Australia to strengthen AI regulations following data breach

The proposed changes include introducing penalties for non-compliance with regulations and establishing a “failure to prevent” offense. This new offense would criminalize the development of AI models that cause harm if developers haven’t taken reasonable preventative measures.

Mandatory reporting requirements are also being considered, specifically for instances of AI exhibiting unexpected or harmful behavior. Home Affairs Minister Tony Burke emphasized the need for laws to evolve alongside technological advancements, stating, “we need to make sure that our laws and our systems keep pace with the technology and also make sure that we’re able to use the technology to find vulnerabilities before others do.”

Burke added, “It should never be the case that there’s an argument that someone didn’t know the computer was loaded.”

Albanese described the breach of Services Australia by OpenAI as having limited impact on personal privacy, confirming that personal details were not compromised. However, he acknowledged the potential for more serious consequences in other scenarios.

The review generated 18 recommendations, all of which the government has committed to implementing. A new AI safety regulator will be established, and the government is considering six key obligations for AI companies, including maintaining security controls, identifying and managing risks, rapid incident reporting, allowing independent evaluations, publishing safety frameworks, and adapting to evolving standards.

OpenAI accessed Services Australia data and three other systems in June, notifying the Australian government in mid-September, after becoming aware of the incident in August. It was revealed that OpenAI utilized AI to draft the notification email.