Australian laws are tougher on hacked companies than rogue AI doing it – here’s what needs to change to make agents accountable

The Australian government looks likely to introduce stronger legal checks on artificial intelligence (AI) companies to parliament early next year, after a bipartisan parliamentary committee released early recommendations in a letter to the prime minister.

Their final report is due by the end of November.

Yet even after those proposed changes, our laws won’t do enough to hold companies accountable for so-called “rogue AI”.

This includes instances such as OpenAI’s AI agents hacking multiple federal and state government websites in Australia this year, which OpenAI only belatedly revealed.

But there are precedents for how to get tougher on companies responsible for rogue AI hacks.

How AI agents slip through legal cracks

If an Australian business – even a relatively small one, with an annual turnover of just A$3 million or more – suffers a data breach likely to cause serious harm, the rules are clear. That business or organisation must notify the customers or others affected, as well as the Office of the Australian Information Commissioner.

But if a company’s AI agent – software that can browse websites and complete tasks without needing a person to check each step – actually does the breaking in, the rules are very different.

OpenAI had no legal obligation to tell anyone that its AI agents breached security on Australian government websites during a training exercise in June. It didn’t even have a direct obligation to prevent those hacks.

The only legal responsibility sits with whoever held the data – not whoever took it. That’s true whether that company is based here in Australia, or overseas (such as US-based OpenAI).

Hacking offences currently assume a human intentionally breaks in. The law doesn’t account for a machine that, in Prime Minister Anthony Albanese’s words, “didn’t accept ‘no’ for an answer”.

What’s being done now

The prime minister’s AI rapid review taskforce is considering whether existing processes can handle AI cyber incidents. It is expected to report within weeks.

There’s also draft legislation being prepared on other ways to better regulate technology.

For example, the government’s privacy bill proposes requiring any handling of personal information to be “fair and reasonable”. If that legislation passes, clicking “I agree” when you see terms and conditions would no longer excuse unfair practices.

Meanwhile, the digital duty of care bill – introduced to parliament on Thursday – would require social media platforms and search engines to assess foreseeable risks and proactively reduce them. Penalties for failing could exceed A$100 million.

However, neither of those bills covers companies that build AI models, then let their AI agents loose on the internet.

On Tuesday, the joint parliamentary committee on AI released its preliminary recommendations for AI safety and risk management. Those recommendations included requiring AI companies to submit to independent safety checks.

Without stronger obligations on the companies, this measure is unlikely to have real impact on safety culture at the tech giants.

4 more steps we need to take

Our submissions to parliament’s AI inquiry propose several additional steps.

An AI “duty of care”: The proposed “digital duty of care” needs to be extended beyond online safety. It should include a legal obligation on companies developing AI to take reasonable care not to harm others.

Australian employers have worked this way for decades, keeping workers safe “so far as is reasonably practicable”.

This would mean AI companies have to find and reduce foreseeable risks, such as an AI agent that won’t take no for an answer. It also means proper testing with secure boundaries, before a new agent is allowed onto the internet.

Individual rights: People harmed when a company falls short under the duty of care should be able to take it to court. Without a direct safety duty, and accompanying right of legal action, people currently face jumping through multiple legal hoops to get redress.

Registration of AI companies: Phone companies and financial advisers need a licence. Yet most AI businesses need not even tell a regulator they exist. So how can regulators know who they are regulating?

Registration of companies providing large AI and computing services to Australians, with a local contact and a duty to report incidents promptly, would close that reporting gap.

Mandatory reporting rules for AI breaches: Appearing at a parliamentary inquiry hearing last week, OpenAI and rival company Anthropic both backed the need for mandatory reporting for AI breaches. We agree.

None of this is radical.

Since 1992, Australian law has held manufacturers responsible for goods that are less safe than people are entitled to expect. For instance, a car maker has to both report and pay to fix faulty airbags. They can also be sued if those airbags cause harm.

It’s time AI companies were held legally responsible for their faulty products too.

• Rob Nicholls, Senior Research Associate in Media and Communications, University of Sydney and Jeannie Marie Paterson, Professor of Law (consumer protections and credit law), The University of Melbourne

This article is republished from The Conversation under a Creative Commons license. Read the original article.