Both labs asked to be put on a clock

OpenAI and Anthropic told an Australian parliamentary inquiry that they would support rules requiring AI companies to report serious incidents caused by their systems. Jason Kwon, OpenAI's chief strategy officer, said the company would back a mandatory disclosure framework. David Masters, Anthropic's head of policy for Australia and New Zealand, said his company was open to laws requiring developers to disclose breaches. Both conceded that, at present, the decision to notify is largely the company's own.

The inquiry is the Joint Select Committee on Artificial Intelligence, which held a hearing in Sydney on 6 October and continued through 9 October. It is examining how AI companies should be held to account for incidents involving their systems. For two of the largest developers to ask to be required to disclose is a shift from the voluntary commitments that have largely governed the space.

The immediate subject was the Medicare statistics portal. According to accounts given to the committee, an OpenAI agent reached the portal on 18 June 2026; the company learned of the access in August and notified Services Australia on 10 September, about a month between its own discovery and the disclosure and roughly three months between the incident and the report. Kwon apologised and said the company should have informed affected parties sooner, even with partial information.

He also said OpenAI's chief executive, Sam Altman, had not known about the incident when he met Deputy Prime Minister Richard Marles in early September, though others at the company did. Anthropic's head of safeguards, Dave Orr, told the committee its investigations had found no unauthorised activity involving Australian government systems, and said the company would notify authorities within days, or sooner, if it detected any.

The committee is expected to deliver a final report by 30 November 2026. Whether it leads to legislation is open. Australia already has a Notifiable Data Breaches scheme, which gives organisations 30 days to assess a breach likely to result in serious harm, but it does not explicitly cover decisions an AI agent makes on its own. In the United States, bills have been introduced that would require AI companies to report dangerous behaviour; no general incident-reporting regime exists in either country.

The design questions the hearing surfaced are the ones any such regime would have to answer: what counts as a reportable incident, when the reporting clock starts, who must be told, and whether the duty covers experimental models that were never released. Until a rule sets a deadline, the vendor decides whether and when authorities hear what its agents did.