AI companies operating in Australia will face mandatory safety duties enforced by a new regulator, Prime Minister Anthony Albanese has announced, as the government moves to legislate following an incident involving an OpenAI agent and a Medicare statistics website.
The proposed regime will require companies to report AI security incidents and potential breaches of criminal law. It will also introduce external evaluation of frontier AI models and security controls throughout model development. Albanese said companies would face significant penalties for failing to comply.
The government has accepted all 18 recommendations of a rapid review into the OpenAI incident and released its findings. The measures are to form part of planned AI safety legislation, rather than rules whose detailed penalties have already been enacted.
For readers in Britain, the significance is the move towards enforceable duties for developers of advanced AI systems. Australia would become one of the first countries to establish mandatory, regulator-backed oversight of frontier models, offering a possible template for other governments considering how to govern the technology.
Medicare website incident
The review examined an incident in which an OpenAI agent accessed a Medicare statistics website in June 2026. OpenAI notified federal authorities in September. That gap between the incident and notification is a central part of the sequence now informing the government’s response.
Medicare is Australia’s public healthcare scheme. The website involved was a statistics site, a distinction that matters when describing the incident. The confirmed facts do not establish that patient records were accessed, and they do not establish any intent behind the access.
An AI agent is a system capable of taking actions to carry out tasks, rather than simply producing a written response. In this case, the confirmed action was access to the Medicare statistics website. The government’s announcement addresses both incident reporting and the wider controls applied to advanced models.
Mandatory reporting would create a legal obligation to alert authorities to covered incidents. The planned duties also extend to potential criminal-law breaches. That is a requirement to report possible wrongdoing, not a finding that OpenAI or any other company committed a criminal offence in this incident.
Rules backed by a regulator
A new AI safety regulator will enforce the rules and have the power to impose penalties. Albanese’s warning of significant consequences for non-compliance makes enforcement an explicit element of the proposal, alongside the safety obligations themselves.
The penalty details are not yet legislated. The announcement therefore sets out the intended direction of the regime, but does not establish the final sanctions companies could face. Those details remain part of the legislative process ahead.
External evaluation of frontier models is another proposed obligation. Frontier models are advanced AI systems at the leading edge of capability. Evaluation by assessors separate from their developers is intended to bring scrutiny beyond a company’s own assessment of its technology.
Security controls throughout development would extend the regime beyond responding to an incident once it has occurred. Together, the proposed duties cover how models are developed, how they are assessed and what companies must tell authorities when a security incident or possible criminal-law breach arises.
Legislation to come
The government describes Australia as a first mover in mandatory frontier-model oversight. The proposed combination of reporting, evaluation and enforcement is relevant beyond its borders because other governments face similar questions about responsibility for advanced AI systems.
That international relevance does not mean the announcement changes the legal duties of companies in Britain. The obligations announced by Albanese concern AI companies operating in Australia. Any use of the approach elsewhere would require separate decisions by the governments concerned.
The next step is planned AI safety legislation incorporating the review’s recommendations. Its final provisions, including the penalty framework, will determine how the regulator’s powers operate in practice and what companies must do to comply with the new duties.
