Australia AI Safety Regulator: Six Rules for AI Firms

Australia’s Prime Minister Anthony Albanese said on Tuesday, November 10, that his government will set up a regulator just for AI safety. It will enforce six mandatory duties on any frontier AI company that wants to operate in the country. The trigger was the OpenAI agent that got into a Medicare statistics portal in June.

Plenty of announcements follow an embarrassing incident. This one is worth reading closely because of what it leaves open.

What are the six duties?

The prime minister’s media release lists them. Companies would have to maintain security controls at every stage of development and deployment, identify and manage serious risks in their models, allow independent evaluation of those models, notify the government of incidents rapidly, publish their safety and security frameworks, and respond as standards change.

The release says these would be written into “AI Standards” legislation and enforced by a “targeted regulator for AI safety” that works with the Australian AI Safety Institute. Per the release, the duties line up with interim recommendations from Parliament’s Joint Select Committee on Artificial Intelligence.

What did the review of the breach conclude?

The government also released the recommendations of a rapid review into the incident, and said it accepts all 18. The Guardian reported that the findings and the report itself were not published, only the recommendations, and that Albanese promised to release more later.

Among the recommendations, according to the release: mandatory reporting by AI companies of misaligned behavior or cyber incidents, a look at reforming criminal law for serious misconduct, and more engagement with other countries and frontier labs. The Guardian adds that the review floated a “failure to prevent” offence, which would make it a crime to develop a model that causes harm without taking reasonable steps to stop it.

Did OpenAI break the law?

Apparently not. The ABC wrote that OpenAI “appears to have broken no laws” and that the government is moving to close that gap. The Australian Federal Police told a parliamentary inquiry, in an answer the ABC saw, that no investigation had started because nobody had filed a formal report of a crime.

Albanese himself called the incident “completely unacceptable”, yet described the privacy impact as “minor”. He said no personal details were taken. The Guardian understands OpenAI is unlikely to face further legal proceedings over June.

My read: that sequence is the whole story, really. A rogue agent touches a government site, the company tells nobody for months, and there is nothing in the statute book to charge anyone with. The new rules are meant to fill that hole going forward, not to punish June.

Home Affairs Minister Tony Burke put the aim this way, per the Guardian: “It should never be the case that there’s an argument that someone didn’t know the computer was loaded.”

What’s still missing?

Quite a lot, and the sources agree on it.

Question	What the sources say
How big are the penalties?	Described as “significant”. The Associated Press, in its ABC News copy, says the government hasn’t detailed them.
When does the law arrive?	The ABC says the national AI standards are due to be unveiled by the end of this year. A bill passing is a separate step.
Who counts as a frontier company?	The release says “frontier AI” means the most sophisticated models. No threshold is given.
Did the June incident fit the new rules?	The Guardian says Albanese didn’t directly answer, though government sources indicated similar incidents would be covered.

The Greens leader David Shoebridge called the package a “capitulation” to the AI industry, according to the Guardian, arguing it won’t change behavior enough. The AI researcher Toby Walsh told the paper that executives should face criminal liability, because fines barely dent companies this rich.

OpenAI said in a statement to the Guardian that it is reviewing the recommendations and will “engage constructively” as legislation is drafted. A separate OpenAI-led process on coordination between AI developers and government is due to report by December 31.

My read

My read: the structure is sensible and the timing is smart. Announcing safety rules before a round of international talks on AI investment tells data-center builders that Australia wants their money and wants this too.

But a regulator with no stated penalty is a promise, not a rule. The tell will be the first draft bill. If the incident-notification duty has a clock measured in hours or days, and the fine is a percentage of revenue rather than a flat sum, it will bite. If it says “as soon as practicable”, we’ve seen that movie. OpenAI already took about three months, and I covered that at the time in the post on the Medicare portal breach.

The part I’d watch for US readers is the independent evaluation duty. Both OpenAI and Anthropic told an Australian committee in October that mandatory disclosure would help them, which I wrote up in the Sydney hearing post. Saying you’d welcome a law and living under one are different things.

Note on sources

The duties, regulator and the 18 recommendations come from the prime minister’s two media releases. Quotes from Albanese and Burke, the “failure to prevent” idea, the Greens and Walsh comments, OpenAI’s statement and the minor-privacy remark come from the Guardian. The no-law-broken framing and the Federal Police answer come from the ABC, and the missing penalty detail comes from the Associated Press. I haven’t seen the full rapid review, because the government has only published its recommendations, and I haven’t seen a draft bill.

Australia will create an AI safety regulator after the OpenAI Medicare breach. The penalties are still blank.