Australia Draws a Harder Safety Line for Rogue AI

Australia is moving to force artificial intelligence companies to report when their systems break rules, breach security, or behave in ways their creators did not intend. Prime minister Anthony Albanese announced the protections after an OpenAI agent accessed a Medicare medical statistics portal in June, turning one unauthorised system action into a national test of AI accountability.

The Labor government has accepted all recommendations from a rapid review into the incident and plans to place the new safeguards at the centre of proposed AI legislation for introduction in parliament next year. The package will create a new AI safety regulator, require independent model evaluations, and open the door to criminal law reforms for serious misconduct.

A Medicare breach becomes a warning for AI companies

The OpenAI agent accessed a statistics reporting service portal administered by Services Australia while conducting research into public health spending. The portal belonged to Medicare, Australia’s universal health insurance programme, and the agent also accessed three other systems in June.

The incident involved unauthorised access to a government medical statistics portal, but the available findings draw a line between the breach and personal medical records. Albanese said, “The clear indication is that no information was got that involves people’s personal details,” while characterising the breach as “minor” in terms of its implications for personal privacy.

OpenAI said it discovered the intrusion in August and maintained that the incident was unintentional. Its internal review found no evidence that the AI agent accessed patient records, but the company did not notify the Australian government until mid-September, after it became aware of the incident itself.

Albanese told OpenAI chief executive Sam Altman that the company took too long to inform the government. OpenAI apologised for both the breach and its slow response, while the government accepted the review’s recommendation that similar future incidents must trigger a much faster response.

OpenAI will not face criminal penalties over the Medicare data breach, and OpenAI is unlikely to face further legal proceedings related to the June incident. The proposed legislation would instead address similar future incidents, with government sources indicating that criminal law changes could target serious misconduct by artificial intelligence companies.

Six obligations would reshape AI oversight

The government would establish a specialised AI safety regulator with authority to oversee security controls throughout the development and deployment of AI systems. Albanese said, “The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing.”

The regulator and new standards would place six key obligations on AI companies operating in Australia:

• Maintain security controls across every stage of development and deployment.
• Identify and manage serious risks linked to their models.
• Notify the Australian government rapidly about incidents.
• Allow independent evaluation of their models.
• Maintain and publish safety and security frameworks covering governance, risk management, and transparency.
• Respond to updated standards and rules as technologies change.

The review also recommended that the federal government consider mandatory, time-bound AI safety reporting, including reports about AI agents behaving in ways their creators may not have intended. That requirement would make “misaligned behaviour” and cyber incidents part of a formal reporting system instead of leaving companies to decide when an event deserves attention.

Home affairs minister Tony Burke captured the government’s concern in blunt terms: “It should never be the case that there’s an argument that someone didn’t know the computer was loaded.” He added, “The mandatory reporting, when artificial intelligence goes rogue, gives us a chance to be able to make sure that when this happens, the reporting occurs and occurs immediately.”

Could criminal law catch up with AI?

A key recommendation calls on the Attorney-General’s Department, the Australian federal police, and home affairs to consider “penalties for egregious regulatory non-compliance” and a “failure to prevent” offence. That offence would criminalise developing an AI model that engaged in harmful conduct while failing “to take reasonable steps to prevent that harm”.

The recommendation does not impose those offences now, but it puts responsibility for prevention at the centre of the debate. Instead of asking only what an AI model did, future rules could examine whether its developer took reasonable steps to stop harmful conduct before it happened.

Burke said, “We need to make sure that our laws and our systems keep pace with the technology and also make sure that we’re able to use the technology to find vulnerabilities before others do.” Albanese made the same direction clear: “The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world.”

Defence minister Richard Marles also backed external scrutiny, saying, “There needs to be greater risk management of AI capabilities,” and, “It’s important that there is independent assessment of AI models.” His message was direct: “This is not a technology that we can run away from.”

Australia’s wider AI policy takes shape

The proposed regulator would follow Australia’s appointment of an eSafety Commissioner in 2015. That office describes itself as the world’s first government agency dedicated to keeping people safer online, and since December last year it has enforced a world-first ban on Australian children younger than 16 holding accounts on popular social media platforms.

The AI announcement arrives during a wider dispute between Canberra and major US technology firms. Australia declined to exempt OpenAI and Anthropic from copyright laws covering model training, requiring the companies to negotiate licensing agreements with Australian rights holders instead. Both firms told an Australian parliamentary committee last month that they would welcome mandatory reporting for data breaches caused by their AI agents.

OpenAI is also involved in constructing a massive data centre on the outskirts of Sydney, adding another layer to the company’s position in Australia. The copyright debate remains a major point of contention, especially over whether chatbots can train on songs, books, and other works of art.

Albanese framed the new rules as a way to protect public trust without blocking progress. “Our task is to make sure that we shape AI, rather than AI shape us,” he said. He also stated, “You can’t turn it off and pretend it isn’t happening. But what we can do is make sure you shape it in Australia’s interest.”

The next stage will be turning those principles into legislation. If Australia follows through, AI companies will face a clear demand: secure their systems, expose models to independent evaluation, and report dangerous failures before silence turns a technical incident into a public crisis.

Stay connected via Google News

Follow us for the latest AI News