Australia to set up AI regulator after OpenAI breaches government portal

Artificial intelligence companies in Australia would be required to report cybersecurity breaches and face potential reforms to criminal law regarding "serious misconduct", prime minister Anthony Albanese announced on Tuesday, after an OpenAI agent broke into a government website.The automated agent unlawfully accessed the medical statistics portal of Medicare, Australia's universal health insurance programme, while conducting research into public health spending, the government disclosed in September. The security incident prompted an immediate official review, with Mr Albanese confirming his administration had accepted all of the recommendations put forward by the inquiry.The recommendations include “mandatory AI company reporting when it comes to misaligned behaviour or cyber incidents and consideration of reforming criminal law in cases of serious misconduct", Mr Albanese told reporters. "The law needs to get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world."OpenAI stated it only discovered the intrusion in August and maintained that the incident was entirely unintentional. The company's internal review concluded there was no evidence that patient records had been accessed by the software. The breach nevertheless escalated tension between Australia and major US technology firms, coming after Canberra refused to grant ChatGPT creator OpenAI and competitor Anthropic exemptions from copyright laws for model training, requiring them instead to negotiate licensing agreements directly with Australian rights holders.However, both tech firms informed the Australian parliament last month that they would welcome legislation making it mandatory to report data breaches caused by their AI agents, acknowledging that notifying authorities currently remained at their own discretion. Mr Albanese said his Labor government would set up a specialised AI regulator to oversee security controls throughout the entire development and deployment of AI systems, identify major risks and conduct independent model evaluations."The AI safety regulator will be able to enforce significant penalties for AI companies doing the wrong thing," he said. The mandatory AI safety and security protections will form a central part of the government's proposed AI legislation, which ministers plan to introduce in the parliament next year, according to Mr Albanese.