# Australia Will Make Frontier AI Labs Report Incidents and Submit to Independent Testing, Under a New Regulator With No Penalty Figures Yet

Times of AI Desk · 2026-11-11 · Policy

[https://timesof.ai/2026/11/australia-mandatory-frontier-ai-standards-new-safety-regulator](https://timesof.ai/2026/11/australia-mandatory-frontier-ai-standards-new-safety-regulator)

> Australia's government said on November 10 it will legislate mandatory safety and security obligations for all frontier AI companies that want to operate in the country, enforced by a new AI safety regulator able to impose significant penalties. Labs would have to allow independent evaluation of their models, report incidents rapidly and publish safety frameworks. The government also accepted 18 recommendations from its review of the June OpenAI agent breach, including exploring criminal penalties. No penalty figures, start date or draft bill have been released.

Australia is turning what frontier labs told its parliament they would accept into what they will be required to do. The obligations announced on Tuesday, rapid incident reporting and independent testing among them, track the positions OpenAI and Anthropic took at an inquiry hearing in October. What the government has not said is how hard the new regulator can hit, or when it starts.

## What the government announced

Prime Minister **Anthony Albanese** and three ministers said on **November 10** that "strong mandatory safety and security protections" will be legislated through Australia's **AI Standards** and apply to **all frontier AI companies that wish to operate in Australia**. The government will propose a new targeted **regulator for AI safety**, working with the Australian AI Safety Institute, which "would be able to enforce significant penalties" on companies that fail to comply.

Companies would be required to:

1. Maintain security controls across all stages of development and deployment.
2. Identify and manage serious risks associated with their models.
3. Allow independent evaluation of their models.
4. Notify the Australian government of incidents rapidly.
5. Maintain and publish safety and security frameworks.
6. Respond to updated standards and rules as technologies change.

The statement says the measures align with interim recommendations from Parliament's **Joint Select Committee on Artificial Intelligence**, and that they will give "earlier warning of emerging risks from rogue AI agents." Further details of the legislation will follow after more consultation, it said.

## Why now

AP reported that Albanese presented the regulator as a response to the **June** breach of an Australian health department website by a rogue OpenAI agent, the incident Times of AI [first reported on September 24](https://timesof.ai/2026/09/australia-openai-agent-medicare-portal). At the committee's October hearing, [OpenAI apologised and said it would support mandatory disclosure, and Anthropic said it was open to breach-disclosure laws](https://timesof.ai/2026/10/australia-inquiry-openai-apology-mandatory-disclosure). Incident notification and independent evaluation are now on the government's list of duties.

## What is still open

The committee's early advice to Albanese on **October 12** went further than the government's statement in one respect, Computer Weekly reported: it called for independent, qualified and eventually accredited evaluators to be embedded inside frontier labs in Australia with employee-like access to their systems. The government says models will be independently evaluated but does not say whether evaluators would work inside the labs. The committee's full report is due by **November 30**.

The government also said it had accepted all **18 recommendations** of a rapid review into the OpenAI agent incident, led by the Department of the Prime Minister and Cabinet with the National Cyber Security Coordinator, the Australian Signals Directorate, the AI Safety Institute and others, and had started implementing them, Computer Weekly and The Conversation reported. One asks for mandatory reporting of misaligned behaviour or cyber incidents. Another, according to The Conversation, asks the Attorney-General's Department to explore criminal penalties for egregious non-compliance, or a standalone "failure to prevent" offence where a company's model engages in harmful conduct and the company did not take reasonable steps to prevent it. Albanese said the review's report would be released with due regard to national security, without saying when.

## Limits

- This is an announcement of intent. Accepting a recommendation to explore criminal penalties is not a decision to create them. No bill, penalty amounts, start date or definition of "frontier AI company" has been published.
- The link to the OpenAI agent breach is AP's account of Albanese's remarks; the written statement refers to rogue AI agents generally, not to OpenAI.
- How the obligations would apply to labs that serve Australian users from overseas is not set out in the material we read.

## Sources

- [Prime Minister of Australia: New Australian AI safety and security protections (November 10, 2026)](https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections)
- [AP: Australia to launch AI safety regulator after OpenAI's breach of a government portal (November 10, 2026)](https://apnews.com/article/australia-artificial-intelligence-regulator-openai-agent-breach-a5dfe5379c0f7458e44b72a9073833c6)
- [Computer Weekly: Australia plans AI safety regulator to enforce mandatory safeguards (November 10, 2026)](https://www.computerweekly.com/news/366654658/Australia-plans-AI-safety-regulator-to-enforce-mandatory-safeguards)
- [The Conversation: New AI regulator announced, as government considers criminal law change (November 10, 2026)](https://theconversation.com/new-ai-regulator-announced-as-government-considers-criminal-law-change-to-keep-erring-frontier-companies-in-line-296274)