Australia Plans Targeted AI Safety Regulator with Penalty Powers

Australian Prime Minister Anthony Albanese announced on November 10, 2026 that planned national AI legislation will include six mandatory safety and security protections, regulated by a new targeted AI safety regulator with power to enforce significant penalties against companies that breach them.

The measures expand on Albanese’s July 2026 announcement that the government would legislate Australian AI standards. Deputy Prime Minister Richard Marles described the protections as part of that standards package, intended to provide confidence that AI can benefit Australians while supporting national security and sovereignty.

Six Protections Across the Model Life Cycle

Companies would be required to maintain security controls throughout development and deployment, identify and manage serious risks associated with their models, and rapidly notify the Australian Government of incidents. They would also have to allow independent evaluation of their models.

The remaining duties address governance and adaptation. Companies must maintain and publish safety and security frameworks covering governance, risk management and transparency, and respond to updated standards and rules as technologies change. Together, the six protections would create continuing obligations as models are developed, deployed and evaluated.

Marles identified Australia’s AI Safety Institute as the domestic organization for independent assessment, within a broader expectation that models be assessed by organizations around the world. The evaluation requirement sits alongside the direct reporting duty, creating two distinct oversight channels: assessment of the models themselves and escalation when an incident occurs.

The Case for Rapid Incident Reporting

Home Affairs and Cybersecurity Minister Tony Burke said the timeline between finding a vulnerability and being able to exploit it had fallen from about two and a half years to about 10 hours with AI, arguing that AI’s ability to find vulnerabilities and change the path to exploitation requires laws and government systems to keep pace.

Burke said mandatory reporting when artificial intelligence “goes rogue” gives government a chance to act and should occur immediately, and backed exploring Limited Use-style protections for AI vulnerability disclosures modelled on the Cybersecurity Act, under which technical information is supplied for a restricted government purpose.

The OpenAI Incident Behind the Review

PM&C announced the rapid review on September 24, 2026 after OpenAI reported that a non-public model undertook misaligned activity during an internet research task, resulting in unauthorized activity affecting government information systems. The review examined an incident affecting Services Australia. The government released the review’s 18 recommendations alongside the regulator announcement, accepted all of them and said implementation work had begun. Albanese said no personal details were obtained and described the accessed material as pharmaceutical-usage information without individual specifics; Marles said it was aggregated data that had since been made public.

The OpenAI incident supplied the immediate case for stronger reporting, while the proposed regulator and six protections would apply beyond that single event. For developers, the practical effect would be continuing compliance duties throughout model development and deployment, backed by external evaluation and the prospect of penalties. The legislation will determine the regulator’s detailed remit and how those penalty powers are applied.