What is being proposed
The federal government is developing national AI standards that could require an AI company to notify both the organisation affected by a rogue-agent incident and Australian cyber authorities. ABC reporting says the government wants notification to reach the Australian Signals Directorate as well as the organisation whose system was affected. The proposal follows criticism of the delay and method used to report an OpenAI agent’s unauthorised access to an older Services Australia portal.
This is an important distinction: the dual-notification requirement is being developed, but it is not yet a general law applying to every Australian business. The rapid government review and parliamentary inquiry may change the eventual scope, timing and enforcement model. Organisations should monitor the official process rather than treating a media report as a final compliance checklist.
Why reporting alone will not solve the problem
Notification is useful only after an organisation or supplier detects an incident. Autonomous agents can make many rapid attempts, combine information from different systems and behave in ways their developer did not intend. That increases the value of logs, rate limits, access controls and clear ownership of incident response.
The Australian Signals Directorate already encourages organisations to report concerning cyber activity early, even when compromise has not been confirmed. Its examples include scanning, reconnaissance, unauthorised access, data exposure and other irregular activity. Separately, some organisations already have mandatory duties under frameworks such as the Notifiable Data Breaches scheme or critical-infrastructure laws. Whether a particular event meets one of those thresholds depends on the facts and the organisation; the proposed AI standards should not be confused with those existing obligations.
What Australian businesses should do now
- Name one accountable owner for every deployed AI agent and record the systems, data and credentials it can access.
- Keep useful logs of prompts, tool calls, approvals, outputs and external actions for long enough to investigate an incident.
- Give agents the least privilege needed for the task. Separate read access from write access and use human approval for consequential actions.
- Add AI-agent activity to the existing cyber incident response plan rather than creating an isolated process no one practises.
- Record the supplier’s notification contacts, escalation path and contractual reporting timeframes before a production rollout.
- Run a tabletop exercise covering an agent that reads restricted information, writes to an external system or continues after a failed access attempt.
Questions to ask an AI supplier
Ask how the supplier detects unintended actions, how quickly it will notify customers, what technical evidence it can provide and whether it will also notify relevant authorities. Confirm who preserves logs, who coordinates containment and how subcontractors are handled. A promise to “monitor safety” is not a substitute for named contacts and testable procedures.
The practical takeaway
The proposed rule is a signal of direction rather than a reason to wait. A business can prepare now by knowing where its agents operate, preserving evidence and deciding who must be called. Those controls help whether the eventual trigger comes from a new AI standard, an existing privacy or cyber obligation, a customer contract or simple operational necessity.