What is actually on page one
On 22 October 2026, the first page of Australian results for AI software development was nine ranking lists and no vendor. Titles along the lines of Top 10 AI Development Companies in Australia, 7 Best AI Consulting and Development Companies, Top 5 Generative AI Development Companies for Secure and Custom AI. Not one result was a company describing what it builds.
Seven of the nine were published on the blog of a software company that also appears in its own ranking. The other two sit on third-party posting platforms with no stated methodology at all. The lists do not agree with each other about who belongs in the top ten, which is the expected result when the author is a candidate.
The entire first page of results for this question is written by people answering it about themselves.
This is not a scandal and it is not unusual. Ranking lists are cheap to produce, they attract exactly the search a buyer makes, and nothing stops a vendor writing one. It does mean that the most prominent advice available on choosing an AI software development partner in Australia is advice with a direct commercial stake in your answer.
You can check any list you are reading in about ten seconds. Look at the domain it is published on, then look for that company's name in the list. Then look for a methodology section. If the first search succeeds and the second fails, you are reading a sales page with a numbered structure.
The criteria those lists use cannot be failed
Read across the ranking set and the same selection criteria keep appearing: technical expertise, AI capability, innovation, enterprise experience, client satisfaction. Every one of those is unfalsifiable. No firm has ever described itself as technically weak, uninventive or disliked by its clients, so a criterion that every candidate passes is not a criterion.
The advice that follows is usually to review portfolios, case studies and testimonials. That is better, but it has the same problem in a slower form: the vendor chooses which three projects you see. A portfolio tells you what went well. It cannot tell you what the firm does when something does not.
What you want instead is a question with a specific, checkable answer, where a firm that has not done the work cannot produce one. Those questions exist, and for AI work most of them have already been written down by somebody with no stake in your decision.
Six questions the government already wrote for you
On 21 October 2025 the Department of Industry, Science and Resources published Guidance for AI Adoption, which condensed the ten guardrails of the earlier Voluntary AI Safety Standard into six essential practices. It is written for organisations adopting AI rather than for procurement, and that is probably why almost nobody uses it this way.
Each practice converts cleanly into a question for a vendor, because each one describes something the delivered software either does or does not do. A firm that has shipped governed AI systems answers all six from memory. A firm that configures somebody else's platform answers in the future tense.
| Essential practice | What to ask the vendor | What a weak answer sounds like |
|---|---|---|
| Decide who is accountable | Who owns this system on our side after handover, and who owns it on yours? | We provide ongoing support. |
| Understand impacts and plan accordingly | Which decisions will this make without a person, and who is affected when it gets one wrong? | It is only automation, it does not really make decisions. |
| Measure and manage risks | What is the rollback, and what have you actually had to roll back before? | We test thoroughly. |
| Share essential information | What do our staff and our customers get told this system is doing? | That is a question for your lawyers. |
| Test and monitor | What runs after go-live, who reads the output, and what raises an alert? | We will monitor it. |
| Maintain human control | Where is the human checkpoint, and can you show me one where a human changed the outcome? | There is an approval step in the workflow. |
The last row is the one worth pressing on. An approval step that has never changed an outcome is not oversight, it is a click. We have written separately about how to tell the difference, and what to record so the answer is a number rather than an opinion, because from 10 December 2026 Australian privacy policies have to describe the automated decisions a business makes and most systems cannot describe themselves.
Three contract questions that decide what you own
These are not technical questions and they do not belong in the technical conversation. Ask them early, because the answers are cheap to give before a proposal is written and expensive to change afterwards.
- Who owns the repository, and when do we get it?
The answer you want is that you own it and it sits in your organisation's account from the first commit. An answer that defers this until project completion means the code is leverage until then.
- If we want to change model provider in eighteen months, what breaks?
A system with the provider's calls scattered through its business logic has to be rewritten. A system that puts those calls behind one boundary does not. The vendor already knows which of the two they are about to build.
- How do we get our data out, including the parts the system generated?
Prompts, retrieved context, decisions, approvals and the audit trail are all data you will want, and none of them exist in your source systems. Ask for the export format now rather than at the end.
There is a fourth question that only applies to some projects, and it is the one that most reliably exposes whether a firm builds or configures. Ask what happens to a workflow running in production when the model version underneath it changes. Models are deprecated and replaced on the provider's schedule rather than yours, and the answer is either an architecture or a shrug.
Bring a constraint, not a requirements list
The most useful thing to bring to a first conversation is not a feature list. It is the constraint your business cannot move, because that is what decides the shape of the software and it is exactly what a generic proposal will quietly route around.
In a SharePoint access governance build for an Australian resources business, the client's security posture ruled out any application that held their documents outside SharePoint, so the governance was built inside SharePoint instead. That single constraint determined the architecture, and it was known before anything was designed. You can read what that looked like in practice.
Bring the equivalent to your shortlist and watch what each firm does with it. The useful response is a narrower proposal. The response to be wary of is enthusiasm.
A note on how new this market is
The ABS reported that 12% of Australian businesses used AI in 2024-25, up from around 1% two years earlier. That is a very fast change, and one consequence is that most firms now describing themselves as AI software development companies in Australia have been doing it for under two years, including several on every ranking list. How long a firm has been shipping this particular kind of work is a fair question, and unlike the criteria in the lists, the answer is checkable.
It also means the most experienced teams in this market often do not have AI in the company name. A firm that has spent a decade shipping custom software and integrations into Australian businesses has the harder half of the problem already solved, because the model is rarely the difficult part. The systems it has to reach into are, and those have not changed.
DevPro builds and ships working custom software rather than producing strategy documents. DevPro specifies the AI agents it builds with an audit trail, a defined human approval path, a scoped role and bounded system access. Those are two claims, no better evidenced by sitting on this page than anything on a ranking list is, so put the six questions above to us as well.
Should I rule out companies that appear on their own ranking lists?
No. Publishing a list you appear on is a marketing decision rather than a quality signal in either direction, and capable firms do it. Rule out the list, not the company, and assess the company on the six questions above.
Does it matter whether the development team is in Australia?
It matters for two specific reasons rather than as a general principle. Data that cannot leave the country constrains where the system runs and who can see it, and the OAIC's guidance on commercially available AI products is worth reading before that decision is made. Timezone overlap matters when a workflow breaks at 9am on a Tuesday. Neither is really about where the developers sit.
What is a reasonable first engagement?
Something small enough to be finished and used. A scoped first build that reaches production tells you more about a firm in six weeks than any portfolio does, and it leaves you with working software either way. A discovery phase that ends in a document tells you how well the firm writes documents.
How do I compare quotes that are wildly different?
Usually they are quoting different projects rather than different prices. The five facts that make quotes comparable are in our piece on what AI software development costs in Australia.