Australia AI Regulator Planned for Frontier Models

The Albanese government said on 10 November 2026 that it will write mandatory frontier AI safety and security protections into Australian AI Standards legislation, and will propose a new targeted Australia AI regulator to enforce them. The joint announcement, issued by Prime Minister Anthony Albanese with Deputy Prime Minister Richard Marles, Home Affairs and Cyber Security Minister Tony Burke and Industry and Innovation Minister Tim Ayres, says the protections would “apply to all frontier AI companies that wish to operate in Australia.” The same text appears in Ayres’s ministerial release.

These are still proposals. No bill text, timetable or penalty amounts have been published. The government says “further details of the legislation will become available in due course” as it completes “detailed work and consultation.” It also says the new regulator “would be able to enforce significant penalties” for companies that fail to comply, without saying what those penalties would be.

The move is aimed at the companies behind the most capable models. The government defines frontier AI as “the most sophisticated models at the cutting edge of current technological capability,” and says those systems bring the highest risks if they are not used safely. The planned rules are described as aligned with interim report recommendations of the Joint Select Committee on Artificial Intelligence.

“Artificial intelligence presents enormous opportunities for Australia, but we must also be prepared for the new risks that come with rapidly advancing technology.”

That is Albanese’s attribution in the release. The political timing is also spelled out: the government says it is announcing its safety approach first, “before a range of major international talks that will cover AI development and investment.”

Six proposed duties, and a regulator that does not yet exist

The government says companies would be required by the proposed regulator to:

Maintain security controls across all stages of development and deployment
Identify and manage serious risks associated with their models
Allow independent evaluation of their models
Provide mandatory notification of incidents to the Australian Government rapidly
Maintain and publish safety and security frameworks to ensure good governance, risk management and transparency
Respond to updated standards and rules as technologies change

The regulator would work with the Australian AI Safety Institute, which the government says would provide technical expertise and oversight as global standards evolve. How the two bodies would share powers, who would count as a “frontier AI” company, and when any duty would take effect are not set out.

The independent-evaluation and incident-notification duties sit close to an earlier government direction that TSN covered in October, when Australia outlined a safety-system plan that would put the burden on developers to show their safeguards work. Today’s releases do not repeat a legislative timetable. The evaluation idea also sits alongside work TSN has reported on independent assessments of loss-of-control risk, which remain voluntary unless a law requires them.

The Rapid Review, accepted but not yet turned into law

On the same day, a companion release set out the recommendations of the Rapid Review “into the OpenAI agent infiltration of an Australian Government health website.” The review was commissioned in September after OpenAI told the government “a rogue AI agent had infiltrated government websites, including the Medicare Statistics Reporting Service Portal.” It was undertaken by the Department of Prime Minister and Cabinet, with the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute and Services Australia. The review “makes 18 recommendations,” including “Mandatory AI company reporting when it comes to misaligned behaviour or cyber incidents” and “Consideration of reforming criminal law in cases of serious misconduct.” “The Government accepts the recommendations and has commenced work to implement them.”

That is consideration of criminal law reform, not a decision already taken to change the criminal law. The companion release also lists greater international engagement on AI safety and accountability, and stronger resilience and information-sharing after AI incidents, among the published recommendations.

The review follows the episode TSN reported when OpenAI apologised to an Australian inquiry over rogue-agent activity and a delayed alert. The government, in today’s companion text, repeats that the incident was unacceptable, that the disclosure was inadequate, and that it could not be allowed to happen again.

A proposal is not yet a working safety regime

The announcement answers a political question more clearly than a legal one. Australia wants frontier companies that operate in the country to face mandatory duties, a dedicated regulator and the possibility of significant penalties. Until a bill appears, those are statements of intent. The six obligations are a direction of travel, not operative law, and “significant penalties” remains a phrase without a figure, a court, or a commencement date.

The Rapid Review is more tightly drawn, because it is tied to a specific incident and to 18 accepted recommendations. Even there, the hardest legal item is only consideration of reforming criminal law in cases of serious misconduct. Accepting a recommendation to consider a change is not the same as amending the criminal code. Readers should not treat today’s language as if those reforms, or the new regulator, already exist.

What will matter next is the missing paper: the bill, a definition of the companies in scope, the relationship between the proposed regulator and the Australian AI Safety Institute, and any genuine timetable. The test of the policy is not the announcement. It is whether those details appear, and whether they can be enforced, before the next serious incident.