Adaptive Policy for Adaptive Systems

Thank you, Pia, and good morning everyone.

I should be honest with you from the start. I’m not a technologist. I’m not a rules-as-code practitioner. I haven’t built the kind of tools that some of you in this room have spent years developing.

What I am is someone who spent six and a half years as Commissioner of the Australian Border Force, running systems that many policy-makers didn’t fully understand, using tools that often couldn’t keep pace with what was being asked of them, in an environment where the consequences of getting it wrong could sometimes be measured in lives, not just dollars.

What you’re building, rules as code, policy simulation, computational modelling, is the infrastructure that would have changed those outcomes. So let me tell you why.

The World Has Changed

The policy frameworks we rely on across government were designed for a world of relative stability. Rules-based trade. Predictable institutional behaviour. Threats that fitted recognisable categories.

That world is over.

Four forces have converged to change the operating environment fundamentally. Geopolitical fragmentation; trade is now weaponised as statecraft. Technological disruption; AI is reshaping what’s possible faster than our institutions can adapt. Supply chain complexity; opaque, multi-tier, and in many cases criminally infiltrated networks that stretch across dozens of jurisdictions. And expanding mandates; agencies like the one I led are now responsible for economic security, sanctions enforcement, critical minerals tracing, forced labour compliance, and biosecurity, on top of their traditional border protection functions.

This is not just a border problem. Every policy domain in this room faces the same challenge: rules written for linear, predictable systems are now trying to govern complex, adaptive ones.

That’s why you’re here. And that’s why what you’re building matters far more than you might think.

The Gap Between Intent and Reality

Let me make this concrete. In the border domain, the gap between policy intent and operational reality shows up in three layers.

First: what the system can’t see. In 2021, an international covert law enforcement operation revealed that over 100 companies and 1,000 individuals with direct links to organised crime had embedded themselves in Australia’s border and supply chain infrastructure - working in our ports, airports, and freight systems. Soon after, a separate global operation across 58 countries, using previously unseen industry data, seized nearly 100 tonnes of cocaine in less than a month - drugs that were moving through legitimate global supply chains. In both cases the criminals were hiding in plain sight, and yet were completely invisible to the system’s risk detection. The policy is to “secure the border.” The architecture can’t see much of what’s there.

Second: what the system can see but can’t act on at scale. Illicit tobacco in Australia represents a multi-billion-dollar black market, with foregone excise revenue measured at over AUD$11 billion per year. Everyone knows it’s there. Cargo X-ray examination rates sit at around one per cent. The policy says “enforce compliance” yet the system’s ability to do so is overwhelmed by volume. That’s not risk management, it’s risk acceptance by default, with no meaningful measure of assurance and no honest pricing of what’s being accepted.

Third: what the system isn’t designed to recognise. Critical infrastructure, supply chains and financial systems are increasingly being exploited as vectors for grey-zone activity - through containerised weapons systems, synthetic identities and state actors using criminal proxies. And on the near horizon, capabilities like artificial general intelligence and quantum computing will accelerate both the sophistication and the speed of those threats in ways we can barely model today. The question changes entirely. It’s no longer about catching more of what we’re already looking for. It’s about whether the systems architecture, and the policy architecture above it, can generate risk signals in real time by connecting systems and data across domains, to see what no single system can see alone. The threats we face now, and those ahead, don’t sit neatly in one category. They cascade across them.

Now, these structural systems failures didn’t emerge in a vacuum.

As Marcus Wigan and our host Pia Andrews argue in their recent book The Expertise Deficit, public sectors, arguably, have systematically lost the ability to recognise, value, and incorporate genuine expertise into decision-making. Over three decades of efficiency agendas, generalist managerialism displacing domain knowledge, functional segmentation creating silos, the outsourcing of specialist capability and an arm’s length approach to engaging with industry, we appear to have hollowed out the institutional capacity to even articulate what a modern system, such as our border, should look like - let alone commission one.

Australia’s single window for trade, the Integrated Cargo System, handling nearly a trillion dollars in two-way trade and 1.2 billion transactions per year, isn’t over twenty years old by accident. The funding models, the procurement culture, fragmented governance, the revolving door of generalist executives - these created the conditions for stagnation.

