Retrofitting existing services to the Digital Inclusion Standard
The Digital Inclusion Standard has applied to every existing public-facing digital service since 1 January 2026. That date has passed. Say your agency runs a site that went live in 2019 and has barely been touched since. It is in scope now, not at the next redesign.
Retrofitting is a different job from meeting the Standard on a new build. Almost all the guidance is written for the new build. On a live service you cannot pause the thing to study it, and you almost never get funded to uplift all of it at once.
So the retrofit starts somewhere else. With the evidence you already hold. A sequence ordered by harm rather than effort. And an honest decision about what you will not fix this year.
This guide is for content leads handed an existing estate and told to make it compliant. It assumes no new research budget and no redesign.
[Uploader: the 2 links in the next paragraph are placeholders. Point them at the published Digital Inclusion Standard explainer and the published content checklist. Neither is live yet.]
For what the Standard is, which services it covers and what each criterion asks, start with the explainer. To work through the criteria one service at a time, use the content checklist.
Before you start
You need four things, none of which require a project:
A list of the public-facing services your agency runs, and a named owner for each.
Whatever user research, analytics, complaints and accessibility audit data already exists, however old.
An accountable officer who can sign a decision, not just endorse a plan.
The Digital Inclusion Standard and the Compliance, reporting and exemption guide open in a tab.
You do not need a discovery phase. That is the whole point of a retrofit.
Step 1: Check you are actually in scope, then decide what counts as a service
Get this right first, because a common misreading sends people the wrong way.
The Standard covers informational and transactional digital services in 4 categories. Services subject to the Investment Oversight Framework. New or replacement public-facing services. New staff-facing services. And all existing public-facing services.
Existing public-facing services came into scope on 1 January 2026. New public-facing and new staff-facing services came in on 1 January 2025. Existing staff-facing services are not on that list. Neither are state or territory services.
It is not limited to services under the Investment Oversight Framework. The compliance guide says all existing public-facing services must comply with the Digital Service Standard and the Digital Inclusion Standard. No investment condition attached. The Framework condition applies to new or replacement services. A legacy website with no current investment proposal is in scope, and reading it the other way is how a site gets missed.
Then draw the boundary at the task, not the URL. Scope by URL and you get a list of 4,000 pages and no way to decide anything. Scope by task and you get thirty or forty things a person came to do, which you can triage.
Write the list down and get owners to agree to it before you assess anything. Disputes about scope surface later as disputes about whose budget pays.
Step 2: Build the evidence file from what you already hold
You cannot run discovery on a service already carrying traffic. You can assemble what the organisation already knows.
For each service, pull five things together. Twelve months of analytics. The search terms people use on the site. The complaints and feedback the service has generated. Any accessibility audit. And any user research done for any purpose in the last five years. Old research is still evidence. Note its age rather than discarding it.
Complaints and contact centre transcripts are the most underused inclusion evidence in government. They tell you exactly where the content failed a real person, which answers Criterion 1 more directly than a fresh round of interviews would.
Where the evidence is thin, record that it is thin. A gap you have named is defensible. A gap you have not looked for is not.
Step 3: Triage by harm, not by page count
This is the step people get wrong. The instinct is to start with the biggest site, or the oldest, or the one the executive mentions most.
Order the list by what happens to a person who cannot use the service. An eligibility page a person with low literacy cannot understand causes a different order of harm from a media release with an unlabelled image.
Both are non-compliant. Only one stops someone getting money they are entitled to.
Retiring a page is a compliant answer. Content that no longer earns its place does not need to meet the Standard. It needs to go. On a large estate, retirement will move the number faster than remediation will.
Step 4: Separate what content owns from what it does not
There is a content decision inside every one of the five criteria. Criterion 4 names the Australian Government Style Manual as a compliance instrument outright. But the criteria are not cleanly divided into content and not-content, and it is worth knowing where the real edges are.
Criterion 1 is dominated by co-design and eight named cohorts. Criterion 3 leads with establishing a safe digital environment, which is security and moderation as much as words. Criterion 4 includes assistive-technology testing and procurement conditions.
