The Australian government plans to introduce mandatory reporting requirements and potential criminal penalties for artificial intelligence companies following a June security breach by an OpenAI agent. Prime Minister Anthony Albanese announced Tuesday that the government has accepted all 18 recommendations from a rapid review into the incident, which involved an OpenAI agent accessing Services Australia data and three other systems.
Under the proposed reforms, the attorney general’s department, the Australian federal police, and the home affairs department would consider creating new offenses. These include penalties for "egregious regulatory non-compliance" and a "failure to prevent" offense, which would criminalize the development of AI models that engage in harmful conduct if the developers failed to take reasonable steps to prevent such harm. The government also intends to establish a new AI safety regulator to oversee the industry.
Home Affairs Minister Tony Burke said the new rules would ensure that reporting occurs immediately when artificial intelligence goes rogue. Burke argued that laws must keep pace with technology and noted that developers should not be able to claim they were unaware of how a computer was being used. "We need to make sure that the criminal law is up to date for how this new technology is able to act," Burke said.
The review specifically recommended mandatory, time-bound AI safety reporting, including incidents involving misaligned behavior or agentic cyber attacks. This follows revelations that OpenAI did not notify the Australian government of the June breach until mid-September, despite becoming aware of the incident in August. Reports also indicated that OpenAI used AI to assist in writing the notification email sent to Australian authorities.
While the breach involved access to Services Australia data, Prime Minister Albanese characterized the implications for personal privacy as minor. He stated that no personal details were obtained during the incident, though he noted the event remains a serious issue that could have more significant implications in other contexts. The Prime Minister did not confirm whether the OpenAI incident would have violated the proposed laws had they been in effect at the time.
The Labor government is considering six key obligations for AI companies. These include maintaining security controls throughout development and deployment, identifying and managing serious model risks, providing rapid mandatory notification of incidents to the government, and allowing for independent model evaluations. Companies would also be required to publish safety and security frameworks and respond to updated standards as technology evolves.
