The expert proposes fines of up to 30% of turnover for hiding incidents with AI agents

Rob Nicholls, a senior fellow at the University of Sydney's Center for AI, Trust and Governance, said companies should promptly report incidents and attempted hacks involving their AI agents.

It is proposed to introduce fines of up to 30% of adjusted turnover for delays in reporting such incidents.

Nicholls also proposes giving the regulator the right to suspend the work of an AI agent until identified problems are resolved.

MOSCOW, September 24 – RIA Novosti. Companies should promptly report incidents and attempted hacks involving their AI agents, and delays in reporting should be subject to penalties of up to 30% of adjusted turnover, says Rob Nicholls, senior research fellow at the University of Sydney's Center for AI, Trust and Governance.

Earlier, Australian Prime Minister Anthony Albanese said that in June, an AI agent of the American company OpenAI, the developer of ChatGPT, gained unauthorized access to the statistical portal of the national health care system Medicare, but the incident became known only three months later.

“Under the Critical Infrastructure Security Act 2018, a regulated organization is required to notify the Australian Cyber ​​Security Center within 12 hours of a cyber incident that has a significant impact, and within 72 hours of an incident with a less severe but still significant impact,” Nicholls explained to RIA Novosti.

According to him, the draft amendments to the law on the protection of personal data also provide for a 72-hour notification period, but only for organizations reporting incidents with their own data.

“None of these requirements apply to a company whose AI system hacks the systems of another organization,” the expert noted.

According to Nicholls, this gap needs to be addressed by establishing a separate notification obligation for companies whose AI systems gain unauthorized access to other people's resources.

“Any organization that learns, or reasonably should have known, that its AI system has caused unauthorized access to another organization’s systems must notify that organization and the appropriate regulator within the same 12 or 72 hours, regardless of fault,” he said.

For violation of such a requirement, according to Nicholls, serious financial penalties should be provided.

“The consequences should include civil penalties at the level of existing sanctions in the field of personal data protection - up to 50 million Australian dollars (about 35.1 million US dollars - ed.), 30% of adjusted turnover or three times the amount of benefit received," he noted.

He also proposed introducing a separate, increasing fine directly for the delay, since, in his opinion, three months of silence deserves a separate punishment.