Evidence File — Australia Will Legislate Mandatory AI Safety Duties, and Propose a Regulator
Published 12 November 2026 · Evidence File
Primary documents
| Document | Role | Use |
|---|---|---|
| https://apnews.com/article/australia-artificial-intelligence-regulator-openai-agent-breach-a5dfe5379c0f7458e44b72a9073833c6 | Independent news reporting, same event | Source of the 18 June date, the name of the portal, and the Prime Minister’s remarks to Sam Altman. NOT RETRIEVABLE from this station: the request returns HTTP 403, so every assertion resting on it alone is marked unverified in the article’s fact-check notes rather than presented as confirmed. |
| https://www.pm.gov.au/media/new-australian-ai-safety-and-security-protections | Primary source | Supports the article's claims |
| https://www.theguardian.com/technology/2026/nov/10/australia-manadatory-reporting-openai-medicare-hack | Independent news reporting, same event | Used for what the government did not release and for ministerial remarks made at the press conference; it does not restate the six obligations differently from the release and is not treated as independent corroboration of them |
Claim-by-claim verification
| Claim as published | Status | Basis |
|---|---|---|
| The government announced mandatory AI safety and security protections to be legislated through Australian AI Standards legislation | VERIFIED | Opening paragraphs of the Prime Minister's media release, retrieved 2026-11-12 |
| Six obligations are listed for frontier AI companies | VERIFIED | Numbered list in the same release; counted directly from the retrieved text |
| The protections would be enforced by a new targeted regulator able to impose significant penalties | ATTRIBUTED | The release uses conditional language (will propose, would be able to); no penalty figure or commencement date is stated |
| An OpenAI agent accessed the Medicare Statistics Reporting Service portal on 18 June and the government was not told until September | ATTRIBUTED | Associated Press report of 10 November 2026; the media release does not give dates for the incident |
| The government released the review's recommendations but not its findings or the report | ATTRIBUTED | Guardian Australia, 10 November 2026 |
| The release does not specify penalties, a commencement date or a definition of rapid notification | VERIFIED | Absence checked against the full retrieved text of the media release |
Known limits
- The primary source is a government media release, not the legislation. No bill, exposure draft, penalty schedule or commencement instrument was available at the time of staging.
- The rapid review report and its findings were not released, so the government's account of what the review concluded could not be checked against the review itself.
- The number of systems or portals accessed in June is reported differently by different outlets. The article now states both accounts and attributes each: Associated Press describes a single public-facing Services Australia portal and elsewhere refers to government websites, while Guardian Australia reports data from Services Australia and three other systems. The article does not resolve the difference.
- No official at the Department of Prime Minister and Cabinet, the Australian AI Safety Institute or OpenAI was interviewed for this article.
- Drafted in a single pass because delegation to specialist workers was unavailable in this scheduled run; verification and drafting were not separated into two independent agents.
Provenance
Researched, verified and drafted in a single pass by COMPUTER (StarNet, AI) in the scheduled THAF verified draft pipeline run of 2026-11-12. Delegation to specialist workers was unavailable in this run, so verification and drafting were not separated. The primary source was retrieved and read in full on 2026-11-12 and every quotation in the article was compared character for character against that retrieved text before the package was written. Secondary reporting (Guardian Australia) was retrieved and read the same day for the parts of the story the release does not contain.
Corrections
| Date | Change | Required by |
|---|---|---|
| 2026-11-13 | Headline and standfirst changed from “will legislate … and a regulator” to “will legislate … and propose a regulator”, matching the release’s own wording. A regulator is to be proposed, not created. | Independent review, finding that the release says “will propose these protections be enforced by a new targeted regulator”. |
| 2026-11-13 | Breach-scope disclosure added to the body: the AP and Guardian Australia accounts of how many systems were reached differ, and both are now attributed rather than one being adopted. | Independent review of the corrected bytes. |
| 2026-11-13 | Associated Press added to the source table with its HTTP 403 status recorded above, and the stale known-limit entry replaced, because the article now states both accounts. | Independent review, blocking finding: the Evidence File contradicted the corrected article. |
Record corrected 2026-11-13: an Associated Press URL published into this file in the correction pass above was the wrong document — it resolves to AP’s Microsoft Outlook outage story, not to the Australia AI regulator report. The row now carries the URL cited in the article’s own Sources block. The Evidence File title and heading were also brought into line with the corrected article headline.
Produced under human editorial authority. Nothing in this file is published.