Criminal penalties for big tech, but OpenAI to avoid fines after Medicare hack

Artificial intelligence companies that fail to rein in rogue agents may face criminal penalties and mandatory reporting requirements for cyber incidents, as the government responds to OpenAI’s hack of Medicare data which shook the industry.

Despite warnings that world-first regulations could hamper AI investment in Australia, the government accepted all recommendations of a rapid review into the hack on Tuesday, including the creation of a criminal offence of failing to prevent agents from running amok.

Speaking at a press conference at Parliament House in Canberra, Prime Minister Anthony Albanese said the government was seeking to shape AI to retain its social license while reaping investment benefits as communities across the world rail against data centre development.

“Law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world. And to be clear, Australia is a first mover in these areas,” Albanese said.

In September, Albanese revealed that an OpenAI agent tasked with collecting Australian public health data accessed three government websites where it gained publicly accessible information. The agent also accessed private files that contained general Medicare data. The hack was the first of its kind reported in the world.

The government launched a rapid review in response to the incident, the recommendations of which were made public on Tuesday. Journalists attending the prime minister’s press conference were unable to review the details of the announcement before Albanese faced questioning, and the full report into the Medicare hack has yet to be released.

The Attorney-General and Home Affairs departments will work with the Australian Federal Police to consider options for the establishment of criminal penalties for “egregious regulatory non-compliance”, including a standalone “failure to prevent” offence.

The laws will also establish a regulator targeting AI safety, which will be responsible for enforcing those “significant penalties” on companies that break the rules. The regulator will also be able to independently evaluate AI models for risks.

OpenAI is not expected to face consequences for the hack – which the prime minister described as “minor” – but future incidents of a similar nature may be caught under the proposed legislation.

The Medicare hack took place in June, and OpenAI became aware of it in August. Deputy Prime Minister Richard Marles met with OpenAI CEO Sam Altman earlier in September, but the government was not formally informed about the breach until a week later.

In response, the government will seek to establish a “time-bound” reporting period for AI companies to inform affected parties of misaligned behaviour and cyber incidents, though exactly how long the time period will be is unclear. Companies that make “timely” reports are expected to receive some protection from penalties.

Government agencies will also have their vulnerability and cybersecurity incident reporting and escalation expectations clarified, after it took four days in September for Services Australia to investigate and report the Medicare hack to the Australian Signals Directorate.

Both OpenAI and Anthropic have been contacted for comment. Government sources did not confirm whether AI companies were consulted on the regulations, which were only agreed to by cabinet on Tuesday morning.

The Coalition welcomed the announcement of new safeguards, but highlighted the importance of protecting the potential of AI technologies to “transform Australia for the better”.

“Getting AI regulation right is a crucial national priority,” opposition cybersecurity spokesman Aaron Violi said. “The Coalition is continuing to work constructively in order to identify and implement safeguards that protect Australians and also to promote rather than stifle innovation.”

Justin Allen, head of security operations at Huntress, said: “This is a positive step, and Australia deserves credit for moving early. Rapid incident reporting, independent testing and published security frameworks are things we already expect of any well-run organisation, so it’s right to expect them of companies building the most capable models.”

Among other recommendations the government has adopted from the review are reforms to Commonwealth agencies for better cyber incident response procedures, AI literacy and cybersecurity practices. There will also be a push to reduce agencies’ digital footprint, and shut down or segregate systems that do not need to be connected to the internet.

News of the crackdown came hours after Qantas CEO Vanessa Hudson cited AI when announcing the loss of 850 jobs in finance, procurement, human resources and marketing. The airline has inked a deal with professional services firm Accenture to “modernise its back-end systems, processes and data”.

Earlier in the month, Australian graphic design giant Canva announced a cut of 1000 roles across the business. Co-founder Melanie Perkins did not directly link the cuts to the rise of artificial intelligence, but wrote that the new technology was transforming what people create and what they expect from the products they use.

Cut through the noise of federal politics with news, views and expert analysis. Subscribers can sign up to our weekly Inside Politics newsletter.