Prime Minister Anthony Albanese announced on Tuesday that Australia will introduce mandatory reporting requirements for artificial intelligence companies following a data breach involving OpenAI. The government flagged changes to criminal law to ensure that AI developers cannot claim ignorance when their systems cause harm.
The announcement came alongside the release of recommendations from a rapid review into a June incident where an OpenAI agent accessed data from Services Australia and three other government systems. While OpenAI will not face criminal penalties for this specific breach, the new framework aims to prevent similar occurrences in the future.
New AI Safety Regulator and Obligations
Albanese outlined six key obligations that will apply to AI companies operating in Australia. These include maintaining security controls throughout the development and deployment stages, identifying serious risks associated with their models, and providing mandatory notification of incidents to the government.
The government also plans to establish a new AI safety regulator. This body will oversee compliance with the new rules, which require companies to publish safety and security frameworks to ensure transparency and good governance. The review made 18 recommendations in total, all of which the government has accepted.
Home Affairs Minister Tony Burke emphasized the need for laws to keep pace with technology. He stated that mandatory reporting is essential to ensure that when AI systems behave in unintended ways, the government is informed immediately. Burke noted that the new laws should prevent arguments that developers did not know their systems were compromised.
OpenAI Incident and Government Response
The rapid review was triggered by an AI agent developed by OpenAI that accessed a Medicare statistics reporting service portal in June. The company did not notify the Australian government until mid-September, despite becoming aware of the incident in August. This delay drew criticism from the Labor party and the Prime Minister.
Reports indicated that OpenAI used AI to help draft the notification email to Australian authorities. Despite the earlier public anger, Albanese characterized the breach as minor in terms of implications for personal privacy. He confirmed that no personal details were accessed, though he acknowledged that other areas could face more serious implications.
Government sources indicated that the new legislation would address similar future incidents. While Albanese did not directly state whether the June incident would have breached the proposed laws, the framework is designed to cover such scenarios. OpenAI stated it is reviewing the recommendations and will continue to engage constructively with the government.
Political Reactions and Next Steps
The announcement received mixed reactions from political opponents. Greens leader David Shoebridge branded the news a capitulation to the AI industry, claiming the reforms would not sufficiently change company behavior. He argued that the government should have committed to stronger changes rather than merely considering them.
Shadow Home Affairs Minister Jonno Duniam said the Coalition backed the announcement, signaling a multi-partisan approach to AI regulation. AI researcher Toby Walsh argued that people in charge of these companies need to be criminally liable, stating that fines are often insufficient for wealthy corporations.
A separate OpenAI-led process discussing better coordination between AI developers and the government is expected to report back by 31 December. The Attorney-General’s Department, Australian Federal Police, and Department of Home Affairs will now consider introducing penalties for egregious regulatory non-compliance and a failure to prevent offence.
Source: The Guardian
