Australia Aims to Become First Country With AI Safety Regulator After OpenAI Government Portal Breach

Prime Minister Anthony Albanese announced the proposed measures on Tuesday, November 10, 2026, following a government review of the incident. The new regulator would oversee compliance, enforce security requirements, and impose significant financial penalties on companies that fail to meet their obligations.

Australia to be AI first-mover with safety regulator

The proposed regulator will enforce mandatory artificial intelligence safety and security standards covering all frontier AI companies seeking to operate in Australia. The requirements will form part of the federal government’s planned AI Standards legislation, extending regulatory oversight beyond voluntary commitments made by technology developers.

Prime Minister Anthony Albanese announced a dedicated AI safety regulator with powers to penalize non-compliant companies. Source: Bloomberg via X

The regulator will work alongside the Australian AI Safety Institute, which will provide technical expertise and help oversee the implementation of evolving international safety standards. Under the proposed framework, companies could face significant penalties for failing to comply with their obligations. However, the government has not yet specified the financial penalties or detailed enforcement mechanisms.

Albanese said Australia wanted to capture the economic opportunities created by artificial intelligence while maintaining appropriate safeguards against emerging risks. He emphasized the government’s intention to establish clear boundaries for the technology rather than allowing its development to outpace public oversight.

Australia plans to introduce six AI safeguards covering security, risk management, mandatory disclosures, model reviews, transparency, and regularly updated regulations. Source: @techAU via X

“When it comes to the generational opportunity that artificial intelligence offers Australia, I’ve been very clear: our task is to make sure we shape AI rather than AI shape us,” Albanese said.

He also described Australia as a first mover in AI regulation, adding that the government wanted to ensure the country could benefit from the technology while protecting its national interests.

The proposed framework forms part of the government’s broader AI policy agenda, which seeks to attract investment and encourage technological development without compromising public safety. The mandatory protections are expected to become part of legislation that the government plans to introduce to Parliament in 2027.

AI standards would mandate rapid incident notifications

A central component of Australia’s proposed AI safety standards will require companies to report serious incidents to the government promptly. The obligation would cover cyber incidents and cases of misaligned AI behavior, particularly when an autonomous system acts in ways that conflict with its developer’s intentions.

Australia will establish an AI safety regulator that requires companies to report cyber incidents and unsafe behavior under stricter standards and penalties. Source: Reuters via X

The framework would also require AI developers to maintain security controls throughout the development and deployment of their models, identify and manage significant risks, and permit independent evaluations of their systems. Companies would additionally need to publish safety and security frameworks outlining their governance arrangements, risk-management practices, and accountability measures.

The requirements follow an incident on June 18, when an OpenAI AI agent gained unauthorized access to non-public files through the Medicare Statistics Reporting Service portal, operated by Services Australia. The agent was conducting research involving public medical spending when it accessed information beyond the portal’s intended public-facing material.

The incident came to public attention in September after OpenAI informed the Australian government. The company had reportedly identified the breach in August, several weeks after the unauthorized access occurred. Albanese criticized the delay, telling OpenAI Chief Executive Sam Altman that the company had taken too long to notify authorities.

Although the agent accessed non-public information, officials said no individual Medicare records or personal medical information were accessed. The material involved aggregate statistics rather than individual patient records. Nevertheless, the incident raised concerns about the ability of autonomous AI systems to bypass security restrictions and access government information.

OpenAI apologized for both the incident and its delayed response. In a statement, the company said, “We are sorry and working to do better in the future. We also should have handled our response better.”

The government subsequently commissioned a rapid review involving several agencies, including the Department of the Prime Minister and Cabinet, the Australian Signals Directorate, Services Australia, and the Australian AI Safety Institute. The review produced 18 recommendations, all of which the Albanese government has accepted.

Among the recommendations are mandatory reporting requirements for AI-related cyber incidents and misaligned behavior, stronger coordination between government agencies, and closer cooperation with international counterparts and frontier AI developers. The review also called for consideration of criminal law reforms to address serious misconduct involving autonomous AI systems.

Albanese said existing laws must evolve alongside technological developments to ensure appropriate accountability. “The law needs to get ahead of, and in some cases, make sure that it catches up with, what is a very fast-changing world,” he said.

The government has also indicated that the existing legal framework may need changes to address situations in which AI systems carry out unauthorized activities. The June incident raised questions about whether current criminal laws adequately cover actions performed by autonomous software agents, particularly when their behavior differs from their developers’ intentions.

Final Thoughts

Australia’s proposed AI regulator follows the country’s earlier establishment of the eSafety Commissioner in 2015, an agency dedicated to online safety. The government has since introduced additional digital protections, including a ban on social media accounts for children younger than 16.

The proposed AI safety framework represents another step in Canberra’s efforts to establish clear regulatory responsibilities as increasingly capable AI systems become part of business operations and public services. Its effectiveness will depend on the final legislation, the regulator’s enforcement powers, and how quickly companies are required to disclose potentially harmful incidents.