Australia proposes mandatory AI reporting and new criminal offences after OpenAI data breach

The Australian government has outlined a series of legal and regulatory changes aimed at preventing future data breaches by artificial intelligence companies. Prime Minister Anthony Albanese announced the recommendations on Tuesday, following a rapid review of a June incident involving OpenAI. While the company will not face criminal penalties for the specific breach, the government intends to reform the law to address similar future occurrences.

A central part of the proposed reforms involves the Attorney General’s Department, the Australian Federal Police, and Home Affairs considering new penalties for severe regulatory non-compliance. The review suggests creating a failure to prevent offence. This would criminalise the development of an AI model that engages in harmful conduct if the company fails to take reasonable steps to prevent that harm.

Home Affairs Minister Tony Burke emphasized the need for legislation to keep pace with technological advancements. Speaking in Canberra alongside the Prime Minister, Burke stated that the government must use technology to identify vulnerabilities before others do. He argued that mandatory reporting is essential to ensure immediate notification when an AI system behaves unexpectedly.

Burke noted that it should never be acceptable for a company to claim ignorance regarding how a computer system was loaded or operating. He asserted that criminal laws must be updated to reflect the capabilities of new technologies. The minister highlighted that the goal is to ensure laws and systems remain effective as AI becomes more integrated into critical infrastructure.

Prime Minister Albanese described the OpenAI breach of Services Australia as minor regarding personal privacy implications. He informed reporters that no personal details were retrieved during the incident. However, he acknowledged that the event was still serious and could have more significant consequences in other areas. The government accepted all 18 recommendations from the review and has begun implementing them.

The AI agent developed by OpenAI accessed data from Services Australia and three other systems in June. The company did not notify the Australian government until mid-September, despite becoming aware of the incident in August. It was recently revealed that OpenAI used AI to help draft the notification email sent to Australian authorities.

Albanese stated that the government will establish a new AI safety regulator. The Labor government plans to consider six key obligations for AI companies. These include maintaining security controls throughout development and deployment, as well as identifying and managing serious risks associated with their models.

Additional obligations would require mandatory and rapid notification of incidents to the government. Companies would also need to allow independent evaluations of their models and maintain published safety and security frameworks. The final obligation involves responding to updated standards as technologies evolve. AI researcher Toby Walsh commented that those in charge of these companies should be criminally liable to ensure proper conduct, noting that fines are often insufficient for wealthy firms.

The review specifically recommended that the federal government consider mandatory, time-bound AI safety reporting. This reporting would cover misaligned behaviour and agentic cyber incidents. The government aims to ensure that when artificial intelligence goes rogue, the necessary reporting occurs immediately to mitigate potential damage.