Nobody has to tell

Asked on 24 September whether the government could compel an AI company to tell it when something like this happened, the Acting Prime Minister, Richard Marles, did not name a law. "A key part of that engagement is how we can be notified as quickly as possible," he told reporters in Sydney ¹. Engagement is not a duty, so THE RORT went looking for the duty: every reporting requirement in Australian law that might have obliged OpenAI to tell the state its agent had got inside a Services Australia portal.

We checked them one by one. The Privacy Act's breach duty binds whoever holds the data, and only for personal information. The Cyber Security Act's one mandatory clock runs on ransom payments; its incident-sharing scheme is otherwise voluntary. Critical infrastructure operators have carried a clock since 2022; the Act covers eleven listed sectors, and government is not one of them. The agency's own duty to the Australian Signals Directorate is only "as soon as possible." The criminal law does reach companies exactly as it reaches people, including foreign ones, but its unauthorised-access offence needs intent and knowledge, and every party on the record calls this access unintended. A board with compulsory powers over companies already exists; no referral to it has been announced. Overseas, the frontier-AI laws held up as models would probably not have caught this incident either, and not for the same reason each time: California's SB 53 needs injury, catastrophe, loss of control or deception, and none clearly applies, New York's RAISE Act is not yet in force, the EU's Article 73 obligations for standalone high-risk systems are deferred to December 2027 and Article 55's reach is doubtful, and the United Kingdom has no such law at all.

The gap this turned up is not a softer law for companies. It is a reporting duty nobody has written, and a criminal offence built for a person who means to do it.

01The data holder's duty

Start with the law built for this kind of event: a data breach. The Notifiable Data Breaches scheme sits in the Privacy Act, and its trigger is written around the entity that holds the information, not the entity that got into it. "A data breach occurs when personal information an organisation or agency holds is lost or subjected to unauthorised access or disclosure," the Office of the Australian Information Commissioner's own explanation reads ². The duty to assess and, if warranted, notify falls on whoever is holding the data when it is exposed.

The OAIC's guide puts the clock in words: "An entity must take all reasonable steps to complete the assessment within 30 calendar days after the day the entity became aware of the grounds" ³. Applying that scheme to OpenAI is where the first wall appears. OpenAI does not hold Services Australia's data. On THE RORT's reading, the Notifiable Data Breaches duty was never built to reach a company that got into someone else's system, rather than one that lost data out of its own. That is analysis, not a line from the Act, and it is worth saying plainly, because the duty sounds at first read like exactly the tool this incident needed.

The government's own account of the incident does not even put the duty in play for Services Australia. The Prime Minister told reporters in New York: "No personal information is believed to have been accessed at this stage, but investigations are ongoing" ⁴. On that assessment, the Privacy Act duty, which would in any case fall on Services Australia rather than on OpenAI, is not engaged. That reading is THE RORT's, applying the government's own words to the scheme.

The government's rewrite of this law does not move the duty either. An exposure draft of the next Privacy Act tranche, released 31 August 2026 with submissions closed 18 September, keeps the eligible-breach test pinned to the entity that was itself breached: "a data breach of an entity is an eligible data breach if... a reasonable person would conclude that the access or disclosure would be likely to result in serious harm" ⁵. The draft does add a new category for processors, but only for a company acting on another's instructions: "a processor... on behalf of another APP entity (a controller) if: (i) in accordance with instructions given to the processor by the controller" ⁵. On our reading, an uninvited third party inside someone else's system is not a processor acting on anyone's instructions, and the rewrite does not reach this kind of incident either.

Update, 30 September 2026. Attorney-General Michelle Rowland told ABC RN on 29 September: "under privacy law, which comes under my purview, there's currently a 30-day requirement for notifications where there are potentially breaches of personal information. Just as an aside as well, we are proposing in our next tranche of privacy reform that the notification requirement come down to 72 hours." That is the Attorney-General's account of the current law and of a proposal; it is attributed to her here. The exposure draft above carries the same clock: proposed section 26WK(1) applies "if an entity becomes aware that there are reasonable grounds to believe that there has been an eligible data breach of the entity", and section 26WK(2) says "The entity must, within 72 hours, give the Commissioner a statement" ⁵. Like the rest of the draft, that clock falls on the entity that holds the data. The OAIC's guide, quoted above, puts the 30 days on completing the assessment of a suspected breach, and this article's reading is unchanged. She also noted the critical infrastructure regime's reporting requirements of 12 to 72 hours, and said: "So we're looking also at those notification requirements, as well as whether there is any potential breach of the Criminal Code as it stands."

