The decision follows a specific security incident in which an OpenAI agent gained unauthorized access to a government medical statistics portal while researching public medical spending. OpenAI stated it learned of the breach in August and described the incident as unintentional, noting that its internal review found no evidence that the agent accessed patient records. In response, the Australian government has accepted all recommendations from a recent review, which includes requiring AI companies to report misaligned behavior and cyber incidents. The government is also considering reforms to criminal law to address cases of serious misconduct.
A new AI safety regulator will be established to oversee security controls during the development and deployment of AI systems. This body will identify serious risks, conduct independent evaluations of models, and enforce significant penalties for non-compliance. Albanese emphasized that the law must “get ahead of, and in some cases, make sure that it catches up with what is a very fast-changing world.” Both OpenAI and rival Anthropic have told an Australian parliamentary committee that they would welcome mandatory reporting requirements for data breaches involving their AI agents.
On the international stage, a parallel development occurred on November 9 in Bahrain, where state and government leaders from Canada, Finland, France, Norway, and the Netherlands signed the “Paris AI Safety and Security Call.” The signatories included executives from major technology firms such as Anthropic, Black Forest Labs, Cohere, Domyn, Hugging Face, Microsoft, Mistral AI, OpenAI, Sakana AI, and Synthesia. Civil society organizations LawZero, SaferAI, AI Safety Connect, and Ifri also joined the declaration.
The joint declaration asserts that the opportunities and risks associated with AI are global in nature. It emphasizes that protecting citizens, businesses, and institutions is a collective responsibility that cannot be managed by states or companies alone. The signatories agreed on three core areas: the need for a clear, understandable, and predictable regulatory framework; the urgency of achieving concrete results in transparency, incident reporting, and risk management; and the absolute necessity of rigorous evaluation standards.
The commitment involves a structured collaboration framework based on three strategic pledges: creating a common framework for evaluating advanced AI models and managing risks; ensuring all actors in the AI ecosystem adhere to principles of responsibility and accountability; and developing information sharing and early warning systems. The declaration remains open to new signatories and will continue to be updated as the global AI landscape evolves.
Notably, the Australian government declined to grant copyright exemptions to OpenAI and Anthropic for model training. Instead, these companies will be required to negotiate licensing agreements with Australian rights holders. This regulatory stance contrasts with the broader international cooperation seen in the Bahrain declaration, highlighting a dual approach of domestic enforcement and global standardization.
