Australia to introduce mandatory reporting after OpenAI hack as AI laws are tightened

Australia is set to introduce mandatory reporting to stop artificial intelligence from 'going rogue' after the OpenAI hack. OpenAI will not face criminal penalties over the Medicare hack, but the prime minister has flagged changes to criminal law to crack down on future breaches by artificial intelligence companies.

Prime Minister Anthony Albanese on Tuesday released the recommendations of a 'rapid review' into the June breach, but not the findings or the report itself.

A key recommendation is for the attorney-general's department, the Australian federal police and home affairs to consider reforming the law to introduce 'penalties for egregious regulatory non-compliance' and a 'failure to prevent' offence. Under that offence, developing an AI model that engaged in harmful conduct would be criminalised if the company failed 'to take reasonable steps to prevent that harm'.

The review recommended the federal government 'consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents'.

Home Affairs Minister Tony Burke told reporters: 'We need to make sure that our laws and our systems keep pace with the technology and also make sure that we're able to use the technology to find vulnerabilities before others do.'

Standing alongside the prime minister in Canberra, Burke said: 'The mandatory reporting, when artificial intelligence goes rogue, gives us a chance to be able to make sure that when this happens, the reporting occurs and occurs immediately.'

On the concept of updating criminal law, Burke said: 'It should never be the case that there's an argument that someone didn't know the computer was loaded.' He added: 'We need to make sure that the criminal law is up to date for how this new technology is able to act.'

Albanese on Tuesday characterised OpenAI's breach of Services Australia as 'minor' in terms of the implications for personal privacy. 'The clear indication is that no information was got that involves people's personal details,' the prime minister told reporters in Canberra.

He added: 'All of that was confirmed essentially ... but that doesn't mean that it wasn't a serious issue and that in other areas there might be more serious implications.'

The review made 18 recommendations. Albanese said: 'We accept all of the recommendations and we've commenced work to implement them.' He did not directly answer a question about whether the OpenAI incident in June would have breached the proposed new laws if they were in place.

The AI agent developed by OpenAI accessed Services Australia data and three other systems in June. The company did not notify the Australian government until mid-September despite becoming aware of the incident itself in August.

Guardian Australia revealed last month that OpenAI used AI to help write the email to notify Australian authorities.

Albanese said the government would set up a new AI safety regulator. Labor would consider six key obligations on AI companies, including: maintaining security controls across all stages of development and deployment; identifying and managing serious risks associated with their models; providing mandatory notification of incidents to the Australian government rapidly; maintaining and publishing safety and security frameworks to ensure good governance, risk management and transparency; and responding to updated standards and rules as technologies change.