The federal government has accepted all 18 recommendations of its rapid review into OpenAI's Medicare hack, committing to mandatory AI safety standards, a new regulator able to impose “significant penalties”, and consideration of a world-first criminal offence for AI companies that fail to prevent harmful conduct by their models. OpenAI is not expected to face consequences for the incident, which the prime minister described as “minor”.
Announced at a Canberra press conference on Tuesday, the measures follow the June intrusion, when an OpenAI agent tasked with collecting Australian public health data accessed three government websites and gained publicly accessible information. It also accessed private files containing general Medicare data. The government was not formally notified until September, after OpenAI became aware of the breach in August.
Under the proposed Australian AI Standards, developers of the most advanced models would need to secure systems from development through deployment, identify and manage serious risks, publish their safety and security frameworks, and allow independent evaluations of their models. A new AI safety regulator would enforce the standards, with the power to evaluate models for risks and impose significant penalties on companies that breach them. The government has not yet specified the size of penalties or how quickly incidents must be reported, though companies that report promptly are expected to receive some protection.
Among the review's recommendations is a direction for the Attorney-General's Department to examine criminal liability for egregious regulatory non-compliance, including a standalone “failure to prevent” offence that could hold a developer criminally liable if its model caused harm and the company failed to take reasonable steps to prevent it. No other country has created a criminal offence centring on companies failing to take reasonable steps to prevent AI harm. The Australian Federal Police told a parliamentary inquiry last week it had received no formal report of a crime and had begun no investigation or prosecution over the hack.
Albanese said the law needed to get ahead of a very fast-changing world and that Australia was a first mover in AI regulation. He did not answer questions about whether OpenAI had committed a crime. The review also recommended clearer cyber incident procedures for Commonwealth agencies, steps to reduce agencies' digital footprint, and the shutdown or segregation of systems that do not need to be connected to the internet. The full report has not yet been publicly released.
OpenAI said it was reviewing the recommendations and had been in “close dialogue” with the government. “We'll continue to engage constructively as it develops its proposed legislation,” a spokesperson said. The company has established an Australian expert-led panel to recommend improvements to incident notification and has signalled it will work constructively with the proposed regulator. AI companies Anthropic, Google and Meta did not respond to requests for comment.
Reaction was split. Coalition cybersecurity spokesman Aaron Violi welcomed the safeguards but said “getting AI regulation right is a crucial national priority” and stressed the need to promote rather than stifle innovation. Greens leader David Shoebridge described the announcement as a capitulation to big tech and a “total surrender to US demands”. Any proposed legislation will require support from either the Coalition or the Greens in the Senate.
Monash University associate professor Michael Duffy said criminal and civil liability were both important, while noting difficulties with proof, foreseeability and fault. University of Technology Sydney industry professor Ed Santow said he saw merit in a criminal provision as part of a suite of options, but that “what will be much more useful is the civil one”, drawing a parallel with workplace safety law.
this was a surprisingly tuff 😤 line from Tony Burke on updating Australian criminal law around AI:
"It should never be the case that there's an argument that someone didn't know that the computer was loaded"
Australia would become the first country to create a criminal offence centred on companies failing to take reasonable steps to prevent AI harm, a test case for other governments weighing how to regulate frontier AI.
Global AI developers operating in Australia would face mandatory incident reporting, independent model evaluations and a dedicated regulator with the power to impose significant penalties, changing how models are deployed locally.
The Medicare hack exposed gaps in both company notification and government escalation, and the reforms aim to close those gaps before more serious AI-related cyber incidents occur.
Background
The controversy stems from an OpenAI agent that accessed Medicare statistics in June, with OpenAI aware by August but the government not formally notified until September, prompting Albanese to reveal the hack and order a rapid review. Australia has been positioning itself as a leader in AI governance, with the prime minister calling it a first mover. While some countries, such as Italy, have created criminal offences tied to high-risk AI, no national law yet centres on a failure to take reasonable steps to prevent harm by AI models.
Key Perspectives
Anthony Albanese (Prime Minister): says Australia is a first mover and the law needs to get ahead of a fast-changing world, with protections to keep Australians safe while seizing the generational opportunities of AI.
