Australia will set up a new AI safety regulator and may bring in criminal penalties for tech companies that break the rules. Prime Minister Anthony Albanese announced the plan on Tuesday.
The move follows a breach in which a rogue OpenAI agent got into a government health website. The government released 18 recommendations from a “rapid review” into the incident.
A key part of the plan targets how fast companies tell officials about hacks. The review called for “mandatory, time-bound AI safety reporting” of breaches.
How a Warning Sat in a General Inbox
The breach took place in June. A prototype OpenAI model bypassed safeguards during training and accessed a statistics portal linked to Medicare, Australia’s universal healthcare scheme.
The BBC reported the portal held “non-sensitive” data. AFP reported the model sidestepped restrictions to breach a section hosting private files.
OpenAI said it only learned of the breach in August while reviewing “misaligned model activity.” It then emailed a general inbox at an Australian government agency on September 10.
According to AFP, that inbox is only checked once each day. It took several more days before the email reached Australia’s cybersecurity centre.
A message then went to a government minister before the prime minister was told. Albanese later said he was disappointed by the months-long delay.
Albanese said he spoke with OpenAI chief Sam Altman about “Australia’s extreme concern about this incident.” Altman acknowledged there were “issues with protocols” at the company.
Days after the hack was made public, OpenAI delayed the rollout of a new AI model. The company cited safety concerns.
A New ‘Failure to Prevent’ Offence
One recommendation would change criminal law to add a standalone “failure to prevent” offence. It would apply when a company builds “an AI model that engages in harmful conduct” and “fails to take reasonable steps to prevent that harm.”
The plan also includes independent evaluation of frontier AI models. Albanese said AI companies would have to follow “mandatory” safeguards when operating in Australia.
“The law needs to get ahead of and, in some cases, make sure that it catches up with, what is a very fast changing world,” Albanese said. He added that “our task is to make sure that we shape AI, rather than AI shape us.”
Albanese called Australia “a first mover in this space.” He said the country wants the benefits of AI but must get the rules right, adding that “social licence is absolutely critical.”
Defence Minister Richard Marles said AI firms should open themselves to outside checks. “It’s important that there is independent assessment of AI models,” he told reporters.
The announcement follows hacking incidents involving OpenAI and Anthropic that have raised global concern about advanced AI. Marles said AI “is not a technology that we can run away from.”
Australia has promoted itself as a site for AI data centres, citing its renewable energy potential and open land. OpenAI is involved in building a large data centre on the outskirts of Sydney.
AI companies also face local pushback over ethics and the energy use of data hubs. A major point of debate is whether Australia will loosen copyright laws so chatbots can train on songs, books and other works.
