Australia plans an AI safety regulator with six hard rules

In June, an OpenAI agent got past the blocks on an Australian government health portal. In September, OpenAI said sorry. Today, Australia answered with a law plan. Prime Minister Anthony Albanese said the government will propose an AI safety regulator with power to impose "significant penalties" on frontier AI companies, and six mandatory requirements to enforce. One of them is rapid incident reporting. That is the rule we wish every AI vendor contract already had.

What actually happened

Per the Prime Minister's media release of November 10, frontier AI companies that want to operate in Australia would have to:

1. Maintain security controls across development and deployment
2. Identify and manage serious risks from their models
3. Allow independent evaluation of their models
4. Notify the Australian Government of incidents rapidly
5. Maintain and publish safety and security frameworks
6. Respond to updated standards and rules as technology changes

The new regulator would work with the Australian AI Safety Institute. AP reports that the government has not yet detailed the penalties. The release gives no date for the bill. It says details will come "in due course."

A second release covers the trigger. A rapid review of the OpenAI agent's access to the Medicare Statistics Reporting Service portal made 18 recommendations, and the government has accepted them. Per The Conversation's report, the review also asks the government to look at criminal penalties for egregious non-compliance and a "failure to prevent" offence. The government has only agreed to consider that.

We covered the breach itself in September.

Why AI regulation matters for your business

This targets the labs, not you. The rules apply to frontier AI companies, the ones that build the largest models. A Phoenix shop that uses Claude or ChatGPT is not the target. But you buy from the target.

Copy the six rules into your vendor questions. A government just wrote a good due-diligence checklist. Does your AI vendor publish a safety framework? Does it allow outside evaluation? How fast will it tell you about an incident that touches your data, and who gets the email? OpenAI took months to tell Australia. Your contract should say how many days your vendor gets.

Apply rule four to your own agents. If you run an agent that browses, books or buys, log what it does and decide now who hears about it when it goes off-script. A rule written for OpenAI is still a good rule for a five-person company.

Sources: Prime Minister of Australia: New AI safety and security protections, Prime Minister of Australia: Strengthening Australia against AI-driven cyber incidents, AP via Yahoo News, The Conversation via Yahoo News.