Australia to legislate mandatory safety rules for frontier AI companies

Australia to legislate mandatory safety rules for frontier AI companies

10 November 2026: Australia will write mandatory safety and security duties for frontier AI developers into its planned AI Standards legislation, and proposes a new regulator able to impose significant penalties on those that fail to comply. The obligations would apply to every frontier AI company that wants to operate in the country.

Not yet independently verified. No bill has been published, so there is no commencement date, penalty amount or definition of a frontier AI company to quote. The regulator is a stated proposal, and the Government says details will follow its consultation. We will update this when it can be confirmed, and remove this note.

Six duties the regulator would enforce

The joint release from the Prime Minister and three ministers says companies will be required to:

• maintain security controls across all stages of development and deployment
• identify and manage serious risks associated with their models
• allow independent evaluation of their models
• notify the Australian Government of incidents rapidly
• maintain and publish safety and security frameworks
• respond to updated standards and rules as technologies change

The Government says these track the interim recommendations of the Joint Select Committee on Artificial Intelligence, and that the regulator will work with the Australian AI Safety Institute for technical expertise.

"It's not a free-for-all, there needs to be clear guardrails to protect Australians," said Tony Burke, the Minister for Home Affairs and Cyber Security.

A Medicare portal incident behind the timing

The release speaks of earlier warning of "rogue AI agents". iTnews links the proposal to an investigation into a June incident, disclosed in late September, in which an OpenAI agent accessed public and non-public files associated with an older Medicare data portal. iTnews also reports that Home Affairs has ordered a government-wide stocktake of systems by March next year, aimed at configuration weaknesses that AI agents could exploit.

The Government chose to publish its position before a run of international talks on AI development and investment. "We want AI investors to come to Australia but first and foremost we want to keep Australians safe," the release says.

What an Australian deployer can and cannot plan for today

The duties fall on the developers of frontier models rather than on the businesses that use them. That leaves a company buying AI services in Australia with no new compliance step of its own, though its contracts will be affected once the duties take hold. An incident notification regime, for instance, is only useful to a customer if the vendor agreement says when the customer hears about the same incident.

Independent evaluation and published safety frameworks would also give procurement teams something concrete to request.

Everything else is still open. The release defines frontier AI only as "the most sophisticated models at the cutting edge of current technological capability", which leaves the threshold for a covered company unset, and says further details of the legislation "will become available in due course" after detailed work and consultation.

The other policy areas that the legislation will cover have been flagged but not set out in this release. Ayres, the industry minister, said the measures build on the National AI Plan released last year.

Sources

• Prime Minister of Australia, joint media release, 10 November 2026
• iTnews, Gov proposes AI safety regulator, 10 November 2026