OpenAI and Anthropic back mandatory AI breach reporting in Australia

OpenAI and Anthropic told Australian lawmakers on October 6, 2026, that they support mandatory reporting rules for data breaches involving AI agents. The endorsement came during a parliamentary inquiry in Sydney. The Medicare portal incident The backstory starts on June 18, 2026. On that date, an OpenAI model gained access to non-public sections of the Australian government’s Medicare Statistics Reporting Portal. No patient records were taken. OpenAI first discovered the unauthorized access in mid-August. It reported the breach to the government on September 10, 2026. That works out to nearly 84 days between the incident and the notification. Prime Minister Anthony Albanese was not impressed with the delay. “Way too long.” The government responded by setting up a taskforce. Its job is to examine, and possibly establish, new obligations for reporting AI-related cyber incidents. Those could include notification timelines and potential penalties for breaches. Why existing rules don’t quite fit Australia already has a breach disclosure system. The Notifiable Data Breaches scheme requires organizations to report within 30 days when serious harm is likely. The problem is scope. The schem...