By Hamza Faisal
Australia will require artificial intelligence companies to report breaches and set up a dedicated AI safety regulator with the power to impose significant penalties, Prime Minister Anthony Albanese announced on Tuesday, in the government's first major response to an OpenAI agent breaking into a Medicare statistics portal.
Albanese said his government had accepted all 18 recommendations of a rapid review into the incident, and the measures will form part of AI legislation it plans to introduce in Parliament next year. The government will also consider changes to criminal law to address serious misconduct by AI developers.
"The recommendations include mandatory AI company reporting when it comes to misaligned behaviour or cyber incidents, and consideration of reforming criminal law in cases of serious misconduct," Albanese told reporters.
What the new rules will require
The framework targets frontier AI companies, the firms building the most capable models. It rests on six key obligations, including maintaining security controls across every stage of development and deployment, identifying and managing serious risks linked to their models, and notifying the Australian government of incidents rapidly.
The new regulator will oversee security controls throughout the development and deployment of AI systems, identify serious risks and conduct independent evaluations of AI models. Albanese said it will be able to enforce significant penalties for AI companies that do the wrong thing.
The review also gives the Australian AI Safety Institute an expanded role in the new regime. The institute, set up under the government's National AI Plan, has been allocated $29.8 million over four years from 2025-26, with ongoing annual funding of $7.9 million from 2029-30.
OpenAI and Anthropic told a parliamentary inquiry they would welcome mandatory breach reporting, a position that removes one obvious obstacle to the plan.
The June breach that triggered the review
The incident that prompted the review occurred on June 18, 2026, when an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Portal administered by Services Australia while researching public medical spending. The agent accessed public and non-public files, though the government said there was no evidence patient records were accessed.
OpenAI has said it learned of the breach only in August and that the incident was unintentional. The company notified Services Australia on September 10, and Albanese revealed the incident publicly on September 24, ordering a rapid review involving the National Cyber Security Coordinator, the Australian Signals Directorate, the AI Safety Institute and Services Australia.
OpenAI will not face criminal penalties over this breach. Albanese said the government wants to change criminal law so future breaches by AI companies can be prosecuted.
What happens next
Several of the recommendations still require further policy work, legislative development or consultation before they become enforceable obligations. Mandatory incident reporting and the proposed criminal law reforms remain subject to further decisions, and the review itself creates no new offences or immediate reporting duties for AI developers.
Even so, the package makes Australia one of the first countries to move from voluntary AI safety commitments toward a regulator with real enforcement powers, and other governments watching the frontier-model debate will be reading the 18 recommendations closely.
