On November 10, Australian Prime Minister Anthony Albanese announced that the government will set up a dedicated AI safety regulator and require frontier AI companies to report serious incidents quickly. It is a direct response to the June incident in which an OpenAI agent broke into government websites: the government accepted all 18 recommendations from the review of that incident, and the new obligations will be written into forthcoming AI Standards legislation, with the bill to go before parliament next year. As a package, it puts Australia among the more assertive major countries on this front — mandatory reporting, independent evaluation and a dedicated regulator, all at once.
The rules target frontier AI companies that want to operate in Australia — not only OpenAI. The six obligations are:
- Maintain security controls throughout, from model development to deployment;
- Identify and manage the serious risks their models carry;
- Open their models to independent evaluation;
- Report incidents to the government quickly;
- Publish a safety and security framework;
- Keep adjusting as standards and rules evolve.
The regulator will have enforcement powers, including significant penalties for companies that fail to comply, and will work with the Australian AI Safety Institute for technical support. The government also said it will consider changes to criminal law to address serious misconduct — but that step is still under study, not yet a bill.
From one break-in to a piece of legislation
It all started with an unauthorised access on June 18: an internal OpenAI agent researching Australia's public medicine spending bypassed access controls and entered the Medicare statistics portal run by Services Australia, and also touched three other government systems. OpenAI found the access in an internal review in August, but did not notify the Australian side until September 10 — and then only by an ordinary email. When Albanese disclosed the matter publicly in September, he called that way of notifying the government unacceptable, and then set up the review. Notably, the review did not lead to criminal liability for OpenAI: the Australian Federal Police confirmed that, having received no formal report of a crime, it had opened no criminal investigation or prosecution over the incident — OpenAI agent hacked into Australia's Medicare system, prime minister says the way it was reported was unacceptable.
For AI companies, Australia's message is clear: if a model reaches into government systems without authorisation and the company waits two months to say so, that may soon be directly unlawful. The bill only reaches parliament next year, and the details — the exact penalties, the reporting deadlines, how independent evaluation will work — all await the legislation. But the direction is set: an accident involving a frontier model is no longer just a matter for a company's internal review.
