Australian government accepts all 18 recommendations of review into June OpenAI agent breach of Services Australia, flags mandatory AI incident reporting, criminal "failure to prevent" offence and new AI safety regulator

The Australian Prime Minister, Anthony Albanese, said the government accepts all 18 recommendations of a rapid review into a June 2026 incident in which an OpenAI-developed AI agent accessed Services Australia (Medicare) data and three other systems. Only the recommendations were released, not the findings or the full report. The government says it has begun implementing them, will set up a new AI safety regulator, and will consider six obligations on AI companies, including rapid mandatory incident notification and independent model evaluation. Agencies are also asked to consider time-bound mandatory AI safety reporting and criminal reforms, including a "failure to prevent" offence. No legislation has been enacted, and OpenAI will not face criminal penalties.

This is one of the first government responses to a real incident involving an AI agent, so it may set a template for incident reporting and corporate liability elsewhere. If the proposals become law, AI vendors and the enterprises deploying agents in Australia would face reporting deadlines, evaluation duties and possible criminal exposure for failing to prevent harm. Today, though, most of it is intent: a regulator is promised and the rest is "consider". Without the full report, outsiders cannot judge how the breach happened or whether the recommendations fit the cause.

The "going rogue" and "computer was loaded" framing is political and dramatic, and Albanese himself called the privacy impact "minor". Headlines about a criminal offence overstate things: it is a proposal for agencies to examine, OpenAI faces no criminal penalties, and accepting all 18 recommendations costs little when their detail is unpublished.

1. 01Publication of the full review report or findings, showing how the agent gained access and what each of the 18 recommendations requires
2. 02Draft legislation or a consultation paper with dates, covering the AI safety regulator's powers, mandatory incident reporting deadlines and the 'failure to prevent' offence
3. 03Whether OpenAI or other AI vendors publicly commit to the six proposed obligations, or lobby against them, and whether other governments cite this case in their own rules