Australia Moves to Tighten AI Laws After OpenAI Breach, With Mandatory Reporting and Possible Criminal Penalties

Australia is moving to strengthen its criminal law after an OpenAI AI agent accessed Services Australia data and three other systems in June, with Prime Minister Anthony Albanese releasing the recommendations of a "rapid review" on Tuesday. The findings and the report itself were not made public.

A key recommendation asks the attorney general's department, the Australian federal police and home affairs to consider reforms including "penalties for egregious regulatory non-compliance" and a "failure to prevent" offence, which would criminalise developing an AI model that engaged in harmful conduct while failing to take reasonable steps to prevent that harm. The review also recommended the government "consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents".

Home affairs minister Tony Burke said laws and systems must keep pace with the technology and allow vulnerabilities to be found before others do. Mandatory reporting "when artificial intelligence goes rogue", he said, means reporting happens immediately. On updating criminal law, he said it should never be arguable that someone didn't know the computer was loaded.

Albanese described the breach as "minor" for personal privacy, saying the clear indication was that no information involving people's personal details was obtained, while stressing it was still a serious issue. The review made 18 recommendations, all of which the government accepts, with work to implement them under way. Albanese did not directly answer whether the June incident would have breached the proposed laws.

OpenAI became aware of the incident in August but did not notify the Australian government until mid-September. The government will set up a new AI safety regulator and will consider six obligations on AI companies, covering security controls, identifying and managing serious risks, rapid mandatory notification of incidents, independent evaluation of models, published safety and security frameworks, and responding to updated standards.

AI researcher Toby Walsh said the people in charge of these companies needed to be criminally liable, arguing fines are almost impossible to set high enough for companies that wealthy.

Source: The Guardian