And there’s a further dimension. Across government, there are vastly different levels of digital literacy among decision-makers and policy-makers. There are pockets of excellence, but relatively few understand the basics of contemporary data science and information architecture, let alone how to translate that understanding into good policy. You cannot commission what you cannot conceive of. The result is policy, or important decisions, being developed or made in isolation from the systems that will implement it.

Step back and you see three structural gaps between the people who make policy and the systems that must deliver it. A knowledge gap - policy-makers often don’t understand the operational systems they’re governing. A visibility gap - even those who do understand can’t get a unified picture, because data is fragmented across agencies and portfolios. And a feedback gap - once policy is deployed, there is no mechanism to test whether it’s achieving its intent at the operational level, or to iterate at speed when conditions change. I experienced all three, simultaneously, throughout the pandemic as we closed, managed and re-opened Australia’s border.

In every case, the failure is not in our people or the policy’s aspiration. It’s in the gap between what the policy says and what the system can actually deliver.

Policy that cannot be tested against system reality before deployment is policy built on hope. And hope is neither a plan nor a strategy.

A Digital Policy Architecture

So what does adaptive policy actually look like in practice?

As Althaus, Anantula and Andrews describe in The Policy Playbook (and I commend it to you) the separation of policy design from policy implementation, introduced through reforms in the 1990’s, created a model where no one owns the whole policy lifecycle. Policy intent gets frozen in time. One team designs, another implements, and the feedback loop between them is weak or absent. That model assumes a tempo and level of complexity that no longer matches the operating environment in which we now find ourselves. What if policy could be modelled, stress-tested, and iterated before it hits the operational system?

I want to put three interconnected concepts to you. And I want to suggest that the middle one, digital policy twins, is the integrating layer that addresses all three of the gaps I’ve just described.

First: digital twins of operational systems. In border management, this means building a computational model of how goods, people, data, capital and risk actually flow through the system; not how we assume they flow. Singapore is already deploying a Maritime Digital Twin across its port and trade systems through a Maritime and Port Authority and GovTech collaboration. Australia’s recent experiences, whether fuel security vulnerabilities or the terrorist attack at Bondi Beach in December, indicate that no single system currently provides a unified picture across our national security and economic security systems at the border. Arguably you could add Biosecurity to that list. A digital twin would expose those seams. And that’s precisely the point.

Second: digital policy twins. This is where rules-as-code becomes operationally significant, and where it addresses all three gaps simultaneously. If we can express policy rules - tariff classifications, sanctions criteria, risk thresholds, forced labour prohibitions, carbon border adjustments - as executable, testable code, we can simulate how those rules interact with the operational digital twin. What happens to throughput if we change that threshold? What happens to risk exposure if we apply this new sanctions regime? What are the second-order effects across portfolios?

This is not abstract. The Bank of England and Payments Canada are already doing this - using digital twins to stress-test liquidity rules under different regulatory settings. This community has been building exactly this capability for fiscal and social policy. Later today you’ll hear from Phillipa Martin at Salsa Digital on practical anomaly detection and AI-enabled policy transcoding. The argument I’m making is that the same paradigm should extend to national and economic security, trade, and border governance.

Let me connect this directly to those three gaps. A digital policy twin closes the knowledge gap, because it bridges the divide between subject matter experts and policy makers and narrows the digital literacy gap. If you can show a decision-maker the consequences of a policy change in a simulated environment - visually, with measurable outcomes - you’ve translated the technical complexity without requiring them to become operators or data scientists. The tool does the translating.

It closes the visibility gap because when you model new trade rules, tariffs or sanctions regimes computationally, you cannot avoid seeing their effects on trade facilitation, revenue collection, and risk settings simultaneously. Digital policy twins force cross-portfolio visibility that siloed policy development systematically avoids.

And it closes the feedback gap because the model doesn’t stop working once the policy is deployed. You can run it continuously, compare predicted outcomes against actual system behaviour, and iterate. That’s the difference between a policy cycle measured in years and one measured in weeks. This real-time feedback is a significant advancement during a crisis.

Let me make this tangible. Imagine a U.S. sanctions regime is imposed overnight with significant compliance risks for security and trading partners such as Australia. Today, the policy team writes a brief, the operational team or teams interpret it, and the system adapts over weeks, if it can adapt at all. With a digital policy twin, you encode the new rule, run it against the operational model, and within hours you can see: which trade flows are affected, where the compliance bottlenecks will form, what the revenue impact looks like, and where the risks and gaps are. That’s not a theoretical capability. It’s what modern computational policy infrastructure makes possible.