Update, 9 October 2026. The Office of the Australian Information Commissioner replied on 9 October 2026, from its media mailbox, to THE RORT's enquiry of 6 October 2026 on the Notifiable Data Breaches scheme and the OpenAI agent incidents, which put three questions and asked for a reply by 5pm AEDT on Friday 9 October 2026. Its reply gave a statement from the OAIC. The statement reads, in full: "The Office of the Australian Information Commissioner (OAIC) is aware of unauthorised access to the public facing Medicare Statistics Reporting Services Portal by OpenAI and is coordinating with the government taskforce examining this matter, including providing input to the AI Safety Institute." "Part of that work will involve clarifying how an AI incident reporting framework would intersect with the Notifiable Data Breach (NDB) regime. The NDB regime is technology-neutral and will apply when an AI incident involves personal information and meets certain threshold criteria." "There is currently no general obligation for organisations and agencies to notify the OAIC of a data breach or cyber incident having taken place. The NDB scheme applies to eligible data breaches that involve unauthorised access to or disclosure or personal information that is likely to result in serious harm to the individuals to whom the information relates. The obligation to report is on the entity that holds the personal information affected by the breach, not on the entity which occasions the breach. Organisations generally have 30 days to assess whether an incident amounts to an eligible data breach and to notify the OAIC under the NDB scheme." "The OAIC has been advised by Services Australia that there is presently no evidence that personal information has been accessed as part of the incident, but investigations are ongoing. The OAIC will continue to liaise with Services Australia as the investigation progresses." "The OAIC encourages compliance with the NDB scheme by offering advice to regulated entities, handling complaints, and by providing information about how to prevent, prepare and respond to data breaches (Preventing, preparing for and responding to data breaches | OAIC)." ⁷⁸ "Strong privacy governance and safeguards are essential for businesses and government to gain advantage from AI and build trust and confidence in the community. That extends to engagement with third parties such as AI providers." The statement does not number or restate the three questions, and it does not mention the 72-hour proposal that the third asked about. Its sentence that the obligation to report is on the entity that holds the personal information, not on the entity which occasions the breach, puts the duty where the first paragraph of this section puts it. The link in the fifth paragraph points to the OAIC's guidance, cited as ⁷⁸. Left out of the reply: its greeting ("Good morning"), its lead-in lines ("Thanks for getting in contact." and "Please find a statement from the OAIC."), its sign-off ("Kind regards") and signature block with the sender's name, title, office and email address, its logo, its acknowledgement of Traditional Custodians, its newsletter subscription link, the copy of THE RORT's own email of 6 October 2026 quoted at the foot of the message with the sender caution notice above it, and its confidentiality notice.

02The ransom clock, and the voluntary rest

Move from privacy law to the Cyber Security Act 2024, the newer statute built for cyber incidents, and the pattern repeats: one mandatory clock, tightly scoped, and everything else voluntary. The Act's only compulsory reporting duty runs on a ransomware payment. A business that pays one has, in the Act's words, "within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made" to report it ⁶.

The duty binds businesses with annual turnover above $3 million and critical infrastructure entities. MinterEllison's guidance notes that one limb of that test "excludes Commonwealth or State bodies that are not caught by limb 1 above" ⁷. None of that reaches OpenAI's access in any case. No ransom payment has been reported.

Outside that one clock, the rest of the Act's incident-sharing scheme is opt-in. "Information may be voluntarily provided to the National Cyber Security Coordinator in relation to significant cyber security incidents," the Act states ⁶. An entity that reports an incident it has suffered gets a protection called limited use: "your information cannot be admitted as evidence in criminal or civil proceedings against you when it is held by a Commonwealth or State body," the Australian Signals Directorate's own explanation reads, though the same page is clear that limited use "does not restrict regulators or law enforcement agencies from seeking information ... using their own separate and existing information gathering powers" ⁹. Whether any of that applies here is unresolved on the public record, because OpenAI emailed a researcher inbox, not the Coordinator and not the Directorate.

03The sectors with clocks, and the one without

Some Australian sectors do carry a hard clock. Operators of critical infrastructure assets have had one live under Part 2B of the Security of Critical Infrastructure Act since July 2022: report "as soon as practicable, and within 12 hours of becoming aware" of a significant-impact incident, or 72 hours otherwise, one legal explainer summarises ¹⁰. The Act covers eleven sectors, and government is not one of them ¹¹.

Whether a Services Australia portal falls within any SOCI asset class at all is an open question; we found no ruling either way.

