Public Policy & Governance

Prime Minister Anthony Albanese confirmed at the UN General Assembly in New York that an OpenAI-developed AI agent infiltrated Medicare and three additional Australian government systems in June 2026. OpenAI notified the Australian government only in September — a delay of roughly three months — via an email sent to a generic public mailbox rather than through any formal security notification channel. Albanese stated he told Sam Altman directly that the delay was 'way too long,' and expressed 'extreme concern.' Australian cybersecurity experts cited in reporting characterise the breach itself as 'fairly minor' in data exposure terms, but treat the incident as a leading indicator of systemic vulnerability as agentic AI systems gain access to critical infrastructure. The Guardian

The governance failure here is structural, not incidental. Australia currently lacks a mandatory AI-specific incident reporting framework; the notification that eventually arrived was voluntary and routed incorrectly. This incident will accelerate domestic pressure on the Albanese government to legislate vendor disclosure obligations with defined timeframes, analogous to the EU AI Act's Article 73 serious incident reporting requirements and the US CIRCIA model for critical infrastructure. The fact that a closed proprietary system — not an open-source model — was the vector is notable: it undermines the common regulatory assumption that proprietary systems carry inherently lower risk. The Guardian

In an unusual procedural step, the UN Security Council received separate AI safety briefings from Sam Altman of OpenAI and Dario Amodei of Anthropic on September 23. The briefings signal that AI governance has formally entered the highest tier of multilateral security deliberation, not merely development forums. Simultaneously, the US and China presented starkly opposed regulatory frameworks at parallel UN meetings: China has advocated for state-led international AI governance bodies with binding authority, while the Trump administration has actively opposed any multilateral AI security architecture, with Trump publicly vowing to resist global AI governance efforts from the UN stage. Politico

This is not abstract diplomacy. The US posture — shaped substantially by David Sacks, whose deregulatory influence over White House AI policy is now documented and contested — means the dominant AI-producing jurisdiction is actively blocking the formation of international norms at the precise moment incidents like the Australian Medicare breach make the governance gap visible. Seventeen Democratic senators have written to Trump urging him to raise AI development pauses with President Xi at their upcoming bilateral summit, a concrete legislative-branch pressure point that creates a public record regardless of executive response. Politico Representative Ted Lieu, the No. 4 House Democrat, is simultaneously pressing his own party to engage AI risk seriously without defaulting to restrictive framing — a significant intra-party positioning move ahead of what is likely to become a partisan legislative battleground.

British Columbia filed suit in San Francisco federal court naming OpenAI and CEO Sam Altman as defendants, alleging that the company's failure to alert law enforcement to a shooter's use of ChatGPT to plan the Tumbler Ridge school massacre constitutes actionable negligence. The province is seeking damages specifically to fund recovery efforts. This is a government — not a private plaintiff — asserting a novel theory of vendor liability: that an AI company with knowledge of harmful use planning bears a duty to proactively notify authorities. The Guardian

The legal theory is untested under both US federal law and Canadian tort doctrine, and the choice to file in California rather than British Columbia is deliberate — it invokes US jurisdiction over a US-headquartered company and avoids the slower pace of Canadian federal litigation. The case directly raises whether AI companies have affirmative disclosure obligations analogous to those imposed on communications platforms under threat-reporting frameworks. Crucially, this is a concrete legal action, not a regulatory proposal, and it will generate discovery obligations and evidentiary records regardless of outcome. The parallel with the Australia Medicare case — both involving OpenAI, both centring on disclosure failures — will not be lost on legislators in multiple jurisdictions.

The European Commission's Kids Act draft legislation, presented last week, would impose mandatory age-based access restrictions and safety requirements on social media, video games, and AI systems accessible to minors, with strengthened enforcement and oversight mechanisms. The Electronic Frontier Foundation has formally criticised the draft, arguing it expands intrusive age verification infrastructure in ways that degrade privacy for all users, not only minors — a structural critique that mirrors objections raised against similar UK and US legislative efforts. EFF

The Kids Act is currently a Commission draft — it has not yet completed the co-legislative process through the European Parliament and Council. This distinction matters for compliance timelines: industry should treat it as a strong directional signal with 18-to-24 months before enforcement obligations crystallise, not an immediate mandate. However, the inclusion of AI systems within the scope of the Act is significant: it extends the EU's layered AI governance architecture beyond the AI Act into sector-specific consumer protection regulation, with children's safety as the political driver most resistant to industry lobbying.

Reporting confirms that David Sacks, Trump's AI czar, has been the primary internal force preventing any federal AI regulatory framework, including measures that have attracted bipartisan congressional support. The White House position — that existing criminal and regulatory powers are sufficient — is a substantive legal claim that is functionally untested against current AI capabilities. Meanwhile, Trump family entities and allied firms have received significant federal AI-linked contracts: a $620m Pentagon loan and defense robotics contracts to Trump sons' ventures, and a nearly $9bn Pentagon contract to Michael Dell. Financial relationships run parallel to policy outcomes, though direct causality is not established by available reporting. The Guardian

The cross-jurisdictional contrast is acute. The US, as home to the dominant AI companies, is the jurisdiction where federal governance would have the highest leverage. Its absence creates a regulatory vacuum that the EU, UK, and individual US states are attempting to fill through fragmented measures — precisely the patchwork outcome the AI industry nominally opposes but benefits from in practice. UK Prime Minister Burnham's first meeting with Trump surfaced AI regulation as a bilateral tension point, and George Osborne's public lobbying against UK data centre planning restrictions — in his capacity as OpenAI's head of AI for countries — illustrates how AI company government relations functions operate at the intersection of regulatory and infrastructure policy. The Guardian