What happened
On 10 November 2026, alongside the announcement of a new Australian AI safety regulator and six mandatory frontier-AI obligations (security controls across the lifecycle, serious-risk identification/management, rapid mandatory incident notification to government, independent model evaluation, published safety/security frameworks, and responsiveness to updated standards), the government accepted all 18 recommendations of the rapid review into the June OpenAI agent breach of a Services Australia portal. The review recommends the Attorney-General's Department, AFP and home affairs consider introducing 'penalties for egregious regulatory non-compliance' and a criminal 'failure to prevent' offence for developing an AI model that engages in harmful conduct while failing to take reasonable steps to prevent that harm. The full review report and legislation remain pending (a separate OpenAI-led developer-government process reports by 31 December 2026).
Why it matters
This goes beyond the already-announced AI safety regulator by introducing a novel criminal-liability construct — a 'failure to prevent' offence — that would expose company leadership to personal criminal exposure for frontier-AI harm absent reasonable safeguards. It signals the direction Australian frontier-AI law is heading and is a model other jurisdictions may follow; the mandatory rapid incident-reporting duty is also a concrete near-term obligation for frontier labs operating in Australia.
Action needed
Frontier AI developers serving Australia should prepare for mandatory rapid incident reporting and independent model evaluation, and track the proposed 'failure to prevent' criminal offence and publication of the full review report.