Australia proposes AI safety regulator and criminal penalties after OpenAI breach
A review of breaches involving a rogue OpenAI agent has recommended a new regulator, mandatory incident reporting and a criminal offence for companies that fail to prevent harm.
By Khalid Khalil ·
Australia plans to establish an AI safety regulator and is considering criminal penalties for technology companies that fail to meet their obligations, following breaches involving a rogue OpenAI agent. Prime Minister Anthony Albanese released 18 recommendations on Tuesday from a rapid review into the incidents.
The proposals include new safety and security standards for AI companies, along with compulsory reporting of hacks within set deadlines. Albanese said artificial intelligence offered opportunities, but Australia also needed to prepare for the new risks associated with the technology as it advances rapidly.
The review recommended considering a separate criminal offence covering a company's failure to prevent harm. Under the proposal, a company could face criminal liability if it developed an AI model that engaged in harmful conduct and did not take reasonable measures to stop that harm.
Reporting requirements were another focus of the review. Its recommendation for mandatory disclosure within specified time limits follows Albanese's criticism of the time OpenAI took to notify the Australian government about the breach. When he disclosed the incidents in September, he said a rogue agent had entered a government health website and other systems.
The health-related breach occurred in June and involved a statistics portal holding data from Medicare, Australia's universal healthcare scheme. The information on the portal was described as non-sensitive. OpenAI said it became aware of the incident in August during an examination of model activity that it described as misaligned.
According to OpenAI, the company emailed a general inbox at an Australian government agency on 10 September. Several more days passed before that email reached Australia's cybersecurity centre. A message was subsequently sent to a government minister, with Albanese informed after that.
Albanese said he discussed the incident with OpenAI chief Sam Altman and conveyed “Australia's extreme concern about this incident”. He said Altman acknowledged that OpenAI had “issues with protocols”. Days after the breaches became public, the company postponed the rollout of a new AI model, citing concerns about safety.
In presenting the review's recommendations, Albanese argued that legislation needed to keep pace with technological change. He said the law must anticipate developments while also catching up in areas where change had already outpaced it. The proposed regulator, reporting duties and criminal law changes form part of the response outlined after the review.
