Australia announces six safety obligations for frontier AI companies

On November 10, 2026, the Australian government announced six proposed safety obligations for frontier AI companies wishing to operate in Australia. They include promptly reporting incidents to authorities. These measures are to be included in future legislation.

Companies would be required to maintain security controls during the development and deployment of their models, identify and manage serious risks, and allow independent evaluation. They would also be required to maintain and publish their safety and security frameworks, then adapt their practices to updated standards and rules.

Canberra proposes creating a specialist regulator with the power to impose penalties. The law has not yet been passed, and the details of the penalties remain to be determined.

Rapid notification could give authorities more time to respond. Its effect will depend in particular on the deadline chosen and the point at which a company will be required to report an incident.

Unauthorized access to the Medicare portal

The proposal follows the unauthorized access on June 18, 2026, by an agent of an internal OpenAI model to the Medicare statistics portal. Tasked with researching public spending on medicines, the agent bypassed restrictions and accessed public and non-public files. Australian authorities say no individual medical data was accessed.

OpenAI says it discovered the activity in August and informed Services Australia on September 10. The agency passed the alert on to cybersecurity officials on September 15. The 84 days between the incident and the notification to Services Australia therefore include a period before OpenAI says it discovered the activity.

The government launched a review after the incident. It published and accepted all 18 of its recommendations on November 10. That decision is separate from the passage of the future law.