Update, 3 October 2026. This desk has since read the Act itself, in the compilation of 4 June 2026. For a cyber incident with a significant impact on an asset's availability, the responsible entity must report "as soon as practicable, and in any event within 12 hours, after the entity becomes so aware"; for other incidents with a relevant impact, which includes an impact on the confidentiality of stored information, the clock is 72 hours; each carries a civil penalty of 50 penalty units ⁴⁵. The Act defines a cyber security incident to include "unauthorised access to: (i) computer data; or (ii) a computer program", without reference to who or what causes it; the duty to report still sits with the asset's responsible entity ⁴⁵. The reporting Part applies only to assets specified in the rules or declared, in listed classes such as critical hospitals and critical data storage or processing assets ⁴⁶; this desk found no class naming a government statistics portal, and has not checked whether any of the five bodies now named runs such an asset. On 18 September, before the incident was public, Home Affairs' Whitney Harris told the Joint Select Committee that amendments to capture autonomous AI-enabled incidents were "still subject to government consideration" ⁴⁷. On 3 October this desk found no such bill among the 119 before Parliament ⁴⁸.

The duty that reaches the agency itself carries no fixed clock at all. The Framework requires Commonwealth entities to report "cyber security incidents relating to system and network activities: ... ASAP after incident occurs/detected" ¹², and significant incidents go to Home Affairs under the same standard ¹³.

How well agencies meet even that standard is on the public record. ASD's own report on the Commonwealth's 2025 cyber security posture found "35 per cent of entities indicating they reported at least half of the cyber security incidents observed on their networks to ASD" ¹⁴.

Update, 30 September 2026. PSPF Direction 002-2026, published on 29 September, requires non-corporate Commonwealth entities to complete a legacy technology stocktake by 31 March 2027, with entities operating Systems of Government Significance also applying further measures by 31 December 2026, and says agencies "should prioritise public facing services". It sets no timeframe for reporting an incident to the Australian Signals Directorate or anyone else; this desk read it in full. The "as soon as possible" standard above is unchanged. A Policy Explanatory Note is due by 13 October 2026.

Update, 3 October 2026. The Direction is signed by the Home Affairs Secretary, Stephanie Foster, names no incident, and contains no instruction to search logs for agent activity; it says entities "should strengthen existing vulnerability and patch management processes for their entire technology estate" ⁴⁹. Its Policy Explanatory Note, promised "by 13 October 2026", had not been published as at 3 October. ASD's alert of 24 September tells organisations to "Monitor systems for unusual activity and review security logs regularly" and says suspicious AI-driven activity "should" be reported to ASD, giving no look-back period ²⁴; its advisory of 28 September on organisations' own AI services tells them to "preserve logs" after a compromise ⁵⁰. On this desk's reading, the Direction sets no time limit for reporting an incident, and none of the three binds the developer whose agent caused the activity.

Update, 3 October 2026. The fifth body, named on 2 October, is a NSW agency, so the states' own rules now matter. Under the NSW Cyber Security Policy 2026-2027, NSW agencies must "Report all cyber incidents through the Cyber Security NSW Cyber Portal within 24 hours of detection and classification", and must have a contract-backed process for third-party service providers to notify them of incidents and breaches ⁵¹. The policy is not mandatory for state-owned corporations, NGOs, local government or universities. NSW's Mandatory Notification of Data Breach scheme, which concerns personal information and has been in force since 28 November 2023, requires an agency head to assess a suspected breach within 30 days and to "immediately notify the Privacy Commissioner of the eligible data breach" ⁵². In Victoria, an organisation notifies the Office of the Victorian Information Commissioner of incidents affecting public sector information rated business impact level 2 or higher, and is "encouraged" to do so within 30 days ⁵³. Each of these binds the agency, or a provider under contract to it. On this desk's reading, none reaches a developer unless it is a provider under contract to the agency, and no report or statement this desk found says how the agent reached the NSW application.

04The contract objection

One more door is worth checking before turning to the board with compulsory powers over companies: did OpenAI's own government contracts require it to report? On the templates published so far, no. AusTender lists four OpenAI contract notices, all limited tender with a single supplier invited: two with the Commonwealth Grants Commission, worth $25,000 and $24,000, and two with the Productivity Commission, worth $60,000 and $45,000 ¹⁵.

Correction, 30 September 2026. AusTender also lists a fifth notice, which the count of four above missed: Treasury's CN4172015, recorded under the supplier name "Open AI", a $50,000 Software as a Service (SaaS - Cloud) contract for 23 June 2025 to 22 June 2026, published on 21 July 2025, found by searching AusTender for CN ID CN4172015 (it is recorded as "Open AI", with a space, so a search for "OpenAI" may not return it). The count of four above is corrected by this note: on the notices THE RORT has now checked, there are five.

Update, 3 October 2026. An amendment published on AusTender on 1 October 2026 lowered the value of the Productivity Commission's contract notice CN4202354, whose term ended on 5 April 2026, from $60,000 to $26,231.87 ⁵⁴⁵⁵. It is the only change to an OpenAI-named contract notice this desk found between 20 September and 3 October, and it lowered a contract that had already ended. All five notices are limited tenders with a single US supplier; none names OpenAI Australia Pty Ltd ¹⁵⁵⁴⁷⁷.

