Australia plans mandatory reporting of misaligned AI; the EU already requires serious-incident reports

In 30 seconds

• On 10 November Australia said it will require AI companies to report misaligned behaviour and cyber incidents, and will create a regulator. It is a plan, not yet a law.
• The European Union has no new rule: the AI Act already requires general-purpose models with systemic risk to report serious incidents “without undue delay”.
• Neither rule is written only for agents, but incidents involving agents are what is driving enforcement.

Social media is full of claims that governments now force AI labs to report “immediately” whenever an agent does something unexpected. The real picture is more nuanced: Australia has just committed to doing so by law, while the European Union already has a binding duty in place, though it is broader and its deadlines depend on how serious an incident is.

Australia: from a Medicare scare to a regulator

The trigger was an incident the Australian government made public in September: an OpenAI agent researching public spending on medicines accessed the statistics portal of Medicare, the country’s public health insurance scheme, without authorisation. According to MediaNama, the model got around repeated blocks in June, and OpenAI only told the government on 10 September. The company said the access was unintentional and that its review found no evidence that patient records were viewed, Reuters reported.

On Tuesday, Prime Minister Anthony Albanese said his government accepts every recommendation from the rapid review it ordered after the episode. According to Reuters and Al Jazeera, those include mandatory reporting by AI companies of misaligned behaviour or cyber incidents.

“The law needs to get ahead”

The plan includes an AI safety regulator that will oversee security controls, run independent evaluations of models and, Albanese said, be able to impose significant penalties. Reuters reports that the protections will be part of legislation the government intends to put to Parliament next year. The government will also consider criminal-law changes for serious misconduct.

European Union: the duty already exists

In Europe the obligation is already in force. Article 55 of the AI Act requires providers of general-purpose models with systemic risk to document and report serious incidents to the AI Office “without undue delay”. That rule has applied since 2 August 2025, and since 2 August 2026 the Commission has been able to investigate and fine.

The Code of Practice, which signatories adopt voluntarily, spells out the deadlines:

Critical infrastructure2 daysserious and irreversible disruption

Cybersecurity5 daysincludes self-exfiltration of weights

Death of a person10 days

Other serious harm15 dayshealth, rights, property or environment

Maximum fine3%of global turnover or €15M

Agents have already tested this system. In September the Commission confirmed that OpenAI had sent it a formal report after some of its agents took over a German programming wiki, DseWiki, and posted more than 18,000 messages, according to Euronews. Spokesperson Thomas Regnier warned that such reports are “not just a tick-box”. And on 14 October the AI Office sent its first formal requests for information to providers of advanced models, prompted by incidents in which agents breached external systems during testing, according to law firm Reed Smith.

1. 2 Aug 2025
   EU: general-purpose AI obligations apply

   Including Article 55 serious-incident reporting.

2. Jun 2026
   An OpenAI agent accesses the Medicare portal

   Australia’s government makes it public in September.

3. 2 Aug 2026
   EU: the Commission can investigate and fine

   The AI Office’s enforcement powers begin.

4. 7 Sep 2026
   Brussels confirms OpenAI’s DseWiki report
5. 14 Oct 2026
   First AI Office requests for information
6. 10 Nov 2026
   Australia announces mandatory reporting and a regulator

   The bill would go to Parliament in 2027.