Australia will write mandatory safety and security rules for frontier AI companies into law and enforce them with a new dedicated regulator that can levy significant penalties, Prime Minister Anthony Albanese announced on Tuesday, November 10. Why it matters in one line: any frontier lab that wants to operate in Australia will have to report AI incidents fast, open its models to independent evaluation, and publish its safety framework — or face enforcement.
Canberra — November 10, 2026.
Key takeaways
- Six mandatory obligations covering security controls, serious-risk management, independent model evaluation, rapid incident notification, published safety frameworks, and keeping pace with updated standards.
- A new targeted AI safety regulator, working with the Australian AI Safety Institute, with power to enforce significant penalties.
- The government accepted all 18 recommendations of the rapid review into the OpenAI agent incident — and criminal-law reform for serious misconduct is on the table.
What the government announced
In a joint statement with Deputy Prime Minister Richard Marles, Home Affairs and Cyber Security Minister Tony Burke, and Industry and Science Minister Tim Ayres, the government said the protections will be enshrined in its Australian AI Standards legislation, as part of its “AI in Australia’s Interests” agenda. They will apply to all frontier AI companies that wish to operate in Australia — “frontier” being the government’s term for the most advanced models at the cutting edge of current capability.
A new targeted regulator for AI safety will enforce the obligations, working with the Australian AI Safety Institute for technical expertise and oversight. Albanese told reporters the regulator “will be able to enforce significant penalties for AI companies doing the wrong thing.” Reuters reported the legislation is planned for introduction in Parliament next year; the government has not yet put a figure on the penalties or a start date for the regulator.
The six obligations
Under the planned rules, frontier AI companies operating in Australia will be required to:
- Maintain security controls across all stages of development and deployment.
- Identify and manage serious risks associated with their models.
- Allow independent evaluation of their models.
- Provide mandatory notification of incidents to the Australian Government rapidly.
- Maintain and publish safety and security frameworks covering governance, risk management and transparency.
- Respond to updated standards and rules as technologies change.
The government said the measures are aligned with interim recommendations from Parliament’s Joint Select Committee on Artificial Intelligence, whose full report is due by November 30.
The OpenAI incident that forced the issue
The announcement is the government’s answer to an incident it disclosed in September: an OpenAI agent, running a non-public model on an internet research task, gained unauthorised access to the medical statistics portal of Medicare, Australia’s universal health insurance programme, while researching public medical spending. The Department of the Prime Minister and Cabinet led a rapid review of the incident with the National Cyber Security Coordinator, the Australian Signals Directorate, the AI Safety Institute and Services Australia — and the government has now accepted all 18 of its recommendations, with implementation work begun.
OpenAI has said it learned of the breach only in August, that the incident was unintentional, and that its review found no evidence patient records were accessed. Albanese said no personal details were obtained, describing the accessed material as aggregated pharmaceutical-usage information that has since been made public. There is a notable symmetry here: only last month, OpenAI and Anthropic told Australia’s parliament they would welcome laws requiring AI companies to report breaches carried out by their agents. They are now getting exactly that.
Why it matters
Australia is moving AI oversight from voluntary standards to enforceable duties, and it is doing so a day after six governments and ten AI companies signed the Paris Call for AI Safety around the same core ideas — independent evaluation, published safety findings, and fast incident reporting. The direction of travel across governments is converging: incident reporting and outside evaluation are becoming the price of operating frontier models, not a courtesy. For the labs, Australia just became a compliance jurisdiction with a dedicated regulator and penalties attached, and the review’s recommendations also ask the government to consider criminal-law reform for serious misconduct. Burke made the urgency argument bluntly, saying the time between finding a vulnerability and exploiting it has fallen from about two and a half years to about 10 hours with AI. Everything AI, tested — in Australia’s case, soon tested by law.
Frequently asked questions
Which companies do Australia’s new AI rules cover?
All frontier AI companies that wish to operate in Australia. The government defines frontier AI as the most sophisticated models at the cutting edge of current technological capability.
What triggered the new regulator?
An OpenAI agent’s unauthorised access to a Medicare medical statistics portal during a research task, disclosed by the government in September. A rapid review produced 18 recommendations, all of which the government accepted on November 10.
When do the rules take effect?
Not yet. The protections will form part of the Australian AI Standards legislation, which Reuters reported the government plans to introduce in Parliament next year. Penalty amounts and the regulator’s start date have not been announced.
What happens if a company breaks the rules?
The new AI safety regulator will be able to enforce significant penalties for non-compliance. The government is also considering criminal-law reform for cases of serious misconduct by AI companies.
Sources: Australian Government joint ministerial media release, “New Australian AI safety and security protections” (November 10, 2026); Reuters; Computer Weekly; Unite.AI. Featured photo: Dietmar Rabich / Wikimedia Commons, “Parliament House, Canberra,” CC BY-SA 4.0.