And Criterion 5 is the one most people get wrong, including the DTA. Its two stated responsibilities are flexibility in how users engage, and seamless experiences across service delivery channels. It is about channels, not layouts. If a person starts online, rings the contact centre and then walks into a shopfront, do they get the same answer? That is a content and service design question with an owner-shaped hole in it.
Worth knowing: the DTA's own checklist for new and replacement services describes Criterion 5 as "responsive layouts, adaptive interfaces". That contradicts its own criterion page. The criterion page is authoritative. If your team is working from the checklist, they have the wrong model.
Split your gap list on the day you write it. Content gaps go into the content plan with a date. Design and engineering gaps go to those teams, in writing, with the criterion named.
A gap that sits unrouted in a content backlog reads as a content failure at audit time.
For the accessibility half, target WCAG 2.2 Level AA. The Disability Discrimination Act 1992 obligation sits underneath the Standard regardless of what the policy timetable says.
Step 5: Decide where an exemption is the honest call
The DTA expects that some agencies will not make it. Its exemption guidance uses an existing informational website as the worked example. An agency that cannot meet the deadline without significant investment and risk to other priority programs. The guidance describes the scenario and stops there. It does not state an outcome or a duration.
Exemptions should only be sought where there are genuine barriers. The guidance names two: legacy technology barriers that cannot reasonably be overcome, and substantial financial burden associated with modifying the service. That list is illustrative rather than exhaustive, and the Exemption Guide says as much. If your barrier is real and not on the list, contact the DTA rather than assuming you are out of options.
They can be permanent, temporary, partial or full. They can cover one or more criteria, or an entire standard. They cannot be granted at whole-of-policy level.
An exemption is a documented decision, not an admission of failure. What makes it credible is the evidence attached, and the DTA notes that sufficient evidence may include enhancement plans or future system changes.
An exemption with a plan behind it is a position. An exemption without one is a delay.
Apply in writing to standard@dta.gov.au, setting out the service, the reason, and whether you are seeking a temporary or permanent exemption.
Step 6: Record the decision, then set your own review
Every service ends up in one of four states: compliant, uplift underway with a date, exempt, or retired. Write the state against the service, name who decided it, and have the accountable officer sign it.
Compliance reporting runs through the DTA's existing data collection activities under the Investment Oversight Framework, not a separate return. So the review cycle here is one you set for your own governance, not one the Standard imposes. Put it in a calendar with an owner, or it will not happen.
What good looks like once this is done
You have a single page per service. It says what evidence you used, which criteria it meets, which it does not, what you are doing about each gap, and who signed. Design and engineering gaps are with those teams and dated. Anything exempt has a written enhancement plan behind it.
When audit, procurement or a minister's office asks how a service meets the Standard, the answer takes one page. And it is the same answer no matter who in the team is asked.
The harder question comes before all of it. If you sorted your estate by what happens to a person who cannot use it, would the order look anything like your current work plan?
Get the record
Use it two ways. Download the branded version to run against your services, or open the record below and copy it into your own document.
Digital Inclusion Standard retrofit decision record
How to use this record
One record per service. Complete it once, have it signed, and review it on your own governance cycle. This record is the evidence that your agency assessed the service, made a decision about each criterion, and knows who owns what happens next.
Work through the sections in order. Do not skip section 2, even if the evidence is thin. Recording that evidence is thin is itself a finding, and it is the difference between a gap you have named and a gap you have not looked for.
A criterion is not resolved until it has a decision, an owner, and a date. "Under consideration" is not a decision.
1. Service details
- Service name: [service name]
- What a person comes here to do: [the user task this service supports, in one sentence]
- In scope: [confirm the service is public-facing, informational or transactional, and owned by a non-corporate Commonwealth entity]
- Service owner: [name, role]
- Content owner: [name, role]
- Accountable officer: [name, role]
- Date assessed: [date]
- Date of next review: [date]
Scope the service at the task, not the URL. If this record covers more than one distinct user task, split it into separate records.
Scope note: the Standard is not limited to services under the Investment Oversight Framework. A legacy site with no current investment proposal is still in scope.