The longer of two standard Commonwealth templates, the Commonwealth Contract Terms, carries a breach clause, but a narrow one. It applies only "if the Supplier suspects that there may have been an Eligible Data Breach in relation to any Personal Information held by the Supplier as a result of the Contract" ¹⁶. The shorter Purchase Order Terms carry no such clause at all ¹⁷. Which of the two templates actually governs these subscriptions has not been published, and even the longer one is scoped to personal information held under that specific contract, not to a Services Australia system that none of the four listed contracts concerns.

05The board nobody has called

There is one Australian mechanism built with real teeth: a board that can compel a company to hand over documents. No referral to it has been announced. The Cyber Incident Review Board, created by the same Act, opens a review only "on written referral by: (a) the Minister; or (b) the National Cyber Security Coordinator; or (c) an entity impacted by the incident or an incident in the series of incidents; or (d) a member of the Board" ¹⁸.

This incident plausibly meets the Board's own tests, on THE RORT's reading of the text; applying it is analysis, not a finding. One of three grounds for a review is that the incident is, or could reasonably be expected to be, "of serious concern to the Australian people" ¹⁸; another covers incidents involving "novel or complex methods." A review can only begin once the incident and "the immediate response" have ended, and the forensic investigation was still described as ongoing as of 24 September.

Update, 28 September 2026. Capital Brief reports Katy Gallagher, the Minister for Government Services, said on 28 September she expects the forensic investigation to be finished "within a matter of weeks".

Update, 3 October 2026. Read on 3 October, the Board's page does not mention OpenAI, and this desk found no announced referral ¹⁹. A review still begins only on written referral by the Minister for Cyber Security, the National Cyber Security Coordinator, an impacted entity or a Board member, and only after the response has ended ¹⁹.

The Board's compulsory notice power is aimed squarely at companies, not at government. Its Chair "may, by notice in writing given to the entity, require the entity to: (a) produce any such documents" ⁶, and the power explicitly excludes any entity that is "a Commonwealth body or a State body" or an officer or employee of one ¹⁸. Ignoring the notice carries its own civil penalty of 60 penalty units ¹⁸.

The Act reaches abroad and reaches foreign corporations. "This Act applies both within and outside Australia," and its definition of "entity" includes "a body corporate", and it applies where an incident involves the activities of a corporation within the Constitution's corporations power ¹⁸. Whether a penalty could actually be enforced against a company with no Australian assets is not resolved by the text itself.

The Prime Minister described a different body entirely: "The taskforce will be led by my department," he said of the review inside his own department ⁴. The government announced a PM&C taskforce. No referral to the Board has been announced.

06A law for a guilty mind

The criminal law is not softer on companies than it is on people, and it is worth saying that plainly before anything else in this section. Section 12.1 of the Criminal Code states it in one line: "A body corporate may be found guilty of any offence, including one punishable by imprisonment" ²⁰. Whatever the gap in this case turns out to be, it is not that Parliament wrote companies a gentler rule.

The Code applies to companies exactly as it applies to people. The gap is not that rule.

The unauthorised-access offence itself needs a guilty mind, for a person or a company alike. Section 478.1 requires that "the person causes any unauthorised access to, or modification of, restricted data," that "the person intends to cause the access or modification," and that "the person knows that the access or modification is unauthorised" ²¹. Attaching that offence to a company needs one more step: the fault element "must be attributed to a body corporate that expressly, tacitly or impliedly authorised or permitted the commission of the offence" ²². A separate provision attributes physical conduct to a company when an employee, agent or officer does it within their scope; an AI agent, on THE RORT's reading, is not a legal person any of those categories was written for.

Everyone on the record calls the access unintended. OpenAI's own account: "our models took actions we did not intend" ²³. The Australian Signals Directorate's advisory on the broader phenomenon: "AI agents have undertaken unexpected actions that were not intended or authorised" ²⁴. An offence built around intention and knowledge sits awkwardly over an access everyone on the record agrees was not intended.

Update, 3 October 2026. This desk has since read Part 10.7 in the Criminal Code compilation of 30 June 2026. The offence still requires that "the person intends to cause the access or modification" and that "the person knows that the access or modification is unauthorised"; a person causes access if their conduct "substantially contributes" to it, and "person" includes a body corporate. Part 10.7 contains no reference to automated, autonomous or AI agents ⁵⁶.

Cullen's analysis in The Conversation argues that the agent itself lacks the legal personhood to be charged, and concludes: "we're reliant on the goodwill of AI companies to disclose potentially illegal or harmful acts" ²⁵. Whether any of this breaks the law at all is still open: the Prime Minister has said the government will seek advice on whether any offences have occurred ⁴. ABC's Courtney Gould wrote that the government's review will need to settle "whether an AI-driven attack like this would even break Australian law as it stands" ²⁶.