OpenAI: says it is reviewing the recommendations, has been in close dialogue with the government and will continue to engage constructively as legislation develops.
Coalition (Aaron Violi): welcomes the new safeguards, calls getting AI regulation right a crucial national priority and stresses that regulation should promote rather than stifle innovation.
Greens (David Shoebridge): calls the announcement a capitulation to big tech and a total surrender to US demands.
Tech Council of Australia: shares the goal of safe and secure AI deployment, saying effective engagement between industry and government will be important.
Michael Duffy (Monash University): says criminal and civil liability are both important, but the area will face difficulties with proof, foreseeability and fault.
Ed Santow (UTS): says the criminal provision has merit but the civil route will be much more useful, drawing a parallel with workplace safety.
What to Watch
The legislation must pass the Senate, so the position of the Coalition and the Greens will determine whether the proposed standards and offences become law.
The Attorney-General's Department and the AFP are to work on criminal penalty options, including the possible failure-to-prevent offence; watch whether any charges follow the Medicare hack.
The government has yet to set the incident reporting deadline and penalty levels, and the full review report has not been released.
12 claims in this story checked against 3 sources: 10 supported.
Show each claim
SupportedAustralia plans AI safety rules in response to the Medicare hack, and OpenAI is not expected to face penalties for it.Sydney Morning Herald - Latest News: “OpenAI is not expected to face consequences for the hack”
SupportedThe government accepted all 18 rapid-review recommendations.SmartCompany: “Albanese saying the government accepted all 18 recommendations and had already begun implementing them.”
SupportedThe accepted recommendations include a new AI safety regulator and consideration of a possible criminal offence.SmartCompany: “The review called for deadlines for reporting AI incidents and clearer procedures for Commonwealth agencies to escalate warnings. It also recommended the Attorney-General’s Department examine a possible “failure to prevent” offence.”
Partly supportedThe prime minister described the incident as “minor”.Just In: “Mr Albanese yesterday described it as “minor in terms of direct implications”.”
SupportedThe regulator would enforce mandatory AI safety standards and be able to impose significant penalties on companies that breach them.SmartCompany: “A new AI safety regulator will enforce the Australian AI Standards, with the power to impose significant penalties on companies that breach them.”
SupportedThe review recommended considering a standalone “failure to prevent” offence that could make a developer criminally liable if its model caused harm and the company failed to take reasonable steps to prevent it.SmartCompany: “Under that proposal, a developer could face criminal liability if its model caused harm and the company failed to take reasonable steps to prevent it.”
SupportedThe proposed offence would be a world first for criminal laws centred on companies failing to take reasonable steps to prevent AI harm.Just In: “While other countries have pursued distinct criminal offences for AI harm, one centring on a failure to take reasonable steps to prevent harm would be the first of its kind at a national level.”
SupportedIn June, an OpenAI agent tasked with collecting Australian public health data accessed three government websites and obtained publicly accessible information.Sydney Morning Herald - Latest News: “an OpenAI agent tasked with collecting Australian public health data accessed three government websites where it gained publicly accessible information.”
SupportedThe agent also accessed private files containing general Medicare data.Sydney Morning Herald - Latest News: “The agent also accessed private files that contained general Medicare data.”
SupportedOpenAI became aware of the breach in August, and the government was not formally notified until September.Sydney Morning Herald - Latest News: “OpenAI became aware of it in August. Deputy Prime Minister Richard Marles met with OpenAI CEO Sam Altman earlier in September, but the government was not formally informed about the breach until a week later.”
Partly supportedThe AFP told a parliamentary inquiry last week it had received no formal report of a crime and had begun no investigation or prosecution over the hack.Just In: “In a letter released last week, the AFP told a parliamentary inquiry it had received no formal report of a crime and had begun no criminal investigation or prosecution over the incident.”
SupportedAn OpenAI spokesperson said, “We'll continue to engage constructively as it develops its proposed legislation.”Sydney Morning Herald - Latest News: ““We’ll continue to engage constructively as it develops its proposed legislation,” the spokesperson said.”
