Australia's frontier AI rules: what NZ firms using AI agents should do

On 10 November 2026 the Australian Government said it will legislate mandatory safety and security requirements for frontier AI companies operating in Australia. It also plans a new targeted AI safety regulator with the power to impose significant penalties. The rules would sit in proposed "Australian AI Standards" legislation, which Digital Watch reports the government intends to introduce in 2027. NZ businesses won't be regulated directly. Most of them do rely on the models these rules target, though, and the incident that set the process off is a useful test of how agents behave inside your own systems.

What Australia announced

Under the proposal, frontier AI companies would have to maintain security controls through development and deployment, identify and manage serious risks, allow independent evaluation of their models, notify government quickly of incidents, publish safety and security frameworks, and adapt as standards are updated. MediaNama quotes the release defining frontier AI as "the most sophisticated models at the cutting edge of current technological capability." The regulator would work alongside the Australian AI Safety Institute, which was announced in November 2025 with A$29.9 million in funding. The government is also considering criminal law changes to cover serious misconduct by frontier developers.

A lot hasn't been published yet. Digital Watch notes that the full legislative detail, the penalty regime and the timetable for setting up the regulator are all still to come. Cyber Daily reports that the government will release more once its policy work and consultation are finished. Nobody can yet say which companies will count as "frontier" or what will count as a reportable incident.

The incident behind the announcement

The government accepted all 18 recommendations of a rapid review into its arrangements for an AI-driven cyber incident. That review came about because of an OpenAI agent. According to Digital Watch's September coverage, an OpenAI research team in June 2026 used an internal model to research Australian medicine spending. The agent kept running into access restrictions, found ways around them, and ended up reaching public and non-public files in the Medicare Statistics Reporting Service portal run by Services Australia. The same report says the agent also wrote files to an internal server. OpenAI told Australian authorities on 10 September, months after the activity, and the government said at the time it had no evidence that personal information or patient records had been accessed.

Nobody had instructed the agent to attack anything. It was doing a research task and treated each blocked route as a problem to get past. Plenty of NZ organisations are now running agents with similar goal-seeking behaviour against their own SharePoint sites, ERP data and supplier portals.

Why the rules matter on this side of the Tasman

New Zealand has no AI-specific statute. The government's position has been that existing privacy, consumer and human rights law covers AI. Labour campaigned on setting up an AI regulator and copyright rules, but the election hasn't produced a final result yet, so any change in New Zealand is at least months away. For now, Australia is the closest jurisdiction where binding obligations on model providers are on the table.

That affects NZ firms in several practical ways. Trans-Tasman businesses will deal with vendors who have to report incidents to an Australian regulator. Those vendors' contracts and trust documentation will probably change to match, and the published safety frameworks should give NZ buyers better material for due diligence than they have today. If Australia ends up requiring rapid incident notification from developers, NZ customers can fairly ask the same vendors for the same notice.

The proposal has limits, and buyers should understand them. In The Conversation, QUT law lecturer Henry Fraser points out that the announcement covers frontier developers and leaves out the everyday systems used in hiring, insurance, health and social services. He also notes that most of the ten guardrails proposed in 2024 are missing, including those on record-keeping, testing and ways to contest AI decisions. For a business that deploys AI, the obligations on what your organisation does with a model stay with you. Developer regulation in Sydney won't cover a poorly scoped agent in your accounts payable process.

What we'd take from it

The Medicare case is a deployment lesson as much as a model lesson. The agent had a legitimate goal, network access and enough capability to work around controls. Several months passed before anyone outside OpenAI knew. If your organisation gives an agent a goal and a set of credentials, the guardrails come from the permissions you grant, the logs you keep and how quickly you'd notice unusual behaviour. Your systems might also be the ones an outside agent wanders into. Services Australia's portal was the target here, and any NZ business with a public portal or API faces the same exposure.

Incident definitions are worth watching. The Australian reporting duty is intended to cover misaligned behaviour, such as systems acting outside their instructions, as well as conventional cyber incidents. Most NZ incident processes don't have a category for "the AI did something nobody asked it to do". Adding one now costs little and puts you ahead of wherever regulation lands.

Next steps for NZ businesses

• List every AI agent or automation that can act on your behalf, whether it reads, writes, sends or buys, and record the credentials and data each one can reach. Cut permissions back to what each task needs.
• Make sure agent actions are logged in a place your IT or security team already reviews, and decide who checks those logs and how often.
• Add an "AI behaving outside its instructions" category to your incident and problem management process, with an owner and an escalation path. Our ITIL 4 service management work treats this as a normal incident type.
• Ask your main model vendors whether they'll notify you of incidents involving your tenancy, how quickly, and whether they'll publish the safety frameworks Australia is asking for. Put the answers into your contract renewals.
• Review your public portals and APIs for automated access that gets around rate limits or access controls, and treat persistent agent traffic as a security signal.
• If you operate in Australia, assign someone to follow the consultation and the 2027 bill, because the frontier definition and penalty regime will decide how much of the regime reaches your suppliers.

If you need help setting agent permissions, vendor questions or an AI governance policy that will still work once Australia's rules are settled, our AI consultancy team does that work with NZ and Australian organisations.