OpenAI won’t face criminal penalties over the Medicare hack but the prime minister has flagged changes to Australia’s criminal law to crack down on future breaches by artificial intelligence companies.
Anthony Albanese on Tuesday released the recommendations of a “rapid review” into the June breach but not the findings or the report itself.
A key recommendation is for the attorney general’s department, the Australian federal police and home affairs to consider reforming the law to introduce “penalties for egregious regulatory non-compliance” and a “failure to prevent” offence which would criminalise developing an AI model that engaged in harmful conduct while failing “to take reasonable steps to prevent that harm”.
The review recommended the federal government “consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents”.
The home affairs minister, Tony Burke, told reporters “we need to make sure that our laws and our systems keep pace with the technology and also make sure that we’re able to use the technology to find vulnerabilities before others do”.
“The mandatory reporting, when artificial intelligence goes rogue, gives us a chance to be able to make sure that when this happens, the reporting occurs and occurs immediately,” Burke said in Canberra alongside the PM.
On the “concept of looking at how we can update our criminal law”, Burke said: “It should never be the case that there’s an argument that someone didn’t know the computer was loaded.”
“We need to make sure that the criminal law is up to date for how this new technology is able to act.”
Albanese on Tuesday characterised OpenAI’s breach of Services Australia as “minor” in terms of the implications for personal privacy.
“The clear indication is that no information was got that involves people’s personal details,” the prime minister told reporters in Canberra.
“All of that was confirmed essentially ... but that doesn’t mean that it wasn’t a serious issue and that in other areas there might be more serious implications.”
The review made 18 recommendations. Albanese said “we accept all of the recommendations and we’ve commenced work to implement them”.
Albanese did not directly answer a question about whether the OpenAI incident in June would have breached the proposed new laws if they were in place.
The AI agent developed by OpenAI accessed Services Australia data and three other systems in June.
The company didn’t notify the Australia government until mid-September despite becoming aware of the incident itself in August.
Guardian Australia revealed last month OpenAI used AI to help write the email to notify Australian authorities.
Albanese said the government would set up a new AI safety regulator.
Labor would consider six key obligations on AI companies, including:
maintaining security controls across all stages of development and deployment;
identify and manage serious risks associated with their models;
provide mandatory notification of incidents to the Australian government rapidly;
allow independent evaluation of their models;
maintain and publish safety and security frameworks to ensure good governance, risk management, and transparency;
and respond to updated standards and rules as technologies change.
