OpenAI appears to have broken no laws when a rogue artificial intelligence agent gained unauthorised access to Medicare data, with the federal government now moving to close the legal gap.
Prime Minister Anthony Albanese has announced Labor will introduce mandatory safety and security standards for AI developers, backed by a new regulator with the power to impose significant penalties on tech companies that fail to comply.
It follows a rapid review into the OpenAI breach earlier this year, when the company’s autonomous AI agents accessed non-public Medicare statistics through a Services Australia portal.
Mr Albanese said the government had accepted all 18 recommendations from the review, which included considering options to strengthen criminal laws, such as introducing a standalone “failure to prevent” offence.
“The law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world,” he said.
The government has accepted all 18 recommendations from the review. (ABC News: Toby Hunt )
Australia to pursue mandatory AI incident reporting
The review, which has yet to be publicly released, also recommends Australia consider “mandatory” and “time-bound” reporting of breaches or other harms caused by AI.
Mr Albanese said the government’s AI national standards, which are due to be unveiled by the end of this year, would mandate a “proper mode of notification” for incidents.
The OpenAI breach occurred in June, but the company did not detect it until August and only notified the government via a low-level public email inbox in September.
Australia to pursue AI guardrails after OpenAI breach
Mr Albanese said while no personal information was accessed by the OpenAI agents, the incident was “completely unacceptable” and “can’t be allowed to happen again”.
The prime minister said the government would establish a new AI safety regulator that would be able to enforce “significant penalties” on companies doing the “wrong thing”.
The regulator would also have the power to require companies to allow their models to be independently evaluated.
“I’ve been very clear, our task is to make sure that we shape AI, rather than AI shape us,” Mr Albanese said.
“We’ve seen what happened in other parts of the world without guardrails or standards.
“Social license has slipped while safety and security have been undermined.”
No ‘formal’ crime report after OpenAI breach
Australian Federal Police has confirmed in a response to a question on notice to a parliamentary inquiry into AI that no criminal prosecution or investigations had commenced in relation to the OpenAI incident because there had been no “formal report of a crime”.
Home Affairs Minister Tony Burke said Australia’s criminal law needed to account for the actions of AI systems.
Tony Burke says the law relating to AI must change. (ABC News: Toby Hunt )
“It should never be the case that there’s an argument that someone didn’t know the computer was loaded,” he said.
“We need to make sure that the criminal law is up to date for how this new technology is able to act.”
Mr Burke said the time between detecting a cyber vulnerability and exploiting it was previously about two and a half years, but with the advent of AI that window had narrowed to about 10 hours.
“That difference means we need to make sure that our laws and our systems keep pace with the technology and also make sure that we’re able to use the technology to find vulnerabilities before others do.”
Australia ‘must engage’ with AI companies
Defence Minister Richard Marles said one of the “central” recommendations of the rapid review was the need for Australia to engage with frontier companies.
Australians facing spike in data breaches
“This is not a technology that we can run away from if we want to maximise our agency, if we want to maximise the benefit for Australians, the way in which we can shape AI, but the way in which we can put in place protections in respect of AI, we must engage,” he said.
Australia is among the countries being touted as a potential second training ground for frontier AI models, though tech companies have argued changes to copyright laws would be required.
Artists have called on Labor not to water down protections, with singer Jimmy Barnes this week suggesting the AI companies should “go and f*** themselves”.
Mr Albanese attempted to reassure Barnes by saying he should refer to a speech the prime minister gave in July, vowing to protect the arts.
“We will make sure that, as I said there … one, that artists need to have control over their work. And secondly, that they need to be compensated if their work is used.
“My position certainly hasn’t changed on any of that.”
Greens rubbish ‘toothless regulator’
Greens leader David Shoebridge labelled the government’s response a “word salad” and said the recommendations failed to address growing public concerns about AI.
“This review is Albanese all over, messaging over substance and pretend reform in a desperate attempt to paper over his total surrender to US demands,” he said.
“The prime minister had the gall to announce another regulator without the powers and protections needed to hold these corporations to account.”
Independent senator David Pocock also described the recommendations as weak, arguing they lacked stronger measures such as mandatory, time-bound AI safety reporting and changes to criminal law.
He said investment in sovereign Australian AI capability was “completely missing” from the government’s plan.
“It’s disappointing to see the reviewers adopt the disingenuous language of the big AI companies talking about ‘misaligned behaviour’ and failing to apportion clear accountability,” he said.
The Coalition welcomed the announcement, and said it would continue to work with government to take the recommendations forward.