A rapid review of Australian Government arrangements following an AI-driven cyber incident involving OpenAI and Services Australia has outlined 18 recommendations to strengthen the nation’s preparedness for future incidents involving artificial intelligence.
The review warns that AI-related incidents could become more complex, widespread and consequential, calling for stronger cooperation between government agencies, frontier AI developers and international partners.
Among its recommendations, the review urges the Australian Government to strengthen information-sharing arrangements with leading AI developers, including through engagement with OpenAI’s Australian Taskforce, international initiatives, technical collaboration and personnel exchanges.
It also recommends encouraging frontier AI companies to establish research, training and AI safety activities in Australia, potentially giving the Government greater access to technical expertise and improving its ability to respond to emerging risks.
The review proposes that the Government consider mandatory, time-bound AI safety reporting, covering issues such as misaligned AI behaviour and agentic cyber incidents. It also calls for options to encourage the timely reporting of AI-related cyber and safety incidents, including protections for developers and others who disclose vulnerabilities or incidents.
The Office of AI is being asked to consider how Australia’s proposed AI Standards could draw on existing regulatory and law-enforcement mechanisms used by international counterparts.
The review also highlights the importance of Australia’s international engagement on AI governance. It recommends that the Department of Foreign Affairs and Trade, the Australian Signals Directorate and the Department of Industry, Science and Resources, including the Australian AI Safety Institute, continue working with international partners on common expectations for AI safety, incident reporting, evaluations, safeguards and transparency.
It further calls for the Government to consider whether the AI Safety Institute has sufficient capacity to meet growing demands for technical research, evaluations and analysis, including providing rapid scientific and technical advice during a crisis.
Criminal law and government accountability
One of the more significant proposals concerns potential changes to Australia’s criminal law to improve AI safety.
The review recommends that the Attorney-General’s Department, in consultation with the Australian Federal Police, the Department of Home Affairs and other relevant agencies, examine options including criminal penalties for serious regulatory non-compliance.
It also proposes exploring a standalone ‘failure to prevent’ offence. Under this approach, a company responsible for developing an AI model could face criminal liability where the model engages in harmful conduct and the company fails to take reasonable steps to prevent that harm.
The recommendations also seek clearer responsibilities across government when agencies encounter suspected cyber security incidents that have not yet been technically verified.
The Protective Security Board is being asked to issue guidance clarifying agency obligations and escalation expectations when vulnerabilities or suspected incidents are reported but remain technically unconfirmed.
Commonwealth agencies are also urged to review their vulnerability-disclosure and cyber incident-management procedures to ensure unusual or emerging threats are escalated promptly to the Australian Signals Directorate, Home Affairs and senior decision-makers.
The review recommends formal liaison arrangements between the Australian Signals Directorate’s Australian Cyber Security Centre, the National Office of Cyber Security and the Australian AI Safety Institute to improve information-sharing and identify incidents that could have wider national security implications.
It also calls for clearer procedures to ensure the National Office of Cyber Security determines whether broader consequence-management arrangements are required following a cyber incident.
Preparing government agencies for AI-related threats
The remaining recommendations focus on strengthening the cyber security capabilities and preparedness of Commonwealth agencies.
Government departments responsible for national plans under the Australian Government Crisis Management Framework are being asked to assess how AI could affect the hazards and emergencies they manage. They must report their findings and any proposed changes to relevant Crisis Arrangements Committee chairs by the end of 2026.
The review also recommends improving AI literacy among government staff so they can better recognise and respond to AI-related risks.
It calls for renewed attention to fundamental cyber security practices, including implementation of the Australian Signals Directorate’s Essential Eight mitigation strategies.
Other proposed measures include reducing the size of the Government’s digital estate by consolidating systems and disconnecting or segregating systems that do not need internet access.
The Government is also being urged to consider further strengthening the cyber defences of Systems of Government Significance in response to changing threats and risk profiles.
At the same time, agencies should work with the Australian Signals Directorate to identify responsible ways to use AI-enabled cyber defence tools for security monitoring, penetration testing, threat detection and incident response.
Taken together, the 18 recommendations seek to strengthen Australia’s ability to identify, report and respond to AI-driven cyber incidents while improving cooperation between government, industry and international partners.
Support our Journalism
No-nonsense journalism. No paywalls. Whether you’re in Australia, the UK, Canada, the USA, or India, you can support The Australia Today by taking a paid subscription via Patreon or donating via PayPal — and help keep honest, fearless journalism alive.
