Australia Introduce Mandatory Reporting for AI Firms After OpenAI Breach
Prime Minister Anthony Albanese said on Tuesday that Australia will set up an AI safety regulator and require AI companies to report incidents quickly. The move follows a June breach of a Medicare statistics portal by an OpenAI agent. OpenAI faces no criminal penalties.
Australia will introduce mandatory reporting of serious artificial intelligence incidents and create a new AI safety regulator, Prime Minister Anthony Albanese announced on Tuesday, November 10, 2026. The plan follows a June breach in which an AI agent built by OpenAI accessed government data.
OpenAI will not face criminal penalties over the breach of a Medicare statistics reporting service portal run by Services Australia. Albanese said the government wants to change criminal law so future breaches by AI companies can be prosecuted.
What the review found
Albanese released the recommendations of a "rapid review" into the incident. He did not publish its findings or the full report, but committed to releasing it in future.
The review made 18 recommendations. "We accept all of the recommendations and we've commenced work to implement them," Albanese said.
The OpenAI agent accessed data from Services Australia and three other systems in June. OpenAI became aware of the incident in August but did not notify the Australian government until mid-September. That delay drew criticism from Labor and Albanese.
Guardian Australia revealed last month that OpenAI used AI to help write the email notifying Australian authorities.
New obligations and possible offence
Albanese said the government will put six key obligations on AI companies. They are:
- maintaining security controls across all stages of development and deployment;
- identifying and managing serious risks linked to their models;
- notifying the Australian government of incidents rapidly;
- allowing independent evaluation of their models;
- maintaining and publishing safety and security frameworks;
- responding to updated standards and rules as technologies change.
The review also recommended the government "consider mandatory, time-bound AI safety reporting". That includes cases where AI agents behave in ways their creators may not have intended.
A key recommendation asks the attorney general's department, the Australian federal police and home affairs to consider a "failure to prevent" offence. It would criminalise developing an AI model that engaged in harmful conduct while failing "to take reasonable steps to prevent that harm". They would also consider "penalties for egregious regulatory non-compliance".
Government and expert reaction
Home Affairs Minister Tony Burke said companies should not be able to argue that no one knew the risk. "It should never be the case that there's an argument that someone didn't know the computer was loaded," he told reporters.
Burke said mandatory reporting "when artificial intelligence goes rogue" is meant to ensure reports happen "immediately".
Albanese called the Services Australia breach "minor" for personal privacy. "The clear indication is that no information was got that involves people's personal details," he said. He added that it was still a serious issue and that other areas might face more serious consequences.
Albanese did not directly answer whether the June incident would have breached the proposed laws. Government sources indicated the new legislation would cover similar future incidents. Guardian Australia understands OpenAI is unlikely to face further legal proceedings. OpenAI was contacted for comment.
AI researcher Toby Walsh said the people running these companies need to be criminally liable to ensure they do the right thing.
