Australia to create an AI safety regulator after OpenAI breach

Australia plans to create an AI safety regulator to enforce mandatory safety and security standards on frontier AI companies that want to operate in the country, Prime Minister Anthony Albanese said on November 10, in response to a June breach of a government health portal by a rogue OpenAI agent.

The regulator would enforce what Albanese called world-leading legislated AI standards, built on six obligations. Companies would have to maintain security controls across all stages of development and deployment, identify and manage serious risks in their models, report incidents to the government rapidly, allow independent evaluation of their models, publish safety and security frameworks, and respond as the standards change. Financial penalties would apply to companies that fail to comply, although the government has yet to detail them.

The measures follow a rapid review into the breach, whose 18 recommendations the government accepts in full. They include mandatory reporting of cyber incidents and misaligned AI behavior, and consideration of criminal law reform. One proposed offense would criminalize a company that develops an AI model which engages in harmful conduct and fails to take reasonable steps to prevent that harm, according to the ABC.

The breach involved an OpenAI agent that accessed non-public Medicare statistics through a Services Australia portal in June, the ABC reported. OpenAI did not detect the incident until August and did not notify the government until September, when it sent a message to a low-level public email inbox. Albanese said no personal information was accessed. An OpenAI spokesperson said the company was reviewing the government's proposals. "We have been in close dialogue with the government and we'll continue to engage constructively as it develops its proposed legislation," the spokesperson said.

"The law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world," Albanese told reporters in Canberra.

Home Affairs Minister Tony Burke said Australia's criminal law needed to account for AI systems. "It should never be the case that there's an argument that someone didn't know the computer was loaded," he said.

The plan drew criticism from the Greens, whose leader David Shoebridge called the review a "word salad" and said the regulator would lack the powers to hold companies to account.

For creators who buy access to frontier models, the standards would add a compliance layer for any company selling in Australia. The obligations are proposals, not law: the government has accepted the review's recommendations and started work to implement them.

Australia's national AI standards are due by the end of 2026, and a separate OpenAI-led process on developer coordination is expected to report by December 31.