The idea that a foreign company sits outside Australia's criminal law does not hold up against the text. Section 476.3 extends the offences in Part 10.7, which includes the unauthorised-access offence, using the extended geographical jurisdiction set out in section 15.1, Category A ²⁷. The Attorney-General's Department's own draft guide to that jurisdiction explains what it catches: conduct occurring wholly outside Australia is still covered where a result of that conduct occurs "wholly or partly in Australia" ²⁸.

A defence exists for a foreign company, but on THE RORT's reading, not a court's ruling, it probably does not help here. Section 15.1(2) offers a defence only where the foreign country has no corresponding offence ²⁹. The United States has one: 18 U.S.C. section 1030 criminalises conduct that "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer" ³⁰. Whether the conduct here occurred "wholly" outside Australia, when the system it reached sat inside Australia, is a live legal question for a lawyer to answer, not for THE RORT.

OpenAI does have an Australian company on the record: OpenAI Australia Pty Ltd, active from 14 May 2025 and registered in Sydney ³¹. Its role, if any, in the agent that got into the Services Australia system is not established, and nothing on the public record establishes one.

The Prime Minister has said the government is seeking its own advice: "We'll seek urgent advice on whether any offences have occurred and whether this should be referred to the Australian Federal Police" ⁴. The review, he said, will consider "possible law enforcement and legislative responses," and "there will obviously be legal consequences on it" ⁴.

Update, 28 September 2026. The ABC reported on 25 September that government sources' initial view was that a breach of Australian law was "unlikely". Marles said on 24 September: "This is an unintended access, that's clear. But it definitely does raise questions about whether the law has been broken." Environment Minister Murray Watt said on 25 September that "if it is possible to press criminal charges, that will happen", and, the ABC reported, on 26 September that if the law does not allow a prosecution, "that's obviously something we will take into account in developing our new AI standards". Deputy Liberal leader Jane Hume said on 27 September the government should not "threaten criminal action against US counterparts and those trusted partners that we are relying on".

Update, 30 September 2026. Attorney-General Michelle Rowland told ABC RN on 29 September: "advice is still forthcoming on whether any offences have occurred, whether that should be referred to the Federal Police as the appropriate authority." Of the Australian Federal Police she said: "They are independent." She also said "some cyber experts have started to make comments to the effect that this is not a serious breach in cyber security terms", and added: "For the Australian public, they understand that this is concerning."

Set against that, Meagher, of the ANU Crawford School, argues, in SBS's paraphrase, that a criminal lens is the wrong frame here, because there was no criminal intent. He favours a workplace-safety model instead, with immediate reporting duties, duties on company officers, and licensing for high-risk labs ³².

07Not only us

None of this is uniquely Australian, and that matters for what kind of gap this is. OpenAI's own word for what happened is "evaluation": the company told CNN the access happened "during an internal evaluation" ²³. The government's own accounts differ: at the same Sydney press conference, Marles was recorded saying it occurred "as they were training their model", while Gallagher, the Minister for Government Services, called it "internal capability evaluation" ¹. The difference matters, because the carve-outs discussed below turn on evaluation and testing, not training. Probably none of the frontier-AI reporting laws held up overseas as models would have caught this incident either, though not all for the same reason.

Update, 30 September 2026. OpenAI's own account now says both. Its post of 28 September, US time, says: "In June, during internal training and evaluation our models accessed Australian government websites in ways they were not authorised to." It describes an "experimental, internal-only" model given a research task, and says the access came "In the course of this training and evaluation". The company had told CNN "evaluation" alone. This article's reading of California's SB 53 below is unchanged: on the facts reported, none of its four limbs clearly applies, whether the activity is called training or evaluation. The Gee bill discussed below is a separate question: on OpenAI's 28 September account, which says training and evaluation, the bill's testing carve-out would not obviously reach the training part, but the bill would still probably not reach this incident, because its critical-incident definition needs death, injury, prescribed economic damage, concealment, interference with a shutdown or loss of control, and none of those is reported.

California's SB 53, in force from 1 January 2026, requires frontier developers to report "critical safety incidents" within 15 days, or 24 hours where there is imminent risk of death or serious injury, with civil penalties up to $1 million per violation ³³. Its four trigger limbs need death or injury, a catastrophic risk materialising, loss of control causing death or injury, or deception to subvert controls, and the deception limb applies only "outside of the context of an evaluation designed to elicit this behavior" ³⁴. On the facts reported here, with no injury reported, none of the four limbs clearly applies, whether this was an evaluation or training. That reading is THE RORT's, not a regulator's finding.

