mitigated risks. A system decommissioned cleanly, information that is found quickly, or sensitive material that no longer needs to be maintained and protected are all benefits of effective retention and disposal.
Without clarity on information holdings, an agency cannot confidently assess its exposure, prioritise investment, or know whether it is keeping information for a defensible reason.
One result from the 2025 Check-up survey deserves particular attention from executives.
Most agencies reported senior management as prioritising support for information management. These agencies had a much higher overall maturity index compared to those that did not. While there might be a number of contributing factors to the difference, it is consistent with the broader finding that established governance practices are associated with stronger information management outcomes.
This finding is not primarily about technology or specialist capability.
It is about leadership.
Visible and sustained executive support means clear authority, meaningful reporting, and attention to information risk in investment, procurement and system decisions. It also means resourcing the priorities the agency has agreed to pursue.
There is encouraging progress. More agencies now have enterprise-wide information governance arrangements in place.
But governance is not complete once a framework has been approved.
It becomes real when executives use it to make decisions, seek assurance and hold the organisation accountable for action.
The answer will not be identical in every agency.
For one agency, the immediate priority may be clearer ownership. For another, it may be visibility of its information holdings, an unsupported system approaching decommissioning, or the capability to act on retention and disposal decisions.
The executive task is to identify the limited number of interventions that will make the greatest difference in that agency’s operating environment.
Our stewardship role can trigger an instinct to keep information for longer, particularly where disposal decisions feel difficult or irreversible.
But indefinite retention does not remove risk.
It transfers risk into the future and allows it to compound.
Every information asset an agency retains must continue to be understood, secured, governed and, where required, migrated, searched and produced. It must also be available quickly and easily when the agency is under pressure or scrutiny.
If that information includes sensitive, personal or security-classified material, it remains within the agency’s exposure for as long as it is held.
If the agency no longer needs that information, and it can accountably be destroyed, continuing to hold it may create risk.
We often hear that storage is cheap. Actions required for effective governance – not so much.
The 2025 Check-up survey results provide a clear indication of the underlying challenge.
Only 41 per cent of agencies reported that they usually or always know how long their existing information must be kept and what should ultimately happen to it.
Only around one-third usually or always promptly destroy temporary information once it is no longer needed and has reached its authorised retention period.
These are not simply records statistics.
Over-retention can make valuable information harder to identify and locate. It creates larger search environments, more complex discovery and freedom of information processes, and greater difficulty distinguishing authoritative records from drafts, duplicates and superseded material.
The Office of the Australian Information Commissioner has made the broader risk clear: retaining large volumes or unnecessary personal information can increase the potential harm to individuals in the event of unauthorised access or a data breach.
For Commonwealth agencies, however, personal information contained in Commonwealth records must be managed and disposed of in accordance with the Archives Act. That includes disposal under an applicable records authority or normal administrative practice.
Privacy and recordkeeping should therefore not be treated as competing obligations.
Together, they require agencies to make deliberate, lawful and documented decisions about retention.
The choice is not between keeping everything and disposing of information recklessly.
It’s about accountable and defensible retention and disposal.
Defensible retention and disposal means keeping information for as long as it is required to support government business, accountability, legal obligations, rights and entitlements, and the national archival record, then disposing of it accountably in accordance with the Archives Act.
A mature agency should be able to explain:
- what it holds
- why that information is needed
- how long it needs to be kept
- and what lawful disposal or transfer action applies.
Good information governance protects what must be kept and enables accountable disposal of what is no longer needed.
The best time to address retention is not at the end of a system’s life.
It is when the system is designed, procured, configured or renewed, while retention, metadata, access and disposal controls can still be built in.
Artificial intelligence (AI) compounds this challenge. Information is being created at unprecedented speeds and immense volumes.
In Check-up 2025, 87 per cent of agencies reported business use of AI. Yet only 15 per cent reported using AI for information management activities.
Information management professionals need to be involved early in decisions about AI, not brought in after technologies and practices have already been established.
As AI use expands, the associated prompts, outputs, summaries, transcripts, and drafts can accumulate rapidly.
Agencies need to distinguish between records that provide evidence of decisions, advice, approvals, accountability, and rights or entitlements, and short-lived facilitative records created during AI-assisted work.
National Archives first published our position statement on records generated through the use of AI in January 2025. We have recently worked with the Department of Finance’s AI Delivery and Enablement Division to update that guidance, responding to a request from the Secretaries Digital and Data Committee for clarification on recordkeeping and FOI obligations relating to the use of AI in government.
The updated guidance reaffirms that records produced through the use of AI are subject to the same retention and disposal requirements as all other Commonwealth records. At the same time, it highlights the need to actively manage facilitative records produced through AI, to avoid over-retention.
Agencies need to ensure their recordkeeping and normal administrative practice policies are updated to expressly address the governance and management of AI records. This includes identifying what must be captured and retained, who is responsible, and which facilitative AI records may be disposed of under normal administrative practice.
