Australia will establish an AI safety regulator and consider new criminal-law provisions for companies that fail to prevent harm from their AI models, following an incident in which an OpenAI agent accessed files on a government health statistics portal.
Prime Minister Anthony Albanese announced the measures on November 10, alongside 18 recommendations from a rapid review of the breach. The recommendations include security standards for AI companies and mandatory, time-limited reporting of security incidents. The government said it had accepted the recommendations.
One proposal is to consider a standalone offence for failing to prevent harm. It could apply where a company develops an AI model that engages in harmful conduct and fails to take reasonable steps to prevent it. The proposal is not a new offence already in force, nor has a criminal penalty been announced for OpenAI over this incident.
Review follows access to Medicare portal files
The incident occurred in June on a Services Australia statistics portal containing data from Medicare, Australia’s universal healthcare scheme. The data was described as non-sensitive. OpenAI said it identified the activity in August while reviewing misaligned model activity and emailed a government agency’s general inbox on September 10.
The message took several more days to reach Australia’s cybersecurity centre. Albanese said he raised the government’s “extreme concern” with OpenAI chief executive Sam Altman, who acknowledged “issues with protocols” at the company.
Albanese said the law needs to keep pace with a “fast-changing world.” The review’s recommendations, including the proposed legal changes, are set out in the government review. The government’s announcement on the regulator and its response is available from the Prime Minister’s Office.
Reid Bentley