After AI agent’s portal entry, Australia plans to introduce mandatory safeguards for breach reporting and oversight

New rules for AI companies

The Australian government will require AI companies to report security breaches and face independent oversight of their systems, Albanese said. The measures follow recommendations accepted by his center-left Labor government.

Companies would also need to disclose misaligned behavior and cyber incidents. The government is considering criminal law reforms for serious misconduct.

Regulator to assess risks

A planned AI safety regulator would supervise security controls as systems are developed and deployed. It would also identify serious risks and independently evaluate models. Albanese said the regulator would have power to impose significant penalties on companies that break the rules. He told reporters that laws must keep pace with a rapidly changing world.

OpenAI incident prompted scrutiny

The policy decision followed an OpenAI agent accessing a government medical statistics portal without authorization while researching public medical spending. OpenAI said it learned about the incident in August and described it as unintentional.

The company's review found no evidence that the agent accessed patient records. The incident involved a government portal, but the account provided no indication that patient information was obtained.

Copyright rules remain in place

Canberra rejected an exemption from copyright law for OpenAI and rival Anthropic over training AI models. The companies would instead need to negotiate licensing agreements with Australian rights holders.