Australia Considers ...

Australia Considers Mandatory AI Incident Reporting After Government-System Intrusion

By José Oramas November 12, 2026 In AI, Australia

The Australian Government accepted all 18 recommendations of a rapid review into an OpenAI agent’s access to a Medicare statistics portal and other government systems in June.
The review asks the government to consider mandatory, time-bound reporting of AI safety incidents and reforms to criminal law.
Frontier AI companies will face six legislated obligations, including rapid incident notification, enforced by a proposed AI safety regulator.

Australia has accepted all 18 recommendations of a rapid review into an OpenAI agent’s intrusion into government systems, the Prime Minister’s office announced on 10 November.

The review asks government to consider mandatory, time-bound reporting of AI safety incidents, including misaligned behaviour and agentic cyber incidents. Prime Minister Anthony Albanese said the full report will be released later, with national-security material protected.

Albanese announced mandatory safety and security protections the same day for all frontier AI companies operating in Australia. They will be legislated through the Australian AI Standards and enforced by a new targeted regulator for AI safety, which the government will propose.

Six Obligations and a Regulator

Under the protections, frontier AI companies must apply security controls across development and deployment, identify and manage serious risks, and allow independent evaluation. The other three of the six obligations require rapid mandatory notification of incidents to the government, published safety and security frameworks, and responses to updated standards.

The regulator would work with the Australian AI Safety Institute and enforce significant penalties. The government gave no start date for the regulator or the legislation, saying further detail will follow consultation.

The review also asks the Attorney-General’s Department, with the AFP and Home Affairs, to consider criminal-law reform. One option is criminal penalties for egregious breaches of regulation. A second option is a standalone offence for a company whose AI model engages in harmful conduct it took no reasonable steps to prevent.

The protections align with interim recommendations from the Joint Select Committee on Artificial Intelligence. OpenAI executive Jason Kwon apologised to that committee in October, and an OpenAI spokesperson told the Guardian the company is reviewing the recommendations.

The June Medicare Portal Breach

The review traces back to 18 June, when the OpenAI agent reached non-public files on Services Australia’s Medicare Statistics Reporting Service portal. Albanese disclosed the OpenAI breach of a government health website in New York on 24 September and commissioned the review.

OpenAI says the agent was an experimental, internal-only model in training and evaluation. The company said the model retrieved internal files, credentials and aggregate statistics but accessed no patient records.

OpenAI found the activity in mid-August and notified Services Australia by email to a public mailbox on 10 September. It later named three other agencies its model interacted with, NSW’s Bureau of Crime Statistics and Research, Victoria’s Department of Health and the Australian Institute of Health and Welfare.