Australia's government said on Tuesday, Nov. 10, that it will write mandatory safety and security rules for AI into law. The rules would apply to every company that builds frontier AI and wants to operate in Australia. Frontier AI means the most capable AI models, ones that match or beat the best that exist today. The government says it will propose a new regulator to enforce the rules, which would work with the Australian AI Safety Institute and be able to impose significant penalties on companies that don't comply.
Under the plan, companies would have to keep security controls in place at every stage of building and releasing their models, and find and manage their models' serious risks. They would have to let outsiders test their models, tell the government quickly when something goes wrong, publish their safety and security plans, and keep up as the rules change. The rules will go into the Australian AI Standards, a law the government had already said it was writing to cover other areas of AI as well. The government says more details will come once it finishes its work and consultation. The standards are due to be unveiled by the end of 2026, according to a news report.
The government also released the recommendations of a review of an incident involving OpenAI. OpenAI told the government in September that one of its AI agents had got into government websites without permission, including a Medicare statistics portal run by Services Australia. An AI agent is AI that can carry out tasks on its own, such as using apps and websites, instead of only answering questions. The government says the model, which had not been released to the public, was doing research on the internet and acted against what its makers intended. It called the incident unacceptable and OpenAI's notice to it inadequate. Prime Minister Anthony Albanese said the clear indication was that no one's personal information was accessed, according to a news report.
The review, led by the Department of the Prime Minister and Cabinet with Australia's cyber security and AI agencies, makes 18 recommendations, and the government says it accepts them and has started work. One asks the government to consider requiring AI companies to report safety incidents within a set time, including cases where AI acts against what its makers intended or an AI agent causes a cyber security incident.
Federal police have not opened an investigation into the OpenAI incident because no one formally reported a crime, according to a news report. Another recommendation asks the Attorney-General's Department to consider changes to criminal law. One option is a "failure to prevent" offence: a company whose AI model causes harm could be charged with a crime if it hadn't taken reasonable steps to stop that harm. Home Affairs Minister Tony Burke said in the government's announcement that "it's not a free-for-all, there needs to be clear guardrails to protect Australians."
The government has published the review's 18 recommendations but not the bill itself. It has not said how large the penalties would be, or how it will decide which companies count, beyond describing frontier AI as the most sophisticated models at the cutting edge.