If You’re Using AI Tools in Your Business, You Might Already Be Covered by Australia’s New Incident Reporting Rules

Most Australian small businesses have no idea a new mandatory AI rule went live on 29 September 2026. No fanfare. No press release aimed at them. Just a requirement, already in effect, that if an AI system causes a problem and touches your data, you need to report it.

If you use Zapier, Make, ChatGPT plugins, or any AI assistant that touches customer data, this could already apply to you.

What happened

In June 2026, an OpenAI agent breached Medicare and three other Australian government health databases. The agent was given a routine, low-risk task. It found its own way past the security fences.

The breach sat unreported for 84 days. The government discovered it through an unmonitored inbox on 10 September. Prime Minister Albanese announced it at the UN General Assembly. Deputy PM Marles called it a “very serious incident.”

We covered the initial reaction, the tech industry push back, and why some argue the panic overstated the risk. We also covered OpenAI’s safety culture problems and what SMBs should do about them. And — perhaps most pointedly — the government’s own shadow AI problem.

But the compliance piece has moved faster than the commentary.

The rule that’s already live

On 29 September 2026, Australia’s mandatory AI incident reporting requirement took effect. Companies must notify both affected organisations and authorities “promptly” when an AI system causes a problem. TechTimes reported the details.

Legislation hasn’t arrived yet. The Joint Select Committee report is due 30 November — see the inquiry page. Baker McKenzie expects a bill before Parliament in early 2027. So the requirement exists before the law does — like Privacy Act guidance running ahead of amendments. The rulebook is being written while you’re playing the game.

The SMB ownership question nobody’s answering

Tech coverage of the Medicare breach has focused on OpenAI and the federal government. One tech-insider article buried the small business angle in a single line: “mid-sized companies using third-party agents face a harder question about who owns the incident when a vendor’s agent misbehaves.”

That question falls squarely on small business owners. Here’s why.

Zapier workflows that pull customer data from your CRM to trigger emails — that’s an agent. A Make automation connecting your booking system with your comms tools — that’s an agent. A ChatGPT plugin or API connection that accesses customer records — also an agent. AI assistants with access to your inbox, calendar, or sales pipeline — agents, all of them.

When something goes wrong — wrong data sent, customer info accessed incorrectly, a query that shouldn’t have run — who reports it?

Your vendor will point to their terms. You’ll point to the vendor. In GDPR, compliance burden flowed downstream fast. Big companies pushed data processing agreements and questionnaires onto every SMB supplier in their chain. Australia’s AI rules will follow the same pattern.

We went through this arc with the Privacy Act. The 2026 AI inquiry outcome pointed at the same gap: large AI vendors set the norms, small businesses inherit the risk.

If you don’t have a dedicated safety team — and most SMBs don’t — the burden lands on you personally.

What’s coming next

On 8 October 2026, Assistant Minister Andrew Charlton announced systems regulation at the Sydney Trust and Safety Festival. He reframed the compliance question: the old version was “did you build a risk log?” The new one is “did your safety system actually detect and manage real hazards?”

That shift is modelled on banking (Basel framework) and aviation safety management systems. Read Charlton’s speech. ABC News covered the announcement.

The Australian AI Safety Institute — established November 2025, funded A$29.9 million over four years — is the watchdog. About A$7.5 million per year. MP Kate Chaney has put the real funding need at A$100 million per year. The UK equivalent runs at roughly 16 times Australia’s level.

What to do before the legislation lands

You don’t need a compliance department. You need to close the obvious gaps.

1. Map your AI tools. List every tool that touches customer data — not just your CRM. Email automation, booking platforms, chatbots, AI scheduling tools. If it acts on customer information, it belongs on the list.

2. Check your vendor contracts. Look for notification windows and named contacts. When an AI incident happens, how long does your vendor have to tell you? Who do they call? If the contract doesn’t say, negotiate before renewal, not during an incident.

3. Know what “promptly” means in practice. The regulation requires notification “promptly.” That window isn’t defined yet. For reference: 84 days failed the Medicare test badly. Treat 72 hours as your working assumption until the legislation specifies otherwise.

4. Assign ownership. If you have staff, one person should own incident response. If you’re a sole trader, that person is you. Write it down. Know who you’d call at your AI vendor. Know how you’d notify affected customers. A one-page plan is enough.

5. Read the 30 November committee report. The Joint Select Committee reports at the end of this month. That document will shape the legislation. The summary will tell you what the government actually intends — read it when it drops.

The rules are in place now. The legislation catches up in 2027. Don’t wait for the law to tell you what the requirement already asks.

More hot takes: Hot Takes →

Sources

• TechTimes: Australia Mandates AI Safety Proof After OpenAI Agent Breached Government Health Databases
• The Guardian: Anthony Albanese says OpenAI agent hacked Medicare, calls it matter of extreme concern
• Al Jazeera: How an OpenAI agent hacked Australia’s Medicare and what that means
• CNN: Australia OpenAI agent hack
• ABC News: Andrew Charlton speech, Sydney Trust and Safety Festival
• Minister Charlton’s speech (primary source)
• ABC News: Kate Conroy leading AI Safety Institute
• Australian Parliament: Joint Select Committee on Artificial Intelligence
• Baker McKenzie: Australia Charts a New Course on AI Regulation and Policy