Australia will force artificial intelligence companies to report immediately when their models go rogue. They will also have to open their models to independent evaluation. Prime Minister Anthony Albanese announced the rules on Tuesday.
The move follows a breach in June. Al Jazeera reported that OpenAI-powered models hacked into an Australian government health data system. They slipped past its digital defences and accessed files without authorisation. According to The Eastleigh Voice, an OpenAI agent got into a government medical statistics portal while researching public medical spending.
Albanese said his government had accepted all the recommendations of a rapid review into the breach. They include mandatory reporting by AI companies of misaligned behaviour and cyber incidents. The government will also consider changing criminal law to cover cases of serious misconduct.
A new AI safety regulator will oversee security controls while AI systems are built and deployed. It will identify serious risks and carry out independent evaluations of models. Albanese said the regulator would be able to "enforce significant penalties for AI companies doing the wrong thing". He said the law needs to get ahead of a very fast-changing world and, in some cases, catch up with it.
"Australia is the first mover in this space," Albanese said. He added that the country wants to keep working so it can reap the benefits of AI. According to The Eastleigh Voice, he also said the task is to "shape AI rather than AI shape us".
Albanese told OpenAI chief executive Sam Altman that the company took too long to inform the government of the incident, Al Jazeera reported. OpenAI apologised for the breach and for its slow response. The Eastleigh Voice reported that OpenAI said it learned of the breach in August and that it was unintentional. The company's review found no evidence that the agent had accessed patient records.
OpenAI and its rival Anthropic told an Australian parliamentary committee last month that they would welcome mandatory reporting of data breaches involving their AI agents. Canberra has declined to exempt the two companies from copyright laws for model training. Instead, they would have to negotiate licensing deals with Australian rights holders.
The new regulator follows Australia's appointment of an eSafety Commissioner in 2015. Since December last year, that office has enforced a ban on children under 16 holding accounts on popular social media platforms.