There’s a deeper point here that connects directly to the expertise deficit. If domain expertise is being lost through executive mobility, outsourcing and functional segmentation, then encoding that expertise as executable, testable code is one way to make it durable. A digital policy twin doesn’t just simulate policy. It embeds domain knowledge in a form that survives institutional churn. It makes expertise shareable and auditable in ways that briefing papers and institutional memory cannot.

Third: digital sandboxes. The Customs Act already contains a regulatory sandbox mechanism, legislated in 2023. ASIC’s Enhanced Regulatory Sandbox shows how these models mature. What we need is the next evolution: cross-portfolio, federated-scope sandboxes that test not just regulatory settings but governance arrangements, data-sharing protocols, and operating models - simultaneously. And if we’re serious about building this infrastructure, we need to be honest about who builds it. Government doesn’t have the technical depth to do this alone and nor should it. In the border domain the model should be co-designed with industry, and in parts industry-led/ government-hosted. That means trusting industry not just to supply systems but to operate assurance functions; biometric anchoring, examination systems, compliance verification, within a governance framework that government sets.

And these tools are not only for pre-deployment testing. In Singapore, HTX and the Ministry of Home Affairs are using digital twin environments to simulate crisis scenarios and provide real-time operational feedback to first responders; modelling cascading effects and testing intervention options before committing to them. A digital backbone for scenario planning as a permanent, real-time capability. Not a periodic exercise conducted every few years when someone commissions a review. The logic extends to the realm of policy design, simulation and real-time feedback loops.

Federated, Not Centralised

The question then is one of architecture. The instinct in government when things go wrong tends to be to centralise. Create a super-agency. Pool all data. Build one system.

That instinct is wrong. For practical, legal, and democratic reasons.

What works is federation. Connected systems where each actor maintains sovereignty over their data and operations, but the architecture allows lawful, real-time sharing and AI-supported decision-making across the system. Algorithms travel to the data. Insights are shared but not the raw files. Privacy and confidentiality are preserved. Automation and learning are enabled.

The foundations already exist. The Fintel Alliance in Australia where law enforcement, regulators, and financial institutions collaborate without pooling data. Singapore’s Networked Trade Platform. The UK’s Global Supply Chains Intelligence Programme. In healthcare, federated machine learning allows hospitals to collaborate on cancer diagnostics without sharing patient records. If that level of trust is achievable for cancer research, it is surely achievable for trade governance.

Adaptive policy cannot be developed in isolation by a single department. It must be co-designed across portfolios and validated against operational reality. Being allowed to comment on a Submission just ahead of a Government decision doesn’t quite cut it! As Wigan and Andrews identify, functional segmentation, with siloed departments unable to deliver cross-portfolio outcomes, is one of the defining features of the expertise deficit. Digital policy twins are a practical mechanism for breaking those silos, because they force cross-portfolio visibility that siloed policy development systematically avoids.

OpenFisca itself embodies this principle. It is, at its core, a federated commons - an open, shared infrastructure for expressing rules as code. Distributed ownership. Shared standards. Interoperable by design. The architecture I’m describing for border governance shares the same foundational logic.

What Adaptive Policy Demands of Us

This community has demonstrated that legislation can be made computable. That policy impacts can be simulated before laws are passed. That rules-as-code can be a public commons. That is an extraordinary achievement.

But the ambition must go further.

As a non-technologist or policy professional, but a person with a keen interest in these domains and with over 44 years in operational delivery and crisis leadership, I would like to make three propositions for this room.

First: extend the rules-as-code paradigm beyond fiscal and social policy into national and economic security, international trade and travel, migration and border governance. The complexity is greater. The classification challenges are real. But the need is urgent. If we can model tax policy computationally, we can model trade compliance and risk thresholds.

Second: connect rules-as-code to operational digital twins. Policy simulation without operational grounding is academic. Operational systems without policy simulation are blind. The power is in the connection, and the digital policy twin is the bridge.

Third: build the institutional capacity for continuous policy adaptation. Sandboxes that test governance arrangements, not just rules. Federated architectures that allow cross-portfolio visibility. And investment in the digital backbone that makes scenario planning a permanent capability.

We test national preparedness through exercises. We test financial resilience through stress tests.

It’s time we tested policy before we deploy it into systems that can no longer afford to learn by failure.