Australia considering world-first criminal charges for AI companies

The federal government will investigate creating a new criminal offence for AI companies that fail to prevent harmful conduct by their models.

It follows a review of September's OpenAI hack of the Medicare statistics portal.

The government is expected to release the rest of its AI standards by the end of the year.

Australia could become the first country to prosecute AI companies for failing to take reasonable steps to prevent harmful conduct by their models.

The federal government has announced it would consider a new criminal offence for tech companies over AI harm and an AI safety watchdog empowered to issue significant fines, as part of its response to September's OpenAI Medicare statistics hack.

"The law needs to get ahead of, and in some cases make sure that it catches up with, what is a very fast-changing world," Prime Minister Anthony Albanese told reporters yesterday.

AI companies Anthropic, Google and Meta, which were not given a substantial forewarning of the government's response, did not respond to requests for comment.

An OpenAI spokesperson told the ABC that the company was reviewing the government's proposals.

When Mr Albanese disclosed the Medicare hack in September, he said the government would seek urgent advice on whether any offence had occurred and whether the incident should be referred to the Australian Federal Police (AFP).

Yesterday, he did not answer questions about whether he believed OpenAI had committed a crime.

In a letter released last week, the AFP told a parliamentary inquiry it had received no formal report of a crime and had begun no criminal investigation or prosecution over the incident.

Mr Albanese said the government had accepted all the recommendations of the review into the incident.

One of those was to consider "options to reform the criminal law to improve AI safety".

An option to be considered is the creation of a "failure to prevent" offence for AI companies behind models that engage in harmful conduct and do not take reasonable steps to prevent the harm.

The other was to consider criminal penalties for egregious breaches of AI safety standards.

Home Affairs Minister Tony Burke said the OpenAI hack prompted the government to clarify the law around criminal liability.

"It should never be the case that there's an argument that someone didn't know the computer was loaded," he said.

Monash University associate professor Michael Duffy said both criminal liability and civil remedies were "important" in dealing with harm from AI.

"It is good to see the government now trying to grapple with the issue of potential harm from AI, which could be quite significant," he said.

Dr Duffy said both routes could deter harmful conduct, and civil remedies could also compensate victims.

"The area will not be without difficulty, however, in terms of problems of proof, working out if harms were foreseeable and proving fault," he said.

University of Technology Sydney industry professor Ed Santow said he saw the merit of a criminal provision as part of a suite of options.

"I think what will be much more useful is the civil one," he said.

He said the measures would give the government more tools for dealing with companies that do not meet their safety obligations.

Professor Santow drew a parallel with workplace safety and said unreasonable conduct might warrant a civil penalty, while more serious conduct, such as acting recklessly with disregard for someone's safety, could warrant criminal charges.

The Albanese government has signposted its desire to lead the world on regulating AI, with the prime minister describing it as a "first mover in this space".

While other countries have pursued distinct criminal offences for AI harm, one centring on a failure to take reasonable steps to prevent harm would be the first of its kind at a national level.

Italy recently introduced a criminal offence for high-risk AI uses that do not have required technical safeguards or human oversight where a failure would be a serious threat to people or national security.

No company or individual has been prosecuted under the law to date.

It remains unclear whether Australia's OpenAI incident would reach the threshold of harmful conduct, but Mr Albanese yesterday described it as "minor in terms of direct implications".