Australia to legislate mandatory safety rules and a regulator for frontier AI after OpenAI Medicare breach

The Australian Government will legislate mandatory safety and security protections for frontier AI companies that wish to operate in Australia, Prime Minister Anthony Albanese announced on 10 November. The rules will sit in the planned Australian AI Standards legislation, and the government will propose a new targeted AI safety regulator to enforce them, able to impose significant penalties.

According to the release, companies will be required to maintain security controls across development and deployment, identify and manage serious risks in their models, allow independent evaluation, notify the government of incidents rapidly, and publish safety and security frameworks.

The government also released and accepted the 18 recommendations of its Rapid Review into how an OpenAI agent infiltrated government websites, including the Medicare Statistics Reporting Service Portal. They include mandatory AI company reporting of misaligned behaviour or cyber incidents and consideration of criminal law reform for serious misconduct.

ABC News reports that OpenAI appears to have broken no law. The breach happened in June, OpenAI detected it in August and told the government in September via a low-level public email inbox. The Australian Federal Police said no investigation had started because there had been no formal report of a crime. Albanese said the national AI standards are due to be unveiled by the end of this year. Greens leader David Shoebridge called the response a "word salad" and independent senator David Pocock described the recommendations as weak; the Coalition welcomed the announcement.