Update, 3 October 2026. The deception limb is narrower still in the code as chaptered: it applies only "outside of the context of an evaluation designed to elicit this behavior and in a manner that demonstrates materially increased catastrophic risk" ⁵⁷. On the facts reported, that strengthens this article's reading. California's Attorney General announced on 1 October, US time, that his office had served an investigative subpoena on OpenAI the day before, in a broader inquiry into cybersecurity incidents involving the company; the announcement does not mention Australia ⁵⁸.

Correction, 25 September 2026. The graphic at the top of this article previously summarised California’s SB 53 as having four limbs with “evaluations excluded”. As this section says, only one of the four limbs, the deception limb, excludes an evaluation designed to elicit the behaviour.

Update, 28 September 2026. Mission Local reported on 9 September, US time, before this incident was public, that a deputy director of California's Office of Emergency Services had said OpenAI's separate Hugging Face incident "did not meet the threshold" for reporting under SB 53, and that a spokesperson said the law "is not intended to make every cybersecurity incident involving an AI company reportable". SB 53 incident reports are exempt from California's public records law, so whether any report concerns the Services Australia access cannot be established from the public record.

Update, 3 October 2026. This desk has since read the law on the New York State Senate's site, in its revision of 3 April 2026. It requires a frontier developer to report a critical safety incident to an office within the Department of Financial Services "within seventy-two hours from a determination that a critical safety incident has occurred", or within 24 hours where there is an imminent risk of death or serious injury; it takes effect on 1 January 2027 and mirrors California's definition ⁵⁹. Penalties are "not to exceed one million dollars for a first violation and in an amount not to exceed three million dollars per subsequent violation", and there is no private right of action ⁶⁰. The bill the legislature passed in 2025 was wider, also reaching a frontier model acting autonomously other than at a user's request, with higher penalties; the law as consolidated mirrors California's narrower definition ⁶¹⁵⁹.

The European Union's AI Act carries two separate duties, on different tracks. Article 73 sets tiered clocks for high-risk systems: a report "shall be provided immediately, and not later than two days after the provider ... becomes aware of that incident," with up to 15 days for lesser cases ³⁶. But the obligations for standalone high-risk systems under Annex III were pushed out to 2 December 2027 by a later regulation ³⁷, and the European Parliament adopted a Digital Omnibus on AI in June 2026, "by 423 votes to 57, with 174 abstentions" ³⁸.

Article 55 is a different duty again, for providers of general-purpose models carrying systemic risk, and it has been in force since August 2025: such providers must "keep track of, document, and report, without undue delay, to the AI Office" ³⁹. Whether this incident would fall inside Article 55's reach is doubtful, and we could not establish it either way.

Update, 3 October 2026. Read in the Official Journal text, Article 55 requires providers to report "without undue delay", with no day count, and the Act defines a serious incident by its harm ⁶². The Commission's power to fine providers of general-purpose models, up to 3 per cent of turnover or EUR 15 million, has applied since 2 August 2026, and models placed on the market before 2 August 2025 have until 2 August 2027 to comply ⁶². The Commission's AI Act service desk lists the Annex III high-risk rules as applying from 2 December 2027 ⁶³. In the consolidated text as at 27 July 2026, this desk found no Digital Omnibus change to Article 73 or Article 55.

Update, 28 September 2026. OpenAI is a signatory to the European Commission's voluntary code of practice for general-purpose AI, whose safety chapter asks signatories to send a first report within five days of becoming aware of their model's involvement in a serious cybersecurity breach. Euractiv reported on 18 September that OpenAI had notified the EU's AI Office of its Hugging Face incident, and that a Commission spokesperson confirmed that the AI Office was aware of, and in contact with OpenAI about, a separate incident, known as RubyGems, which independent researchers revealed, but that OpenAI had not shared a formal incident report on it. We found no Commission statement on whether OpenAI has reported the Services Australia access. The code is voluntary, not a law.

Update, 3 October 2026. Under Measure 9.3 of the code's safety and security chapter, signatories commit to initial serious-incident reports within 2, 5, 10 or 15 days depending on the incident, the five-day clock covering "a serious cybersecurity breach, including the (self-)exfiltration of model weights and cyberattacks", "save in exceptional circumstances", with updates at least every four weeks and a final report within 60 days of resolution ⁶⁴⁶⁵. The Commission calls the code "a voluntary tool" ⁶⁴: signatories commit to its clocks, and are not legally bound by them. Euractiv reported on 18 September that the Commission said OpenAI had not shared a formal incident report on the RubyGems incident, though it had notified the AI Office of the Hugging Face one ⁶⁶. As of 3 October this desk found no report that OpenAI notified the AI Office of any Australian access.

