How one company’s slow response to a minor breach changed the rules for AI in Australia

On 6 October 2026, one of OpenAI’s most senior executives sat before an Australian parliamentary committee in Sydney and began with an apology. Big artificial intelligence companies seem to be apologising more and more often, and in this case it was certainly warranted.

Five weeks later, the Federal Government gave its response. On 10 November, the Prime Minister announced mandatory safeguards for AI companies, a new regulator with the power to issue penalties, and a possible criminal offence for companies that fail to stop their models causing harm. 

OpenAI’s handling of the situation drew a lot of criticism. Some of it was about the dystopian nature of what happened, but much of it was about how long the company took to speak up. Timing aside, its apology ticked almost every box.

What happened

In June, OpenAI was training an experimental AI model which went further than it was supposed to. The model had been asked to research government spending on certain medicines, and it was unable to find the answer through normal public channels.

It found a way into a non-public part of the Services Australia website that reports Medicare statistics to find this information. 

OpenAI’s review later found similar activity on other Australian government sites.

They added that no individual patient records were accessed. 

What OpenAI got right

Once it started apologising, OpenAI had all the ingredients to an apology that most companies tend to struggle with:

• It said sorry, plainly. Jason Kwon opened his evidence with: “I want to begin with an apology.”
• It apologised for the response as well. OpenAI admitted it should have handled the situation better.
• It sent someone senior, in person. A top executive flew from the US to face the committee, signalling that the issue is taken seriously.
• It published the uncomfortable details. The statement set out OpenAI’s own timeline, including the dates that made it look bad.
• It made specific promises. OpenAI committed to dedicated support for affected agencies, funding to strengthen Australia’s cyber defences, and an Australian taskforce with independent experts due to report by the end of the year. Within a month it had named the taskforce: former eSafety Commissioner Alastair MacGibbon, Tech Policy Design Institute director Johanna Weaver, and former Chief of Navy Ray Griggs.
• It changed behaviour straight away. When its review found another affected agency in late September, OpenAI says it made contact within 48 hours, a great improvement on 84 days.
• It backed tougher rules. At the hearing, OpenAI told lawmakers it supports mandatory reporting of breaches involving AI agents.

Where it went wrong: the wait

A good apology can’t undo a slow disclosure. OpenAI has since said it wanted to finish its investigation before giving agencies a full account, and that it should have shared preliminary findings sooner.

The missed opportunities made it worse. OpenAI’s CEO met a senior Australian minister nine days before the notification and didn’t raise it. Around the same time, its global policy head was in Canberra lobbying the government on copyright, and didn’t mention it either. When the notice finally came, it went to a generic inbox. At the hearing, an independent senator asked why such a serious breach was reported that way.

What the silence cost

The silence meant that when the story had broke, the Prime Minister was the one telling it, not OpenAI. This put the company into a position where it had to react quickly without any control of the narrative.

The Prime Minister himself described the incident as “minor in terms of direct implications.” No personal records were taken, and the Australian Federal Police has said it has received no formal report of a crime and has not opened an investigation.

Even so, the way it was handled has helped reshape the rules for an entire industry. On 10 November, the Government accepted all 18 recommendations of its rapid review. AI companies operating in Australia will have to report AI security breaches and potential breaches of criminal law. Frontier AI models will face independent evaluation. A new regulator will oversee the industry and be able to penalise companies that break the rules. 

The Government will also consider a “failure to prevent” offence for AI companies whose models cause harm when they haven’t taken reasonable steps to stop it. If adopted, it would be a world first.

None of this is law yet, and no timeframes have been announced. 

What we learned

OpenAI’s apology was one of the better corporate apologies Australia has seen in a while. The big lesson is that this was a relatively minor incident, and a well-structured apology still couldn’t make up for the 84 days of silence. 

The consequences of that silence are being written into national policy.

In an age where professional services firms have a great deal of access to client information, it’s important to follow these rules when something goes wrong.

1. Tell people early, even if you don’t know everything. A partial, honest update beats a complete one that arrives months late.
2. Tell the right person, the right way. A serious issue deserves a phone call to someone senior.
3. Apologise for the handling. If your response was slow or clumsy, say so. People forgive errors more readily than they forgive feeling kept in the dark.
4. Make your commitments concrete. “We take this seriously” means nothing. Name what you’re changing, who’s responsible and when you’ll report back, then follow through visibly.
5. Plan before anything goes wrong. Decide now who makes the call to disclose, who speaks and how affected clients are told. In a crisis, the firms that move fastest are the ones that already know the steps.

---

Freddie Fletcher is an Account Manager at Popcom PR, an Australian public relations and strategic communications agency specialising in media relations, corporate reputation and communications strategy.