Staff should be guided to prioritise the final business record, while retaining supporting AI material where needed for accountability, transparency and evidence of decision-making.
The principle is simple: preserve the evidence that matters without retaining every digital artefact produced along the way.
Just as we responded to feedback and the needs of agencies in updating our Artificial Intelligence position statement, National Archives is committed to understanding agency needs more broadly. This is reflected in our current Strategy 2025-2030: Evolving National Archives, which will be in place for the next four years.
The strategy comprises four interconnected parts, focused on different aspects of our business, from providing public access to the national archives of the Australian Government to influencing the creation and management of Australian Government information assets.
The Enable component centres around our strategic leadership of Australian Government information management with the aim of uplifting its maturity. To achieve this, we want to:
- be active and visible in government decision-making and leadership forums
- apply a strategic, evidence-based approach to agency engagement
- provide tailored practical advice to improve information management maturity in agencies.
We are currently in the first phase, which is to understand agencies so that we can target our engagement efforts and establish the foundations to build future capabilities.
We recently commissioned an independent market research project which included a voluntary survey for agencies to complete. The survey was aimed at two cohorts – information managers and agency heads or senior executives with information management responsibilities. This was complemented by a series of one-on-one interviews with selected agency heads and senior executives.
This is the first time that we have surveyed and interviewed senior executives, and we were heartened by the response. I would like to thank everyone who assisted us with this research. Over half of agencies (85) responded to the survey and many executives generously gave their time to speak to the research team. Today I would like to share with you what we heard during this market research.
First and foremost, the research confirmed that executives believe in the importance of information management.
However, it also identified a gap between executive intent and operational experience.
An example of this being senior executives rating the strength of executives’ commitment to information management as a business priority more highly than that of information managers.
This same divide in responses was also reflected when senior executives were asked if staff in their agency saw information management as an additional administrative burden.
That is useful feedback for all of us.
Leadership intent does not automatically translate into operational change.
The test is not whether an executive believes information management is important.
It’s whether that priority is reflected in agency culture, budget, priorities, and accountabilities.
Our research asked what agencies wanted more of from National Archives, and they told us they want:
- practical advice that works for agencies of different sizes, functions and levels of maturity
- clearer connections between information management and business risks such as privacy, cybersecurity and AI
- information management built into the platforms staff use, and
- greater assistance with records authorities, sentencing and transfer.
Senior executives told us they wanted:
- more visibility of National Archives expertise in digital information management
- early engagement by the National Archives in solutions for digital information management challenges as they are evolving, and partnership with other digital and data agencies to provided centralised solutions.
We have heard that message.
Our strategy, Evolving National Archives 2025–2030, commits us to stronger visible leadership across the Australian Government information environment.
We will engage with you individually and collectively to obtain greater understanding of the operational realities you face.
We will be more active in whole-of-government discussions, use evidence to target our engagement, and offer tailored practical assistance to improve information management maturity.
We will also continue to partner with other lead agencies so that information management guidance is better connected to related responsibilities including privacy, data, digital investment, cybersecurity and AI governance.
Our aim is to help agencies align their information management with established requirements in ways that improve business delivery, reduce risk and strengthen accountability.
Improving information management maturity is a shared endeavour.
National Archives has information management responsibilities under the Archives Act to determine standards, provide advice, authorise lawful destruction and preserve the most significant records of government.
Agencies, in turn, are accountable for the governance and management of the information they create and hold.
Given that accountability, my ask of you all today is that information risk, including the risk of over-retention, becomes visible through your existing governance, risk, cyber resilience and investment arrangements.
Ask your teams for a briefing addressing three things.
First, exposure:
What information do we hold, where is it, how sensitive is it and who can access it?
Where are the material risks?
Second, control:
Do we know which information is authoritative?
Do we know how long our significant holdings need to be kept, what we are retaining beyond an identified business need, and what lawful disposal action applies?
Third, action:
What are the three highest priority important information management improvements for my agency?
Who owns them?
What executive decision, investment or support is required?
I am not suggesting that every agency begin in the same place or attempt to resolve every legacy issue at once.
I am suggesting that each agency should be able to identify its most important information management priorities, the risks those priorities address, who owns them and what executive support is required.
Progress should become visible through better knowledge of information holdings, current legal coverage for retention and disposal, risk-based action plans, and regular reporting to the executive on barriers and results.
And I ask each of you to make sure the issue is visible at your executive table, that ownership is clear and that your agency can identify a credible and prioritised path forward.
The outcome we should expect is trusted information and resilient agencies: agencies that know what they hold, protect what matters, dispose of information lawfully when it is no longer needed, and ensure that the records of enduring national value reach National Archives in good order.
That is good information management.
More importantly, it is good government.
Thank you
Media contact
National Archives of Australia Media Team
Phone: 0417 247 157
Email: media@naa.gov.au