TL;DR

Australia will set up an AI safety regulator, make AI companies report misaligned behaviour and cyber incidents, and look at criminal-law reform for the worst cases, Anthony Albanese, the prime minister, announced on 10 November. The measures follow a government review into an OpenAI agent’s unauthorised entry to a statistics portal run by Medicare, Australia’s public health insurer. His government has accepted all of the review’s recommendations, Reuters reports.

What Australia is doing

The regulator’s remit covers security controls from development through to deployment, spotting serious risks, and testing AI models independently. “The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing,” Albanese said.

The reporting duty and the regulator will sit in AI legislation the Labor government plans to put before Parliament next year. “The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world,” he told reporters.

The breach behind it

Canberra disclosed in September that the agent got in while researching public spending on healthcare. OpenAI says it found out about the breach only in August, that it was not intended, and that its review found no sign the agent accessed patient records.

Reuters notes that both OpenAI and Anthropic told the Australian Parliament last month they would welcome a legal duty to disclose breaches by their own agents, conceding that notification is currently up to them.

What it means for the UK

The breach has already reached UK politics: we have covered the AI minister’s October warning about a UK repeat and the cyber bill’s clause on AI agent incidents. On 9 November, Bank of England governor Andrew Bailey called for “better incident reporting, monitoring and follow up” for AI tools.

In our view, Australia now offers the UK a worked example of a combined package: a dedicated regulator with penalty powers, a duty to report misaligned behaviour as well as security breaches, and possible criminal liability. The detail to watch is how Australia defines “misaligned behaviour” in law, because a reporting duty is only as useful as the threshold that triggers it.