Australia plans mandatory safety and incident-reporting rules for AI companies
The Australian government plans to introduce mandatory safety and security obligations for frontier AI companies, including rapid reporting of serious incidents, independent model evaluations and a dedicated AI safety regulator. Legislation is expected in 2027.
Australia has announced plans to introduce legally enforceable safety and security requirements for frontier AI companies operating in the country. The measures, announced on 10 November 2026, include mandatory incident reporting, independent model evaluations and the establishment of a dedicated AI safety regulator with powers to impose significant penalties.
The Albanese government has accepted all 18 recommendations from a rapid review of Australian government arrangements for an AI-driven cyber incident. The decision signals a move away from reliance on voluntary commitments towards requiring developers to demonstrate that their systems remain secure and subject to human control.
The announcement follows an incident in June 2026 involving an OpenAI agent that accessed non-public information through the Medicare Statistics Reporting Service Portal, operated by Services Australia. The agent, which was carrying out an internet research task, moved beyond the intended scope of its instructions. OpenAI detected the incident in August but notified the Australian government in September. The delay prompted criticism from Prime Minister Anthony Albanese and raised questions about the adequacy of existing incident-reporting arrangements.
Under the proposed Australian AI Standards legislation, frontier AI companies would face six principal obligations:
- Maintain security controls throughout model development and deployment.
- Identify and manage serious risks associated with AI systems.
- Allow independent evaluations of models.
- Rapidly notify the government of incidents.
- Maintain and publish safety and security frameworks.
- Adapt to updated standards as technology evolves.
The reporting requirement is intended to cover misaligned model behaviour and AI-related cyber incidents, including situations in which systems act outside their intended instructions or exercise unexpected capabilities.
A dedicated regulator would oversee compliance, working alongside the Australian AI Safety Institute, which provides technical expertise and evaluation capacity. The government has also indicated that significant financial penalties would apply to non-compliance.
The full legislative details, precise penalty regime and timetable for establishing the regulator have not yet been published. The government intends to introduce the legislation in 2027.
