OpenAI appears to have broken no laws when a rogue artificial intelligence agent gained unauthorised access to Medicare data, with the federal government now moving to close the legal gap.
Prime Minister Anthony Albanese has announced Labor will introduce mandatory safety and security standards for AI developers, backed by a new regulator with the power to impose significant penalties on tech companies if they fail to comply.
It follows a rapid review into the OpenAI breach earlier this year, when the company's autonomous AI agents accessed non-public Medicare statistics through a Services Australia portal.
Mr Albanese said the government had accepted all 18 recommendations from the review, which included considering options to strengthen criminal laws such as a standalone "failure to prevent" offence.
"The law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world," he said.
Australia to pursue mandatory AI incident reporting
The review, which is yet to be publicly released, also recommended Australia consider "mandatory" and "time-bound" reporting of breaches or other harms caused by AI.
Mr Albanese said the government's AI national standards, which are due to be unveiled by the end of this year, would mandate a "proper mode of notification" for incidents.
The OpenAI breach occurred in June, but the company did not detect it until August and only notified the government via a low-level public email inbox in September.
Mr Albanese said while no personal information was accessed by the OpenAI agents, the incident was "completely unacceptable" and "can't be allowed to happen again".
The prime minister said the government would establish a new AI safety regulator that would be able to enforce "significant penalties" on companies doing the "wrong thing".
"I've been very clear, our task is to make sure that we shape AI, rather than AI shape us," Mr Albanese said.
"We've seen what happened in other parts of the world without guardrails or standards.
"Social license has slipped while safety and security have been undermined."
No 'formal' crime report after OpenAI breach
The Australian Federal Police has confirmed in a question on notice to a parliamentary inquiry into AI that no criminal prosecution or investigations had commenced in relation to the OpenAI incident because there had been no "formal report of a crime".
Home Affairs Minister Tony Burke said Australia's criminal law needs to account for the actions of AI systems.
"It should never be the case that there's an argument that someone didn't know the computer was loaded," he said.
"We need to make sure that the criminal law is up to date for how this new technology is able to act."
Mr Burke said the time between a cyber vulnerability being detected and then exploited was previously about two and a half years, but with the advent of AI that window had narrowed to about 10 hours.
"That difference means we need to make sure that our laws and our systems keep pace with the technology and also make sure that we're able to use the technology to find vulnerabilities before others do."
Australia 'must engage' with AI companies
Defence Minister Richard Marles said one of the "central" recommendations from the rapid review was the need for Australia to engage with frontier companies.
"This is not a technology that we can run away from if we want to maximise our agency, if we want to maximise the benefit for Australians, the way in which we can shape AI, but the way in which we can put in place protections in respect of AI, we must engage," he said.
Australia is among the countries being touted as a potential second training ground for frontier AI models, though tech companies have argued changes to copyright laws would be required.
Artists have called on Labor not to water down protections, with singer Jimmy Barnes this week suggesting the AI companies should "go and f**k themselves".
Mr Albanese attempted to reassure Barnes by saying he should refer to a speech the prime minister gave in July, vowing to protect the arts.
"We will make sure that, as I said there … one, that artists need to have control over their work. And secondly, that they need to be compensated if their work is used.
"My position certainly hasn't changed on any of that."
