The Australian government plans to introduce a dedicated AI safety regulator, update criminal laws, and legislate "strong mandatory safety and security protections" under its forthcoming national AI standards, Labor leaders announced on Tuesday.

The new regulator would have powers to "enforce significant penalties" against AI companies that breach mandatory security and safety obligations, that don't allow independent checks of their models, or that do not "rapidly" notify the government of cybersecurity incidents.

Independent safety assessments of AI models would be carried out by the AI Safety Institute within the Department of Industry, Science, and Resources, officials said.

The announcement comes after an AI agent developed by frontier US firm OpenAI breached a Medicare data portal in June, which the federal government was not told about until September.

"This incident was completely unacceptable, as I outlined to OpenAI's CEO [Sam Altman] at the time – and it can't be allowed to happen again," Prime Minister Anthony Albanese told a press conference on Tuesday.

"... The implications of this [OpenAI incident] in fact were minor in terms of direct implications, but that doesn't mean that it wasn't a serious issue and that in other areas there might be more serious implications."

Government seeks criminal law overhaul for the AI era

Labor also released on Tuesday a set of 18 recommendations it received as part of a rapid review it commissioned from Commonwealth agencies in the wake of the OpenAI incident – all of which it says it has accepted and begun to implement.

Among the list is a recommendation for government agencies to "consider options to reform the criminal law to improve AI safety", including by applying criminal penalties to "egregious regulatory non-compliance".

A standalone "failure to prevent" offence was also suggested, which "would criminalise instances where the company is responsible for developing an AI model that engages in harmful conduct, and the company fails to take reasonable steps to prevent that harm".

Minister for Cybersecurity and Home Affairs, Tony Burke, told Tuesday's press conference, "It should never be the case that there's an argument that someone didn't know the computer was loaded.

"We need to make sure the criminal law is up to date for how this new technology is able to act."

While Burke did not make reference to several government websites which were taken down and urgently patched in October after international security researchers used AI to find vulnerabilities in a popular programming language, he suggested the government needs to better utilise such AI technologies itself.

"We need to make sure that our laws and our systems keep pace with the technology, and also make sure that we're able to use the technology to find vulnerabilities before others do," he said.

The government is yet to release its full rapid review report, which Albanese suggested was due to national security considerations.

Deputy Prime Minister and Minister for Defence Richard Marles said the report "makes clear that we have really good cybersecurity protections in place right now, and that the agencies which oversee this are among the best in the world at what they do".

"Australians should have an enormous sense of confidence about that," he said.


An OpenAI agent breached a Medicare data portal in June, but the company took months to notify Australian authorities. Image: Shutterstock

The Australian Computer Society (ACS), which represents technology workers, said the government should "set clear capability requirements for the people who independently test high-risk AI models and investigate serious AI incidents".

ACS CEO Dr Prins Ralson said, "Legislation and frameworks only work when capable, trusted technology professionals put them into practice.

"Where are those people in the plan? How will we know they have the capability to do the job?"

Will OpenAI be charged over Medicare portal breach?

Albanese did not directly respond on Tuesday when asked if OpenAI had avoided criminal charges over the June incident because it had not technically broken the law.

Several Australian AI experts had called for the company to be prosecuted over the breach, and OpenAI faced questions from local MPs at a parliamentary inquiry into AI in October.

Australian Federal Police (AFP) said earlier this month that there has been no criminal prosecution of OpenAI as it "has not received a formal report of crime and has not commenced a criminal investigation".

There is "no identified need for further law enforcement action at this stage", the AFP said in a statement published last week, in response to a question asked by Independent MP Kate Chaney during a hearing of the parliamentary inquiry in October.

Tuesday's AI regulation announcements come after the prime minister made a major policy pivot in July which confirmed Labor would attempt to legislate national AI standards, including for AI companies and data centres.

Responding to recent US midterm elections which were seen as something of a referendum on data centres and AI regulation, Albanese said, "I think the midterms is a reflection of what we put forward in advance in July, that unless there is social licence for these companies, then there will be a lack of community support for them."

The government is attempting to encourage AI companies to train their models in Australia, as it believes it would give authorities greater "access and influence" with frontier firms.

While Labor has said it will not water down Australia's copyright laws to encourage local AI training, it has explored potential legal changes to make sure at least some intellectual property holders are compensated if their work is used to train AI models locally.

Further details of Labor's proposed national AI standards are expected to be announced by the end of 2026, before they are introduced to parliament in 2027.

ACS is the publisher of Information Age.