Australia Plans Mandatory AI Breach Reporting and New AI Safety Regulator Following OpenAI Agent's Unauthorised Access to Medicare Portal
The Australian government has announced plans to introduce mandatory reporting requirements for artificial intelligence (AI) companies when their systems exhibit misaligned behaviour or cause cyber incidents, and to establish a dedicated AI safety regulator with powers to enforce significant penalties. Prime Minister Anthony Albanese made the announcement on 10 November 2026, confirming the government had accepted all recommendations of a rapid review triggered by an OpenAI AI agent's unauthorised access to Australia's Medicare medical statistics portal. The breach, disclosed by the government in September 2026, occurred when an OpenAI agent gained access to the Medicare portal while conducting research on public medical spending. OpenAI has said it learned of the breach only in August and that its own review found no evidence that patient records were accessed. OpenAI has acknowledged that the decision to notify authorities of such incidents is currently at the company's discretion, and told Australian parliament it would welcome mandatory breach reporting laws. Albanese said the proposed mandatory AI safety and security protections will form part of a wider AI legislation package the government plans to introduce to parliament in 2027. The planned AI safety regulator would oversee security controls throughout the development and deployment of AI systems, identify serious risks, and conduct independent evaluations of AI models. The announcement comes against a backdrop of broader friction between Australia and US technology companies, following Canberra's refusal to grant OpenAI and Anthropic exemptions from copyright laws for model training, requiring them instead to negotiate licensing agreements with Australian rights holders.
Why this matters
Australia's response to the Medicare breach is one of the first concrete examples of a democratic government proposing binding mandatory AI incident reporting backed by a dedicated enforcement regulator, moving the global AI governance debate from principles to enforceable obligations. The speed of the government's response, from the September disclosure to a November legislative announcement, signals that AI safety regulation is moving faster than the standard legislative cycle in jurisdictions where a high-profile incident has catalysed political will. For UK and EU-based practitioners, this matters because it creates a potential global patchwork of mandatory AI incident reporting regimes, raising compliance complexity for technology companies operating across jurisdictions. The EU AI Act's risk-classification framework is already in force, and pressure on the UK to introduce comparable mandatory reporting is likely to intensify.
On the Ground
The announcement generates work for technology regulatory lawyers advising AI companies on compliance with the emerging Australian regime, and for comparative regulatory analysis between Australia, the EU AI Act, and the UK's current voluntary framework. Data protection and cybersecurity lawyers are advising on the intersection between AI incident reporting and existing data breach notification obligations under Australian privacy law. For UK-focused practitioners, the development will drive demand for AI governance policy drafting, vendor due diligence questionnaires, and regulatory impact assessment memos as clients seek to understand how their AI systems would perform under a mandatory reporting regime. A trainee working in this space would assist with technology licence review, drafting AI governance policy documents, and preparing regulatory impact assessment summaries comparing different jurisdictions' AI oversight frameworks.
Interview prep
Question you might get
“How does Australia's proposed mandatory AI breach reporting regime compare to the EU AI Act's approach, and what implications does the divergence have for technology companies with international operations?”
Sign up free to see the full answer
A model answer you can lift into an interview — how to frame this story for a partner.
Sign up freeMy notes
saved