The week in digital: Copilot on your files, Gemini's free tier and an email deadline

This week’s changes share a question for whoever looks after the office technology: what is connected to what, and who decides? An assistant that can read files on a PC, an email connection Microsoft is closing, a free AI tier that is shrinking, a server patch and a privacy probe into a smart-glasses app all come back to someone knowing what the business actually uses. Here are five stories worth taking into next week.

1. Copilot will reach into files on Copilot+ PCs

Microsoft says Copilot on Copilot+ PCs will be able to use relevant files and recent activity on the computer, take actions across Windows and run AI models locally, with the user’s permission. It has given no date and no Australian timing; the features are expected to begin rolling out “in the coming months”. Microsoft Execution Containers, which let organisations set which files and networks agents can reach, are now generally available on Windows 11. When we checked on 8 October, Microsoft’s Australian store listed the new Surface Laptop Ultra from A$4,399 including GST, with a 16 October release date.

So what: decide now who may switch on an assistant that can see local files, and name the client, payroll and confidential folders it should never read. Buy Surface Laptop Ultra only for a role that needs local AI models or a lot of memory.

Read what Copilot’s file access means and the Surface prices.

2. Gemini’s free tier narrows

Google’s notice says its model-access changes start to take effect on 9 October, with no Australian cutoff time given. Personal accounts without an AI subscription keep Flash-Lite; Flash needs AI Plus, and Pro needs AI Pro or Ultra. AI Plus subscribers should get an email with their own timing. The notice covers personal accounts; Workspace licences have separate access rules.

So what: find out whether recurring work runs in a staff member’s personal account. Test the task in the model still available before paying for a higher plan.

Read which accounts change and what the plans cost.

3. Microsoft starts closing an old email connection

From 10 October (US Pacific time), Microsoft’s worldwide cloud starts requiring an application allow-list for tenants explicitly configured with EWSEnabled=True. Exchange Web Services lets applications work with Exchange data, including mail, calendars and contacts. Microsoft is pre-populating the list for some tenants from their recent app activity. This is not a shutdown of Microsoft 365 email, but the final EWS shutdown in Exchange Online starts on 1 April 2027, with no extensions.

So what: ask your Microsoft 365 administrator which applications still use EWS, who supplies them and when each will move off it.

Read the EWS check and supplier questions.

4. Self-managed Atlassian software needs a patch

Atlassian’s 5 October advisory rates CVE-2026-21589 Critical, at 9.3 on CVSS 4.0. It affects self-managed Data Center products including Jira, Confluence and Bitbucket. Atlassian says affected Cloud products are already patched, with no customer action needed.

So what: ask your IT provider whether each Atlassian service is Cloud or self-managed. If it’s self-managed, get the installed version, the fixed release and written confirmation when the work is done.

Read the Atlassian alert and provider checklist.

5. The privacy regulator looks behind smart glasses

The OAIC has opened an investigation into Shenzhen Qingcheng Future Technology, developer of the HeyCyan smart-glasses app, and the Privacy Commissioner has written to retailers asking them to reconsider selling devices that use it. No sales ban has been announced, and no breach finding has been made. The Commissioner says supplying hardware doesn’t by itself bring a retailer under the Privacy Act for information it doesn’t collect or hold, though customers can reasonably expect sellers to examine a product’s privacy risks.

So what: if you sell connected devices, know which companion app each one needs and who operates it, and keep the supplier’s answers on record.

Read the OAIC investigation and stock-review steps.

Dates to watch

Date	What happens
9 October 2026	Google’s Gemini model-access changes begin for personal accounts without an AI subscription.
10 October 2026 (US Pacific time)	Microsoft starts requiring an EWS application allow-list for tenants explicitly configured with EWSEnabled=True.
16 October 2026	Surface Laptop Ultra’s listed release date in Microsoft’s Australian store.
1 April 2027	Microsoft’s final EWS shutdown in Exchange Online starts.
30 June 2027	The ATO keeps accepting credit cards until this date, under the government’s 9 October announcement, instead of stopping after 30 November 2026. Read the ATO credit-card update.