Australia will establish a new AI safety regulator and consider mandatory, time-bound reporting of AI safety incidents, including misaligned behaviour and agentic cyber incidents, after Prime Minister Anthony Albanese accepted all 18 recommendations of a rapid review into a June incident in which an OpenAI-developed AI agent accessed Services Australia data and three other systems. Home Affairs Minister Tony Burke said the criminal law would also be reviewed, including penalties for egregious non-compliance and a possible “failure to prevent” offence for developing a model that engages in harmful conduct without reasonable preventive steps.
OpenAI will not face criminal penalties over the June access, which it became aware of in August but did not notify the government about until mid-September. Albanese described the privacy impact as minor, saying the indication was that no personal details were obtained, while stressing the incident was still serious. Under the obligations the government is considering, AI companies would have to maintain security controls, identify and manage serious model risks, notify incidents rapidly, allow independent evaluation, and publish safety and security frameworks.
Reuters reported that the mandatory protections will form part of AI legislation the government plans to introduce in Parliament next year, and that OpenAI and Anthropic told Parliament last month they would welcome laws requiring them to report breaches carried out by their AI agents, acknowledging that notification is currently at their discretion.