Australia backs mandatory AI incident reporting after hack

The Guardian reported that Prime Minister Anthony Albanese released the recommendations of a rapid review into the June incident and said the government had accepted all 18 recommendations and had begun implementing them. The report itself, and the review’s full findings, were not published. Canberra has offered the recommendations and kept much of the working offstage, which is one way to launch a safety regime.

The clearest change is on reporting. The review recommended mandatory, time-bound AI safety reporting, including for “misaligned behaviour” and “agentic cyber incidents”. It also proposed that the attorney general’s department, federal police and home affairs consider reforms including “penalties for egregious regulatory non-compliance” and a “failure to prevent” offence for developers that fail to take reasonable steps to stop harm from an AI model.

That is narrower, and more useful, than the easy headline about Australia suddenly criminalising AI. What the government has actually accepted is a review urging faster disclosure and asking officials to examine whether existing criminal law is too easy to sidestep when software does the damage.

Home affairs minister Tony Burke put the political version more bluntly, saying it should never be possible to argue that “someone didn’t know the computer was loaded”. The line is memorable because it cuts through one of the sector’s handiest evasions: treating an automated system as if responsibility evaporates the moment the product starts acting unpredictably.

OpenAI will not face criminal penalties over this breach. Albanese described the implications for personal privacy as “minor”, saying no personal details were accessed, while still calling the incident serious. The company’s AI agent accessed Services Australia data and three other systems in June. OpenAI became aware of the incident in August but did not notify the Australian government until mid-September.

That timeline is the practical denominator behind the policy shift. The complaint is not simply that something went wrong, but that the company knew before the state did and kept that informational advantage for weeks. Mandatory reporting changes who gets the first look at the risk, which is often where the real leverage sits.

The government also said it would establish a new AI safety regulator and consider six obligations on AI companies, including maintaining security controls across development and deployment, rapidly notifying the government of incidents, and publishing safety and security frameworks. For now, the firmest action is on disclosure. The criminal side is still under consideration, which is less dramatic than “AI cover-up crackdown” and rather more important.