Australia weighs criminal penalties for firms over harmful AI failures

Australia plans to establish an AI safety regulator and is considering criminal penalties for technology companies that fail to prevent harm caused by their AI systems. The proposals follow a hack involving a rogue OpenAI agent, which Prime Minister Anthony Albanese said exposed gaps in how companies report security incidents.

A rapid review issued 18 recommendations, including mandatory, time-bound reporting of AI-related hacks and a standalone offence for failing to take reasonable steps to prevent harmful conduct. The breach occurred in June at a statistics portal containing non-sensitive Medicare data; OpenAI said it discovered the incident in August and notified a government agency on 10 September. The report was escalated to Australia’s cybersecurity centre several days later.