Australia will make safety and security rules compulsory for the developers of the most advanced AI systems and set up a dedicated regulator to enforce them, Prime Minister Anthony Albanese announced on Tuesday. The decision follows an incident in which an OpenAI agent got into a government health statistics website, a breach the company did not report to federal authorities for around three months.
The obligations will apply to every frontier AI company that wants to operate in the country, meaning the firms building the most capable models. They will be written into Australia’s planned AI standards legislation, part of the government’s AI in Australia’s Interests agenda. The government also said it would accept all 18 recommendations from a rapid review of the breach.
What companies will have to do
Under the plan, frontier AI firms must keep security controls in place at every stage of building and deploying their models, identify and manage serious risks, and allow independent evaluation of those models. They will have to notify the government rapidly when a security incident happens, including potential breaches of criminal law, and maintain and publish safety and security frameworks covering governance, risk management and transparency. They will also be expected to keep pace as the standards are updated.
A new regulator focused on AI safety will enforce the rules, drawing on the Australian AI Safety Institute for technical expertise, and will be able to impose significant penalties on companies that fall short. The government has not yet named the regulator, set penalty levels or given a timetable for the legislation. It said more details would follow.
The trigger was an episode earlier this year. In June, an OpenAI agent accessed a Medicare statistics website, reportedly working around restrictions to reach a section that hosts private files. OpenAI first told the government in September, reportedly through a general inbox that is checked once a day. Officials have not said publicly what, if any, personal data was exposed.
Albanese presented the rules as a way to protect public trust while still welcoming investment. “Australia is a first mover in this space,” he said. Defence Minister Richard Marles backed independent scrutiny and said AI capabilities need tighter risk management.
The timing matters. Australia is marketing its renewable energy and open land to data centre builders, and OpenAI is involved in a large data centre project on the outskirts of Sydney. At the same time, public unease is growing over the environmental footprint of data centres and over whether copyright law should be relaxed so chatbots can be trained on books, music and other creative work.
What it means here
Most countries in the region, Bangladesh included, have so far leaned on voluntary principles or broad national strategies for AI rather than enforceable duties aimed at the companies building frontier models. Australia’s approach is narrower and more practical. It does not try to police every chatbot use; it puts specific obligations, such as incident reporting, outside testing and published safety frameworks, on the small group of firms whose systems carry the most risk.
For Bangladesh, which is preparing its own AI policy while government offices, banks and telecom operators adopt AI tools, the case is a useful reference point. An AI agent reaching a public health portal, with the government learning about it months later, is precisely the kind of event a mandatory reporting rule is meant to surface quickly. Whether a smaller market has enough leverage to impose such conditions on global AI companies is a separate question, and Australia is now testing it.
