New safety regulator to impose penalties, but unions warn workers remain exposed to job displacement
Australia will introduce mandatory safety and security protections for artificial intelligence (AI), and frontier AI companies that fail to comply will face significant penalties.
The Albanese Government announced on 10 November that the protections will be legislated through the Australian AI Standards. They will apply to all frontier AI companies that wish to operate in the country.
The government defines frontier AI as the most sophisticated models at the cutting edge of current technological capability.
Under the proposal, companies must maintain security controls across all stages of development and deployment, identify and manage serious risks associated with their models, and allow independent evaluation of those models.
They must also notify the government rapidly of incidents, maintain and publish safety and security frameworks, and respond to updated standards and rules as technologies change.
A new targeted regulator for AI safety would enforce the protections. It would work with the Australian AI Safety Institute to provide technical expertise and oversight as global standards evolve.
According to the government, the measures align with interim report recommendations from the Joint Select Committee on Artificial Intelligence. It said they will provide earlier warning of emerging risks from rogue AI agents.
Prime Minister Anthony Albanese said AI presents enormous opportunities for Australia, but the country must also be "prepared for the new risks that come with rapidly advancing technology."
Minister for Home Affairs and Cyber Security Tony Burke said those who want to cause harm have access to the latest technology, and Australia needs to have the same or better.
"But it's not a free-for-all, there needs to be clear guardrails to protect Australians," Burke said.
Minister for Industry and Innovation Tim Ayres said keeping Australians safe was "at the heart of the Albanese Labor Government's approach to artificial intelligence."
The government said it will release further details of the legislation once it completes its detailed work and consultation.
Unions welcome regulator
The Australian Council of Trade Unions (ACTU) welcomed the announcement. It said unions have been calling since 2024 for legislated protections backed by an empowered regulator.
"The Medicare breach shows we can't trust these large AI companies to do the right thing," ACTU Assistant Secretary Joseph Mitchell said.
Mitchell warned, however, that the new rules address the risks posed by the development of large AI models, not how employers use the technology.
He said workers need rights that are fit for purpose, and "genuine protections against job displacement and against bosses using AI for intrusive monitoring and surveillance."
The ACTU pointed to Qantas. According to the union, the airline announced on the same day that 850 jobs would be cut and outsourced as it accelerates its use of AI.
Call for an integrated approach
PwC Australia also welcomed the protections. It said their success will depend on a cohesive approach that brings together Australia's regulatory frameworks and can be enforced consistently across jurisdictions.
PwC Australia chief executive Kevin Burrowes said the pace of AI adoption "will ultimately depend on community confidence."
Nicola Costello, PwC Australia's Digital and AI Trust Leader, noted that the new regulator will join several regulators that already have a stake in how AI is used.
"To reduce duplication and unintended grey areas, an integrated and cohesive approach will be critical," Costello said.
She added that the ability to enforce the new rules will be important because the most advanced AI models are being built offshore.
Rapid Review recommendations
The announcement came as the government released the recommendations of a Rapid Review into an incident in which an OpenAI agent infiltrated an Australian Government health website.
The government commissioned the review in September after OpenAI informed it that a rogue AI agent had infiltrated government websites, including the Medicare Statistics Reporting Service Portal.
The government said it had told OpenAI chief executive Sam Altman at the time that the incident was unacceptable and the company's disclosure inadequate.
The review, led by the Department of the Prime Minister and Cabinet, makes 18 recommendations. These include mandatory reporting by AI companies of misaligned behaviour or cyber incidents, and consideration of criminal law reform in cases of serious misconduct. The government said it accepts the recommendations and has begun implementing them.
Costello said the incident shows that the lessons apply beyond frontier developers.
"Every organisation deploying AI agents should know which agents are operating in its systems, what they are authorised to do, who is accountable for their actions, and how quickly they can be stopped," she said.
Rob Di Pietro, PwC Australia's cybersecurity and privacy partner, said the review's call to get back to cyber basics applies just as much to the private sector.
"Organisations may need to treat misbehaving agents as security incidents by detecting, containing and reporting them quickly, including near misses," Di Pietro said.
