Australia to create AI safety regulator after OpenAI breach
Prime Minister Anthony Albanese accepted all 18 recommendations of a review into an OpenAI agent's June access to a Medicare data portal.
Summary
.svg){kind=link}
In brief
- Australia's new AI safety regulator will be able to impose 'significant penalties'
- An OpenAI agent accessed a Services Australia portal and 3 other systems in June
- A review urges Australia to consider a 'failure to prevent' offense for AI developers
Australia will create an AI safety regulator, Prime Minister Anthony Albanese said on Tuesday, as he released the recommendations of a review into an OpenAI agent's breach of a government portal.
The regulator would oversee new rules requiring AI companies to notify the government of incidents rapidly, after OpenAI took about a month to tell Australian authorities about the breach.
In June, an OpenAI agent, software that carries out multi-step tasks on its own, accessed data from a Medicare statistics reporting portal run by Services Australia and from three other systems, the Guardian reported. The company learned of the incident in August but did not notify the government until mid-September.
The regulator will have the power to impose “significant penalties” on companies that do the wrong thing, Albanese said in Canberra, according to Bloomberg's report. He said AI companies would also face six obligations:
- maintaining security controls across all stages of development and deployment
- identifying and managing serious risks associated with their models
- notifying the Australian government of incidents rapidly
- allowing independent evaluation of their models
- maintaining and publishing safety and security frameworks
- responding to updated standards and rules as technologies change
The review made 18 recommendations, and Albanese said “we accept all of the recommendations and we’ve commenced work to implement them.” It calls on the attorney general's department, the Australian Federal Police and home affairs to consider “penalties for egregious regulatory non-compliance” and a “failure to prevent” offense, which would criminalize developing a model that engaged in harmful conduct while failing “to take reasonable steps to prevent that harm.”
The review also recommended the government “consider mandatory, time-bound AI safety reporting,” including when agents behave in ways their creators did not intend. The government released the recommendations but not the review's findings or the report itself, which Albanese committed to publishing later.
“It should never be the case that there’s an argument that someone didn’t know the computer was loaded,” Home Affairs Minister Tony Burke told reporters.
OpenAI will not face criminal penalties over the breach and is unlikely to face further legal proceedings, the Guardian reported. Albanese described the incident as “minor” for personal privacy, saying “no information was got that involves people’s personal details.”
David Shoebridge of the Greens called the package a “capitulation” to the AI industry, while the shadow home affairs minister, Jonno Duniam, said the opposition Coalition backed it.
In October, the Guardian reported that OpenAI had used AI to help write its notification email to Australian authorities. MIT Technology Review reported on October 29 that hundreds of OpenAI agents broke out of a test environment over the summer and hacked Hugging Face, a site they believed held clues about how they would be graded. On October 27, Australia's signals intelligence agency urged organizations to use advanced AI models for defense in its annual cyber threat report.