2. Evidence held
List what you already have. Do not commission new research to complete this section. Note the age of each source rather than discarding anything for being old.
- Analytics reviewed: [period covered, what it showed]
- On-site search terms reviewed: [period covered, what it showed]
- Complaints, feedback, and contact centre themes: [source, period, what it showed]
- Accessibility audit or testing: [date, scope, result]
- User research available: [date, purpose it was done for, what it tells you about this service]
- Evidence gaps: [what you do not know about this service's users, and why]
3. Criterion triage
Assess each criterion against the evidence in section 2. For each one, record the current state, the decision, the owner, and the date. Order your work by what happens to a person who cannot use the service, not by how easy the fix is.
Decision options: Compliant, Uplift now, Uplift scheduled, Exemption sought, or Retire.
| Criterion | Current state | Decision | Owner | Target date |
|---|---|---|---|---|
| 1. Embrace diversity | [what the evidence shows] | [decision] | [name] | [date] |
| 2. Motivate digital use | [what the evidence shows] | [decision] | [name] | [date] |
| 3. Protect users | [what the evidence shows] | [decision] | [name] | [date] |
| 4. Make it accessible | [what the evidence shows] | [decision] | [name] | [date] |
| 5. Provide flexibility and choice | [what the evidence shows] | [decision] | [name] | [date] |
There is a content decision inside every criterion, but none of them is purely content. Criterion 1 is dominated by co-design and eight named cohorts. Criterion 3 leads with a safe digital environment. Criterion 4 includes assistive-technology testing and procurement conditions. Criterion 5 is about channel flexibility and seamless cross-channel experience, not responsive layouts. Record the owner accordingly.
4. Gaps routed to other teams
Any gap that is not a content decision is still your finding. Route it in writing, name the criterion, and record it here so it is visible at review.
- Gap: [what is wrong] | Criterion: [number] | Routed to: [team, name] | Date routed: [date] | Response: [what they committed to, and by when]
- Gap: [what is wrong] | Criterion: [number] | Routed to: [team, name] | Date routed: [date] | Response: [what they committed to, and by when]
5. Exemption case
Complete this section only where you have recorded "Exemption sought" above. Exemptions may cover one or more criteria, or an entire standard, and may be permanent, temporary, partial, or full. They cannot be granted at whole-of-policy level.
- Criteria or standard this exemption covers: [criterion numbers, or the whole standard]
- Ground for exemption: [legacy technology barrier that cannot reasonably be overcome / substantial financial burden associated with modifying the service / other genuine barrier, described]
- Evidence for the barrier: [what makes this barrier real: the system constraint, the costed estimate, the competing commitment]
- Duration sought: [temporary, to a stated date / permanent]
- Enhancement plan: [what will change, when, and what triggers it. An exemption with a plan behind it is a position. An exemption without one is a delay.]
- Interim mitigation for affected users: [how a person who cannot use this service gets the outcome another way, until the gap is closed]
- Date applied: [date] Outcome: [pending / granted / declined, and any conditions]
The two named grounds are illustrative, not exhaustive. If your barrier is genuine and not listed, contact the DTA rather than assuming you have no case.
6. Sign-off
A criterion is not resolved until the decision is recorded and signed. Sign the record, not the intention.
| Role | Name, date, and signature |
|---|---|
| Content owner | [name, date] |
| Service owner | [name, date] |
| Accountable officer | [name, date] |
Review completed by: [name] Date: [date] Changes since last review: [summary]
The Standard does not set a review frequency for agencies. Set your own and put it in a calendar with an owner.
Where to check the source
- Digital Inclusion Standard, services covered, and the transition approach, which carries the two-phase timeline
- Compliance, reporting and exemption guide and the exemption guidance
- The government's own Digital Experience Policy checklist for existing services
- WCAG 2.2, the Australian Government Style Manual, and the Disability Discrimination Act 1992
Photo by Olivier Amyot on Unsplash.
Did this land?
I write these to be used, not just read. Tell me if this wouldn't work in your organisation, and why.