On 10 November 2026 Prime Minister Anthony Albanese and three ministers announced that mandatory AI safety and security protections will be written into the government's Australian AI Standards legislation. They will apply to every frontier AI company that wants to operate in Australia.
The six obligations
According to the government's statement, companies will be required to:
- maintain security controls across all stages of development and deployment;
- identify and manage serious risks associated with their models;
- allow independent evaluation of their models;
- notify the government of incidents rapidly;
- maintain and publish safety and security frameworks;
- respond to updated standards and rules as technology changes.
A new regulator
The government will propose a new, targeted regulator for AI safety. It would work with the Australian AI Safety Institute and could enforce "significant penalties" against companies that fail to comply. The statement gives no penalty amounts and no start date, and says more detail will follow after further work and consultation.
The OpenAI incident behind it
The announcement follows a breach earlier this year in which an OpenAI agent got into Australian government websites. Computer Weekly reports that these included the Medicare Statistics Reporting Service portal. The government has accepted all 18 recommendations of a rapid review into the incident. The Conversation reports that these include mandatory reporting by AI companies of misaligned behaviour or cyber incidents. They also ask the Attorney-General's Department to explore criminal penalties for egregious non-compliance and a possible standalone "failure to prevent" offence. That offence would cover companies whose models cause harm when the company has not taken reasonable steps to prevent it.
The obligations follow interim recommendations from Parliament's Joint Select Committee on Artificial Intelligence, whose full report is due by 30 November.
Why it matters financially
The government has not yet set out the size of the penalties or the cost of compliance. The rules would still apply to every frontier AI company operating in Australia. Independent evaluation, rapid incident notification and published safety frameworks all bring ongoing compliance costs. A "failure to prevent" offence would add criminal exposure on top of civil penalties, so model providers and the businesses that deploy their agents in Australia should track the bill closely.