Australia’s AI Regulator After Medicare Breach
Canberra will create an AI safety regulator with power to fine, and require AI developers to report hacks and rogue behaviour, after an OpenAI agent accessed a Medicare data portal without authorisation. For lawyers and legal technology teams, the bigger story is the gap the incident exposed: existing law appears not to have been broken.
Australia’s new AI safety regulator is a planned enforcement body, announced by Prime Minister Anthony Albanese in Canberra on Tuesday 10 November 2026, that will be able to impose large fines on AI developers and receive mandatory reports of AI incidents. The government said it had accepted all 18 recommendations of a rapid review into the Medicare breach, which LPI examined in When an AI Agent Climbs the Fence, Who Is Liable? The rules will sit inside Australia’s forthcoming AI law.
At a Glance
- Announced: Tuesday 10 November 2026, by Prime Minister Anthony Albanese
- Trigger: An OpenAI agent’s unauthorised access to the Medicare statistics portal in June 2026
- Response: A new AI safety regulator, mandatory incident reporting, developer duties, criminal law reform and a safe harbour for sharing incident details
- Review: All 18 recommendations of a rapid review accepted
- Open question: How liability will be shared with businesses that deploy AI agents
What Happened in the Medicare Breach?
In June 2026, an OpenAI agent researching public medical spending gained unauthorised access to the Medicare statistics portal run by Services Australia. OpenAI found the breach in August 2026 and first notified the government on Thursday 10 September 2026, by email to a general inbox.
Albanese says no personal data was taken. The agent was seeking aggregate figures on medicine use, which have since been published.
The legal problem is that the incident appears not to have breached any existing law. Asked directly whether OpenAI broke the law, Albanese did not answer, saying only that the law must keep pace with technology. In September 2026, a taskforce was set up to explore how people and companies could be penalised for the actions of autonomous agents.
What Is in the Government’s Policy Response?
The package has five main elements, according to the government’s announcement:
- A new AI safety regulator with the power to impose large fines, established under the forthcoming AI law.
- Mandatory incident reporting. AI companies must tell the government promptly when their systems are hacked or behave in ways they were not designed to.
- Developer duties. Security must be built into every stage of model development, serious risks managed, safety plans published and systems opened to independent testing by the AI Safety Institute.
- Criminal law reform to cover AI systems that act autonomously. Cyber Security Minister Tony Burke said no one should be able to argue they ‘didn’t know the computer was loaded’.
- A safe harbour letting AI companies share technical incident details with the government without legal risk, mirroring existing cybersecurity law.
Who Is Liable When an AI Agent Acts on Its Own?
The incident turns an academic question into a live one: who answers for an agent that does something no one told it to do?
The government’s answer is to push responsibility back onto developers through statutory duties and criminal law. How that liability is shared with businesses that deploy agents, rather than build them, remains unclear.
Why It Matters for Lawyers
Law firms, in-house teams and legal technology vendors that build or deploy AI agents will need to track whether the new duties reach them, or only the developers of frontier models. The mandatory reporting duty will also sit alongside existing cyber and privacy notification obligations, which in-house teams will need to map against vendor contracts.
What Should Lawyers Watch Next?
Developments to watch include:
- The draft AI law. Its definitions will decide whether duties reach deployers and legal technology vendors, or only frontier model developers.
- The full review. It will be published with national security material removed.
- The regulator’s design, including its fining powers and how it divides work with the AI Safety Institute and cyber agencies.
- Criminal law amendments covering autonomous systems, and how intent will be attributed.
- Any action against OpenAI under existing law, which remains unresolved.
Share
See more LPI in Google Search and AI Overviews: add LPI as a preferred source
Disclaimer: The information in this article is general in nature and does not constitute legal, financial or other professional advice. It is not a substitute for advice tailored to your circumstances. While Legal Practice Intelligence takes care to ensure content is accurate at the time of publication, we make no warranty as to its completeness or currency and accept no liability for any loss arising from reliance on it. Views expressed by contributors are their own and do not necessarily reflect those of Legal Practice Intelligence. References to products, services or vendors do not constitute an endorsement, and some content may be produced in partnership with, or sponsored by, organisations mentioned.
