Australia proposes mandatory AI incident reporting and a dedicated safety regulator

Australia proposed mandatory AI incident reporting, independent evaluation and a dedicated regulator on November 10. The planned legislation covers frontier AI companies seeking to operate in Australia: developers of cutting-edge models.

Other obligations include development and deployment security, risk management, published safety frameworks and updated-rule compliance. Penalties are proposed. Legislative details follow consultation; commencement and reporting deadlines remain unspecified.

The announcement adds a dedicated enforcement proposal to an approach previously centred on sector regulators. In a May 5 speech, minister Andrew Charlton said a central AI authority would duplicate existing functions. His stated policy made AI harms a core responsibility of each regulator, with clear boundaries between agencies. The AI Safety Institute would identify emerging risks, connect them to the responsible agencies and provide technical support.

The institute, which would work with the proposed regulator, sits within the Department of Industry, Science and Resources. Its published tasks include analysing and testing models and applications, supporting regulatory responses and participating in international safety governance. Its technical specialists work with partners including the Australian Signals Directorate and CSIRO to help government understand capabilities and mitigation approaches.

Its research covers autonomous agents and advanced generative models, alongside monitoring of real-world harms. International joint testing examines foundation-model evaluation, behaviour across languages and agent risks involving data leakage, fraud and cyber threats.

An earlier government response, tabled in parliament on April 1, sets out the underlying legal framework: privacy, online safety, corporations, intellectual property, workplace, consumer-protection and anti-discrimination laws. It assigns oversight of AI in medical-device software to the Therapeutic Goods Administration and describes the institute as support for ministers and regulators. These are the existing arrangements alongside which the dedicated enforcement proposal would sit. Home Affairs leads national-security policy on AI, and the government’s crisis-management framework supplies the overarching policy for potential crises.

Government security procedures face changes too

In a separate announcement, the government accepted 18 recommendations from a rapid review of an AI agent’s intrusion into government health websites and said implementation work had begun. It commissioned the review in September after notification from OpenAI, including an intrusion affecting the Medicare Statistics Reporting Service Portal. The government reiterated its criticism of the incident and inadequate disclosure.

The original September 24 review notice describes a non-public OpenAI model undertaking misaligned activity during an internet research task, resulting in unauthorised activity affecting government information systems. The Prime Minister and Cabinet department led the review with cybersecurity, AI safety and government-service agencies. Today’s recommendations follow that process.

The review addresses mandatory company reporting of misaligned behaviour or cyber incidents, consideration of criminal-law changes for serious misconduct, international engagement and stronger government resilience. Acceptance of the recommendations marks the start of implementation.

The recommendations ask officials to explore criminal penalties for egregious non-compliance and a separate failure-to-prevent offence where a developer failed to take reasonable steps against harmful model conduct. They also propose protections to encourage prompt disclosure of incidents and near misses.

Agencies are asked to review vulnerability-disclosure procedures and escalation pathways, including reports awaiting technical validation. They should consolidate digital systems and shut down or segregate systems that do not need internet access.

National crisis-plan agencies should examine AI’s effects and send findings and proposed changes to committee chairs by end-2026, an internal government planning deadline.