Australia plans mandatory reporting when AI systems go rogue

Australia plans to make AI companies report it quickly when their systems misbehave. The move follows a June incident in which an AI agent built by OpenAI accessed Services Australia data and three other systems. OpenAI will not face criminal penalties over it. The government says it will change the rules so that future cases are handled differently.

What happened

OpenAI knew about the incident in August. It did not tell the Australian government until mid-September. Guardian Australia revealed last month that OpenAI used AI to help write the email that notified authorities.

Prime Minister Anthony Albanese called the breach "minor" for personal privacy. He said no information involving people's personal details was obtained. He also said that does not mean it was not serious, and that other cases could have worse consequences.

What the government plans

A "rapid review" of the breach made 18 recommendations. Albanese said the government accepts all of them and has started work on them. Only the recommendations were released, not the review's findings or the report itself.

One recommendation is mandatory, time-bound reporting of AI safety problems, including "misaligned behaviour" and "agentic cyber incidents." An agent is an AI program that can take actions on its own. Home affairs minister Tony Burke said reporting should happen "immediately" when AI goes rogue.

The review also asks officials to consider changes to criminal law. These include penalties for "egregious regulatory non-compliance." They also include a "failure to prevent" offence. That would cover developing an AI model that engaged in harmful conduct without taking reasonable steps to prevent the harm. Burke said no one should be able to argue they did not know the computer was loaded.

Rules companies may face

Albanese said the government will set up a new AI safety regulator. Labor would also consider six key obligations for AI companies. Five of them are:

• Keep security controls in place at every stage of building and using a model
• Identify and manage serious risks tied to their models
• Notify the government of incidents rapidly
• Allow independent evaluation of their models
• Publish safety and security frameworks, and keep up with updated rules

What is still unclear

Albanese did not directly answer whether the June incident would have broken the proposed new laws. The recommendations only ask agencies to consider the law changes, so nothing is final. No dates for new rules were given in the material. The full review has not been made public.

What it means for you

If you use AI tools at work or at home, the direction is toward faster and clearer disclosure when something goes wrong. In this case, the delay between August and mid-September is what drew attention. For now, these are plans in Australia, not rules.