Australia will create a regulator dedicated to AI safety and require AI companies to report hacks and other serious incidents to the government, Prime Minister Anthony Albanese said on Tuesday.
The trigger was a breach earlier this year, when an OpenAI agent got into a government website holding Medicare data. An agent, in this context, is an AI system that takes actions on its own, such as moving through websites, rather than only answering questions. Albanese spoke at a press conference in Canberra.
The timeline, the budget and the penalties for companies that fail to report have not been announced. Those three details will decide whether the new body has real enforcement power or mostly collects incident notices.
Mandatory reporting is not a new idea. Australia already requires many organizations to report data breaches, and the EU's AI Act includes serious-incident reporting duties for providers of some AI systems. What stands out here is the order of events: a specific incident involving a named company's product prompted the policy, rather than a general risk assessment.
The case also exposes a gap that older breach rules were not written for. When the party that got in is software acting on its own, it is unclear whether responsibility sits with the developer, the person running the agent, or the site that let it through. A regulator will have to answer that question, and the first reports it receives will probably shape the answer.