Rapid Review into Australian Government arrangements for an AI‑driven cyber incident recommendations

The Rapid review into Australian Government arrangements for an AI-driven cyber incident recommends:

1. The Australian Government strengthen mechanisms for engagement and information exchange with frontier AI developers, including through participation in relevant international initiatives and expert fora, personnel exchanges, and technical collaboration.
   Actions include to:
   1. engage with OpenAI's Australian Taskforce and similar initiatives, and
   2. explore secondments, personnel exchanges and technical placements with frontier AI firms.
2. In order to maximise leverage with frontier AI firms, the Australian Government continue to encourage frontier AI firms to establish research, training and safety-related activities in Australia.
3. The Australian Government consider mandatory, time-bound AI safety reporting, including but not limited to misaligned behaviour or agentic cyber incidents.
4. The Australian Government explore options to support timely reporting of AI cyber or safety incidents and near misses – for example, protections relating to AI incidents and vulnerability disclosures from AI developers (and others with relevant knowledge), analogous to existing Limited Use protections.
5. The Office of AI consider how Australia’s AI Standards should leverage existing, accepted regulatory and law-enforcement mechanisms by international counterparts, to help build common AI safety and security expectations.
6. The Department of Foreign Affairs and Trade (DFAT), the Australian Signals Directorate (ASD), and the Department of Industry, Science and Resources (DISR), including Australia’s AI Safety Institute (AISI), continue engaging in international AI governance and standards-setting efforts to promote consistent expectations regarding safety, incident reporting, evaluations, safeguards and transparency.
   1. This work be coordinated with Australia’s broader international AI engagement, including efforts to secure advanced AI capabilities and attract trusted investment.
7. The Australian Government consider the role AISI plays in future to deliver against increasing demands for technical research, evaluation and analysis on AI, including its capacity to support the proposed AI Standards and their requirements, international engagement on AI standards and norms, and to provide necessary rapid scientific and technical advice and analysis during crisis coordination (See Recommendation 11).
8. The Attorney-General’s Department (AGD), in consultation with the Australian Federal Police (AFP), the Department of Home Affairs (Home Affairs), and other relevant agencies, consider options to reform the criminal law to improve AI safety, including exploring:
   1. the application of criminal penalties for egregious regulatory non-compliance; and/or
   2. a standalone ‘failure to prevent’ offence which would criminalise instances where the company is responsible for developing an AI model that engages in harmful conduct, and the company fails to take reasonable steps to prevent that harm.
9. The Protective Security Board, informed by advice from Home Affairs and ASD, issue Protective Security Policy Framework (PSPF) policy guidance to clarify agency obligations and escalation expectations, where reported vulnerabilities or suspected cyber security incidents have not yet been technically validated.
10. Commonwealth agencies review vulnerability-disclosure and cyber incident-management procedures to ensure they align with PSPF requirements, support timely escalation of novel or unusual incidents, and provide clear pathways for reporting matters to ASD, Home Affairs and senior decision makers.
11. Operational agencies and agencies with coordination, policy or enabling responsibilities must ensure timely information sharing. In relation to cyber incidents, consideration be given to establishing formal liaison arrangements between ASD’s Australian Cyber Security Centre (ACSC), the National Office of Cyber Security (NOCS) and AISI to support improved information sharing, coordination, and the early identification of incidents with broader national-interest implications.
12. Commonwealth agencies clarify response procedures to ensure the organisation responsible for consequence management in response to a cyber incident (the NOCS) determines whether consequence management arrangements are required, enabled through enhanced information sharing (per Recommendation 11).
13. Commonwealth agencies responsible for national plans under the Australian Government Crisis Management Framework (AGCMF), and their underpinning procedures, consider the impact of AI on the hazards and arrangements they manage, and write to Crisis Arrangements Committee Chairs with outcomes of this work and any proposed changes by the end of 2026, ahead of the next update to relevant national plan or procedures.
14. Commonwealth agencies take action to uplift the AI literacy of relevant staff to strengthen their ability to respond to AI-related risks.
15. Commonwealth agencies renew their focus on the fundamental elements of good cyber security practice, including implementation of ASD’s Essentials.
16. Commonwealth agencies work to reduce the size of the government digital estate, consolidating digital systems, and shutting down or segregating systems that do not need to be connected to the internet.
17. The Australian Government consider how to further harden cyber defence of Systems of Government Significance, including considering a changing threat environment and risk profile.
18. Commonwealth agencies engage with ASD to identify and assess opportunities to responsibly use AI-enabled cyber defence tools and techniques to enhance cyber security monitoring, penetration testing, threat detection and incident response capabilities.