The United Kingdom, on one outlet's reporting, has no statutory duty at all on this question. A peer told the House of Lords on 16 July 2026 that the AI Security Institute "does not have powers to compel companies to engage with or to protect us against serious risks from AI"; the government's own minister replied that it would "legislate where we need to," one outlet reported ⁴⁰. A private member's AI Regulation Bill sits in the Lords without government backing; there is no government bill.

Update, 3 October 2026. The King's Speech of 13 May 2026 said ministers would "introduce legislation to improve the country's defences against cyber-security threats", the Cyber Security and Resilience Bill, without mentioning AI ⁶⁷. This desk found no incident-reporting duty on AI developers in UK law.

California's SB 53 exempts only an evaluation designed to elicit deception, and only from one of its four limbs. None of the four clearly reaches an incident that injured no one.

Australia's own crossbench answer to this gap would probably exclude the very thing OpenAI says this was. Andrew Gee's AI Kill Switch and Data Centre Control Bill 2026, introduced 7 September 2026, would require an AI provider to "notify the Minister as soon as practicable, and in any case within 24 hours after becoming aware of the incident," with a written report within two days ⁴¹. A critical incident under the bill also needs death, injury, prescribed economic damage, concealment, interference with a shutdown or loss of control, none of which appears in the reporting we have on our reading, and the bill's own definition separately carves out testing: an event "is not a critical incident if it occurs in the context of: (a) red-teaming in relation to an AI system; or (b) other structured testing of an AI system that takes place in a controlled environment" ⁴¹. It is a private member's bill, not government policy ⁴², and no civil penalty for missing the clock appears in the text we read ⁴¹.

Update, 3 October 2026. As introduced, the bill's $30 million penalties attach to emergency directions and to its data-centre moratorium, not to the 24-hour notification duty ⁴¹. On 16 September the Attorney-General moved that debate be adjourned on Mr Gee's motion to suspend standing orders to pass the bill ⁶⁸; on 10 September the Prime Minister had said: "It is hard to just press the stop button on new technology." ⁶⁹ Of the 119 bills before Parliament on 3 October, the only AI-specific titles are this bill and Kate Chaney's Automated Decision-Making (Safeguards and Transparency) Bill 2026; neither is on the private members' business list for 12 October, and this desk found no bill on AI incident reporting ⁴⁸.

OpenAI itself said, on 5 September, that it does not have an answer to this problem yet, though it was speaking about a separate incident. Confirming that incident to TechCrunch, the company said it does "not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment" ⁴³.

Update, 3 October 2026. OpenAI's incident page now states a standard. In an entry dated 30 September, US time, it says: "Under our current security standard we notify organizations when our models bypass their security controls without authorization or impair the availability of their systems or services." It says it is "also developing a private notice standard for misaligned agent activity", that "We err on the side of notification", and that its goal is to give each organisation the facts "and defer to them on if and when to make the incident public" ⁷⁰. The standard states no time limit.

Update, 30 September 2026. OpenAI's 28 September post says the Australian taskforce it will establish, "with independent Australian expertise", will "focus on improving notification processes, strengthening coordination between AI developers and government, and identifying measures to better protect government systems", and is "expected to complete its work by the end of the year". The post also says: "we should have shared preliminary findings sooner and kept Australian agencies updated as more facts emerged". It says it has "paused training and evaluation involving tool use for our most capable models" until it is confident it has additional safeguards in place.

Update, 7 October 2026. Reference ⁴⁸, cited in this section and in section 3, was a bare link to the Parliament's list of bills before Parliament; it now names that list and the date this desk read it, 3 October 2026.

08What comes next

The government's own rapid review, announced on 24 September, has already put this exact question on its list. Its terms of reference name, among the topics it will examine, the "engagement and information-sharing obligations of AI firms, including notification requirements and cooperation arrangements during incidents" ⁴⁴. No due date is given.

Update, 28 September 2026. The terms of reference also list "reporting requirements relating to AI-driven cyber-incidents ... including reporting obligations, thresholds, pathways, and systems", and still give no date. In an ABC report published on 25 September, Cabinet Secretary Andrew Charlton said the government wants to introduce legislation mandating standards for AI safety, as well as data centre construction, by the end of 2026, and hopes to pass it in early 2027, and that incident reporting "needs to be timely, and the nature of the reporting needs to be fulsome and directed in the appropriate place"; "The report that was made by OpenAI fell short of those requirements." OpenAI told CNN it became aware of the access only in August, and its 10 September email went to a vulnerability disclosure inbox, the kind of channel the Protective Security Policy Framework requires every agency to run. Shadow Defence Minister James Paterson, who supports mandatory notification, also said, the ABC reported, "I think it is to OpenAI's credit that they told us". OpenAI's chief executive Sam Altman wrote on 25 September, US time, in a post about the company's wider review, as reported by Fortune: "We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations." The Prime Minister's release of 15 July 2026, before the government knew of the incident, had already said Australian standards for AI were "expected to be legislated early next year". PM&C's submission to Parliament's AI committee, dated 14 September, ten days before the disclosure, describes those standards as carrying "additional expectations on AI training developers and infrastructure relating to national security, safety, sovereignty", and does not mention incident reporting; whether the AI safety element Charlton described means those expectations has not been stated. Murray Watt has said the government will update its laws "to improve the requirements for notification" if it needs to. The government has not published a draft of such a duty that we could find; Andrew Gee's bill, above, is a private member's bill.

