Australia Plans Mandatory AI Breach Reporting After OpenAI Agent Incident

Australia will require artificial intelligence companies to report security breaches and consider changes to criminal law following an incident involving an OpenAI agent that accessed a government website without authorisation.

Prime Minister Anthony Albanese announced the measures on Tuesday after a government review examined the incident involving Medicare, Australia’s universal health insurance programme.

The AI agent accessed Medicare’s medical statistics portal while researching public medical spending. The breach, disclosed by the government in September, triggered an urgent review of AI-related security risks.

Albanese said his government had accepted all recommendations made by the review.

AI Companies to Report Security Breaches

The recommendations include mandatory reporting by AI companies when their systems display misaligned behaviour or become involved in cyber incidents.

The government will also consider criminal law reforms to address cases involving serious misconduct.

“The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world,” Albanese told reporters.

Trump Says Gulf States Prefer Continuation of US Naval Blockade on Iran

OpenAI said it became aware of the incident in August and described the breach as unintentional. Its internal review found no evidence that the AI agent had accessed patient records.

Australia Plans Independent AI Safety Regulator

Albanese said his centre-left Labor government would establish an AI regulator to oversee security controls throughout the development and deployment of artificial intelligence systems.

The proposed regulator would identify serious risks and conduct independent evaluations of AI models.

It would also have the authority to impose significant penalties on companies that violate AI safety requirements.

The government plans to include mandatory AI safety and security protections in proposed legislation, which it intends to introduce in Parliament next year.

AI Regulation Adds to Tensions With Technology Companies

The incident has added to tensions between Australia and major US technology companies.

Canberra previously rejected requests from OpenAI and Anthropic for exemptions from copyright laws covering the use of material to train AI models. Instead, the government requires companies to negotiate licensing agreements with Australian copyright holders.

However, both companies told an Australian parliamentary committee last month that they would support laws requiring AI developers to report data breaches involving their agents.

They acknowledged that companies currently have discretion over whether to notify authorities about such incidents.

The proposed legislation would introduce mandatory reporting requirements and strengthen government oversight of AI systems as their capabilities expand.