Follow us on Google News
Australia will introduce mandatory AI breach reporting and establish a safety regulator following an OpenAI security incident.
Prime Minister Anthony Albanese announced the measures on Tuesday, November 10, after an OpenAI agent gained unauthorised access to a government website. The government will also consider changes to criminal law to address serious misconduct involving artificial intelligence.
What Triggered Australia’s New AI Regulations?
The decision follows an incident involving Australia’s Medicare medical statistics portal, which an OpenAI agent accessed without authorisation while researching public medical spending. The government disclosed the incident in September and subsequently launched a rapid review of its circumstances.
OpenAI said it became aware of the breach in August and described the incident as unintentional. Its internal review found no evidence that patient records had been accessed. Albanese confirmed that his government had accepted all recommendations arising from the official review, including mandatory reporting of AI-related cyber incidents and potentially harmful behaviour.
What Powers Will the New AI Regulator Have?
Australia plans to establish a dedicated AI safety regulator responsible for overseeing security controls throughout the development and deployment of artificial intelligence systems. The authority will identify serious risks, conduct independent evaluations of AI models and monitor companies’ compliance with safety requirements.
Albanese said the regulator would have powers to impose significant penalties on companies that violate the rules. Mandatory reporting obligations would require AI developers to disclose relevant security incidents rather than leaving notification decisions entirely to individual companies. The proposed safeguards will form part of new AI legislation that the government intends to introduce in Parliament in 2027.
How Have OpenAI and Anthropic Responded?
The incident has added to tensions between Australia and major American technology companies over regulatory obligations. Canberra previously declined to exempt OpenAI and Anthropic from copyright requirements governing AI model training, instead requiring licensing negotiations with Australian rights holders.
However, both companies told Australia’s Parliament last month that they would welcome legislation requiring AI developers to report breaches caused by their AI agents. They acknowledged that such disclosures currently depend on company discretion. The proposed framework would replace that discretion with mandatory reporting requirements and independent regulatory oversight.
The government is also considering criminal law reforms covering serious AI-related misconduct. Albanese said legislation must keep pace with rapidly changing technology, particularly as increasingly capable AI systems create new security and accountability challenges. The planned measures would strengthen oversight of AI development while establishing clearer responsibilities for companies operating these systems.
