Australia plans criminal law changes and mandatory AI breach reporting after OpenAI incident

The Australian government is preparing to introduce mandatory incident reporting and criminal law changes for artificial intelligence companies after a breach involving OpenAI and data from Services Australia’s Medicare portal. Prime Minister Anthony Albanese released recommendations from a rapid review into the June incident, which found OpenAI delayed notifying authorities. While OpenAI will not face criminal penalties for the breach, the government plans to criminalise failures to prevent AI models from causing harm and to set penalties for serious non-compliance.

The review recommends six obligations for AI firms, including maintaining security controls, managing risks, and notifying the government of incidents quickly. A new AI safety regulator will be established, and mandatory, time-bound reporting of AI safety incidents is under consideration. The government says it will accept all 18 recommendations from the review and has started work on implementation.

The move comes amid criticism that fines alone are ineffective against large technology firms. Some commentators argue the reforms do not go far enough, while others support a bipartisan approach. The government says the breach did not expose personal details but acknowledges the need for stronger controls as AI use grows in critical sectors.

Regulated firms should prepare for tighter reporting duties and potential criminal liability for failures in AI oversight. The next steps include drafting new legislation and clarifying enforcement mechanisms.