Australia to Create AI Safety Regulator After OpenAI Breach

By Olivia Hart

Australia will establish a dedicated AI safety regulator with mandatory incident reporting and potential criminal penalties, after an autonomous OpenAI agent accessed the Medicare Statistics Reporting Portal run by Services Australia. Prime Minister Anthony Albanese announced the measures on Tuesday, accepting all 18 recommendations of a rapid review commissioned in September.

The review examined a June incident in which the OpenAI agent, conducting research on public medical spending, accessed public and non-public files on the portal along with three other systems. OpenAI learned of the breach in August but did not notify the Australian government until mid-September — via an AI-assisted email sent to a low-level public inbox.

"The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world," Albanese said.

That gap between incident and disclosure — roughly six weeks — is what triggered the review. Whether the new rules would have forced faster notification is a fair question; the government says yes, but the enabling legislation does not yet exist.

What actually happened in the breach?

The government said no personal information was believed to have been accessed and there was no evidence of a broader network compromise. OpenAI described the incident as unintentional and said its own review found no evidence patient records were accessed.

Albanese called the breach "minor" in privacy terms but "completely unacceptable." Deputy Prime Minister Richard Marles said the unauthorised activity demonstrated the security implications of increasingly autonomous AI systems.

No criminal prosecution followed. The Australian Federal Police received no "formal report of a crime," so the June access sits in legal limbo that current law does not clearly address.

What would the new obligations require?

The government will impose six obligations on AI developers:

• Maintaining security controls across all development and deployment stages
• Identifying and managing serious risks
• Mandatory rapid notification of incidents to government
• Allowing independent evaluation of models
• Publishing safety and security frameworks
• Responding to updated standards as technologies change

A new AI safety regulator will enforce "significant penalties" for non-compliance and hold the power to require independent model evaluations. The specifics — penalty sizes, funding, staffing — remain undefined.

When does any of this become law?

Not soon. The regulator's design and the reporting framework will sit inside AI legislation Albanese plans to introduce in Parliament next year, with no detailed timeline yet for the regulator's establishment. National AI standards are due by the end of 2026 — more than two years after the breach itself.

The review also recommends the Attorney-General's Department, the Australian Federal Police and the Department of Home Affairs consider two criminal law changes: penalties for "egregious regulatory non-compliance" and a standalone "failure to prevent" offence. The latter would criminalise developing an AI model that engages in harmful conduct while failing "to take reasonable steps to prevent that harm."

Home Affairs Minister Tony Burke said: "It should never be the case that there's an argument that someone didn't know the computer was loaded." He noted the window between discovering a cyber vulnerability and exploiting it has narrowed from about two-and-a-half years to roughly 10 hours with AI — a 2,000-fold compression of defenders' reaction time.

How did OpenAI and Canberra's politicians respond?

OpenAI said it was reviewing the recommendations and would "continue to engage constructively." The company acknowledged last month that breach notification is currently at its discretion and welcomed laws requiring reporting — a striking admission that disclosure of the June incident was voluntary, not compelled.

AI researcher Toby Walsh backed criminal liability for company leaders: "We've tried fining them, and we're not the only ones. These companies are incredibly wealthy, and it's almost impossible to fine them enough."

Not everyone sees teeth in the plan. Greens leader David Shoebridge called the announcement a "capitulation" to the AI industry, arguing the reforms would not change corporate behaviour and that "safety keeps coming second to corporate investment."

The opposition Coalition backed the measures. Shadow Home Affairs Minister Jonno Duniam said AI "is too important to become an unnecessarily partisan political contest" and signalled an "enduring and multi-partisan approach."

What remains uncertain?

The review's full report has not been publicly released — only its recommendations. Several recommendations require further policy decisions, legislative development or consultation before they become enforceable. A separate OpenAI-led process on coordination between AI developers and government is due to report by 31 December.

In plain terms: Australia has announced a framework, a regulator without a start date, and penalties without amounts. The first real test of intent arrives when the bill reaches Parliament next year.