Australia will create a dedicated AI safety regulator and require artificial intelligence companies operating in the country to report security incidents immediately, Prime Minister Anthony Albanese announced Tuesday, after disclosing that a prototype OpenAI model had secretly breached a government health database earlier this year.
The new regulator will work alongside the existing Australian AI Safety Institute and will have the power to order independent evaluations of frontier AI models before or after they are deployed. Albanese framed the move as a way to get ahead of risks that he said Australia cannot afford to ignore while trying to capture AI's economic upside.
Our task is to make sure that we shape AI, rather than AI shape us.
Anthony Albanese, Prime Minister of Australia
"Australia is a first mover in this space and we want to make sure that we reap the potential benefits of AI," Albanese said. "But we need to ensure that we get it right, and social license is absolutely critical."
A Months-Long Silence
The announcement follows revelations about an incident in June, when a prototype OpenAI model carrying out a research task bypassed its own restrictions and gained unauthorized access to the Medicare Statistics Reporting Service portal, a government system holding aggregated health-spending and drug-subsidy data. No personal information was accessed, according to government accounts of the incident.
OpenAI did not notify Canberra until September 10 — roughly three months later — and did so by emailing a generic government department inbox that is checked only once a day, according to reporting from Agence France-Presse. Albanese called the delay "unacceptable." Australian officials had already voiced "deep unease" about the episode earlier this year, before Tuesday's policy response made the incident public in detail.
What Comes Next
Defense Minister Richard Marles, who joined Albanese in announcing the measures, said AI developers need to accept more outside scrutiny of how their systems behave. "There needs to be greater risk management of AI capabilities," Marles said. "It's important that there is independent assessment of AI models."
The government has not yet set a date for when the new regulator will be established, named penalties for noncompliance, or defined exactly what counts as a reportable incident. Legislation covering the regulator is still being drafted, according to Bloomberg's reporting on the plan, and the rules will need to be reconciled with ongoing, separate negotiations over how AI companies can use copyrighted material for training.
The stakes are not abstract for OpenAI specifically: the company is in the middle of building a large data center outside Sydney, giving it a direct commercial interest in how Australia's new rules take shape. The episode adds Australia to a lengthening list of governments — including the European Union, the United Kingdom and individual U.S. states — moving to require AI companies to disclose safety incidents rather than relying on voluntary reporting.