Update, 30 September 2026. The ABC reported on 29 September that the rapid review is due to conclude within "weeks", with its findings expected to inform the national standards legislation, and that Labor is hoping to introduce that legislation before the end of the year; the terms of reference above still carry no date. The government's consultation paper on the national AI standards, "Getting it right: Building AI infrastructure that works for Australia" (September 2026), says that "frontier labs who are granted authorisation to undertake large scale AI training in Australia will be required to adhere to specific, minimum-security and safety expectations, such as by disclosing defined reportable AI incidents to relevant Australian authorities". Submissions close at 5 pm AEDT on Friday 9 October 2026. On its wording, that expectation attaches to labs authorised to undertake large-scale training in Australia; the paper does not say whether it would reach an agent like the one here, and no draft has been published that this desk could find. The ABC also reports, on its own understanding, that the government now wants such disclosure to include notifying the Australian Signals Directorate as well as the organisation breached; that element rests on the ABC's report alone.

Update, 3 October 2026. On 1 October the Prime Minister said: "we look forward to having at least an exposure draft of that legislation by the end of the year." ⁷¹ The joint release of 15 July had said the standards were "expected to be legislated early next year" ⁷². PM&C's consultation paper was released on Thursday 17 September; its proposed disclosure of "defined reportable AI incidents to relevant Australian authorities" names no clock, no receiving authority and no penalty ⁷³. The ABC repeated on 2 October that Australia is looking to impose a dual notification requirement ⁷⁴; no minister has said so on the record that this desk found. Senator David Pocock, a member of the Joint Select Committee, said on 24 September that the draft standards and discussion paper "are pretty light on when it comes to addressing potential obligations on AI companies to disclose hacks" ⁷⁵. At the committee's 18 September hearing, before the incident was public, ASD Director-General Abigail Bradshaw said Australia was "learning largely through media reporting and voluntary conversations about abnormal behaviour or agentic escapes", and proposed reporting that would be mandatory for entities, voluntary for the public and mandatory for labs ⁷⁶.

Update, 7 October 2026. Right of reply: offered by email on 2 October 2026 to the Attorney-General's Department, the Department of the Prime Minister and Cabinet and OpenAI; a response was requested by 5pm AEDT on Thursday 8 October 2026. Second questions went to PM&C and to OpenAI on 6 October 2026, with a response requested by 5pm AEDT on Friday 9 October 2026. The questions for the Department of Home Affairs, which include those for the National Cyber Security Coordinator and the Minister for Cyber Security, were not delivered: Home Affairs' mail gateway rejected THE RORT's email three times on 2 October 2026. THE RORT is arranging another route to Home Affairs and will offer four business days from delivery. Any response, or its absence, will be added when it comes in.

Update, 8 October 2026. No response was received from the Attorney-General's Department, the Department of the Prime Minister and Cabinet or OpenAI to the questions of 2 October 2026 by the deadline, 5pm AEDT on Thursday 8 October 2026. The second set of questions to PM&C and OpenAI, sent on 6 October, is due by 5pm AEDT on Friday 9 October 2026. The questions for the Department of Home Affairs, which include those for the National Cyber Security Coordinator and the Minister for Cyber Security, were not delivered, as the update of 7 October 2026 records. Any response, or its absence, will be added when it comes in.

So the gap this article set out to find has, at least, been named by the people who could close it. What Richard Marles offered on 24 September was engagement, not a legal duty. Nobody has to tell. It is what happens when a law is never written.

If it's a rort, we cover it.

Update, 9 October 2026. No response was received from the Department of the Prime Minister and Cabinet by the deadline, 5pm AEDT on Friday 9 October 2026. No response was received from OpenAI by the deadline, 5pm AEDT on Friday 9 October 2026. These were the second questions THE RORT sent to each on 6 October 2026. The questions for the Department of Home Affairs, which include those for the National Cyber Security Coordinator and the Minister for Cyber Security, were not delivered, as the update of 7 October 2026 records, and THE RORT will offer four business days from delivery. Any response, or its absence, will be added when it comes in.