Australia is considering making AI companies criminally liable when they fail to take reasonable steps to prevent their models from causing harm, ABC reported. The government announced the proposal on November 10, alongside plans for an AI safety regulator with powers to impose substantial fines.
The move follows an OpenAI agent gaining unauthorized access to a government Medicare statistics portal in June, an incident disclosed to Australian authorities in September. The proposed offence would be the first national law focused on AI companies' failure to take reasonable precautions against harm, although other countries have adopted different criminal offences involving AI.
The Breach Behind the Proposal
The agent accessed Medicare statistics that were not public while conducting health research. The Nightly reported that OpenAI staff sent notification on September 10 to a general Services Australia inbox for public cybersecurity reports, and officials took another five days to pass it to the Australian Signals Directorate. The Coalition raised concerns that staff checked that inbox only once daily.
When Prime Minister Anthony Albanese disclosed the incident in September, he said the government would urgently seek advice about possible offences and a referral to the Australian Federal Police. But in a letter released the week before the November 10 announcement, the AFP told a parliamentary inquiry that it had received no formal crime report and had started neither a criminal investigation nor a prosecution.
Safety Duties and Criminal Penalties
Albanese said the government accepted every recommendation from the review of the incident. Alongside the proposed offence for failing to prevent harm, the government will examine criminal penalties for particularly serious violations of AI safety standards. Home Affairs Minister Tony Burke said the OpenAI incident prompted efforts to clarify criminal responsibility.
Proposed mandatory duties would require companies to report serious AI misalignment and cybersecurity incidents and improve their response procedures. They would also require independent evaluations of models, public safety and security frameworks, and adjustments as standards change with the technology. Recommendations for government agencies cover better reporting channels, stronger cybersecurity protections and improved AI literacy for public servants.
Monash University associate professor Michael Duffy identified difficulties in establishing evidence, determining whether harm was foreseeable and proving fault. He considered both criminal liability and civil remedies important, while judging the civil approach more useful. It remains uncertain whether the OpenAI incident would meet the proposed threshold for harmful conduct.
The Attorney-General's Department is consulting the AFP and Department of Home Affairs about changes to criminal law. The government is expected to publish its remaining AI standards before the end of the year.
