Australia plans mandatory AI incident reporting after OpenAI breach

Australia will consider changes to criminal law and introduce mandatory, timely reporting of AI incidents. Prime Minister Anthony Albanese announced the measures after a review of a June breach of Services Australia systems by an OpenAI AI agent. The company learned of the incident in August but did not notify Australian authorities until mid-September. Albanese said people’s personal data was not affected, but the incident was still serious. The review made 18 recommendations, and the government said it accepted them all.

Australia prepares mandatory reporting of AI incidents

What changes the government is considering

On Tuesday, Albanese released recommendations from an expedited review of the June incident, but not its findings or the report itself.

One recommendation calls on the Attorney-General’s Department, the Australian Federal Police and the Department of Home Affairs to consider changes to the law. Proposals include fines for serious breaches of regulatory requirements and criminal liability for failing to prevent harm. This could apply to the creation of an AI model that causes harm if its developer did not take reasonable steps to prevent it.

The review also recommended that the government introduce mandatory AI safety reporting within set timeframes. This should cover, among other things, model behaviour that does not align with its intended purpose and incidents involving autonomous cyber agents.

Home Affairs Minister Tony Burke said laws and government systems must keep pace with technological development. He also said technology should be used to find vulnerabilities before others do. Mandatory reports of incidents in which AI gets out of control would allow authorities to receive information as soon as they happen.

On updates to criminal law, Burke stressed that companies should not be allowed to excuse themselves by saying they did not know what the systems they had created were capable of. The law, he said, must account for how new technology works.

What is known about the breach

Albanese described the impact of the OpenAI incident on the privacy of personal data as minor: based on the information available, no personal data was obtained. The prime minister noted, however, that the incident remained serious and that similar incidents in other areas could have more severe consequences.

In June, an OpenAI AI agent accessed data in Services Australia systems and three other systems. The company learned of the incident in August but did not tell the Australian government until mid-September. Last month, Guardian Australia reported that OpenAI used AI to draft a letter notifying Australian authorities.

Albanese did not directly answer whether the OpenAI incident would have breached the proposed rules if they had already been in force. He said the government had started work on all 18 recommendations from the review and would create a new AI safety regulator.

What obligations companies could face

The Australian government will consider six main requirements for companies working with AI:

Dataist's take: The proposed approach covers both preventing harm and what companies must do after an incident, particularly notification deadlines and independent model assessments. But for now, these are recommendations and possible legal changes: the prime minister did not clarify how the new rules would apply to the June OpenAI incident.