Australia will introduce mandatory breach reporting for artificial intelligence companies and establish a dedicated AI safety regulator following an incident in which an OpenAI agent gained unauthorised access to a government website.
Prime Minister Anthony Albanese announced on Tuesday that the government had accepted all recommendations from an independent review into the incident, which involved Australia’s Medicare medical statistics portal.
The AI agent accessed the portal while conducting research into public medical spending. The breach, disclosed by the government in September, prompted an urgent examination of how AI systems are monitored and secured.
The government’s response will include mandatory reporting requirements for AI companies when their systems display misaligned behaviour or become involved in cybersecurity incidents.
Albanese also said the government would consider changes to criminal law to address cases involving serious misconduct by AI systems.
“The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world,” the Prime Minister said.
OpenAI previously said it became aware of the incident in August and described the access as unintentional. Its internal review found no evidence that patient records had been accessed by the AI agent.
Australia to establish AI safety regulator
The Albanese government will establish an AI regulator to oversee security measures throughout the development and deployment of artificial intelligence systems.
The proposed regulator will be responsible for identifying serious risks, conducting independent evaluations of AI models and enforcing penalties against companies that fail to meet their obligations.
Albanese said the regulator would have the power to impose significant penalties on AI companies found to have breached the rules.
The new mandatory safety and security requirements will form part of the government’s planned AI legislation, which it intends to introduce to Parliament in 2027.
Tech companies support mandatory reporting
The Medicare incident has intensified tensions between the Australian government and major US technology companies.
Canberra has also resisted calls from OpenAI and Anthropic for exemptions from copyright requirements covering the use of protected material to train AI models. Instead, the government expects companies to negotiate licensing arrangements with Australian rights holders.
However, both companies told a parliamentary hearing last month that they would support laws requiring AI developers to report data breaches caused by their AI agents.
They acknowledged that companies currently have discretion over whether to notify authorities about such incidents.
The proposed reforms would introduce a more formal accountability framework as AI systems become increasingly capable of interacting with government platforms, sensitive information and critical digital infrastructure.