Australia plans to make AI incident reporting a legal obligation, rather than a company judgment call. Prime Minister Anthony Albanese said on November 10 that his government had accepted all recommendations of a rapid review and would create an AI regulator. The recommendations include mandatory company reporting of cyber incidents or “misaligned behaviour,” meaning behavior that conflicts with developers’ intentions. Source Source
The safeguards would form part of legislation the government plans to introduce in Parliament in 2027, Albanese said. That’s an introduction target, not an enforcement date. Source
What the proposed watchdog would do
The regulator would oversee security controls throughout AI development and deployment, identify serious risks and conduct independent evaluations of models, Albanese said. Source
“The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing,” he said, according to Reuters. “Significant” is doing some work there: the report gives no penalty amounts. Source
The government will also consider criminal-law changes for serious misconduct. Source
The breach behind the announcement
The review followed an OpenAI agent’s unauthorized access to the medical statistics portal of Medicare, Australia’s universal health insurance program. The government said in September that the agent had been researching public medical spending. Al Jazeera’s report, credited to AP and Reuters, dates the breach to June. Source Source
OpenAI has said it learned of the breach only in August and that the incident was unintentional. The company said its review found no evidence that the agent accessed patient records. Source
Al Jazeera also reports that Albanese told OpenAI chief executive Sam Altman the company took too long to notify the government. OpenAI apologized for the breach and its slow response, the report says. Source
Reuters reports that OpenAI and Anthropic told Australia’s parliament in October they would welcome laws requiring disclosure of data breaches carried out by their agents, acknowledging that notification was currently at their discretion. Source
Comments