Even before a rogue OpenAI bot breached the database of Australia's health system, the government was escalating its rhetoric about the need to tighten regulation.
The incursion on one of the country's most used government agencies may prompt a tougher stance as Australia readies AI-specific laws starting in 2027, adding pressure to Australia-US relations already tested by Canberra's teen social media ban, tech policy experts said.
Australia has already frustrated the ChatGPT maker and rival Anthropic by refusing to let them bypass copyright laws for model training - requiring them to negotiate licensing deals with Australian rights-holders first. That refusal will most likely remain, the experts said.
The new regulations may also include mandatory reporting for AI companies if their products engage in security breaches, mirroring new Australian laws that require firms to disclose an intrusion within 72 hours.
The Medicare incident may also raise the importance of "social license" - the question of whether a company benefits the community it is operating in - when Australian planning authorities weigh applications to build data centers.
As the Medicare news broke, OpenAI and Anthropic had partnerships with what would be some of the country's biggest data centers - which are awaiting government clearance.
"I would hope it emboldens the government to take more oversight and control over an industry which needs to grow up fast," said Toby Walsh, chief scientist at the University of New South Wales' AI Institute. His university has a sponsorship agreement with OpenAI.
"We would prosecute humans who did such hacking."
Australian leader Anthony Albanese called the breach, which occurred in June and was revealed by OpenAI in September, "unacceptable" and said he voiced "extreme concern" to OpenAI CEO Sam Altman.
He added that the government was considering "possible law-enforcement and legislative responses."
OpenAI says it only learned of the breach - one of at least four of Australian government websites - in August. It says the incident was not intentional and didn't compromise any private information.
An OpenAI spokesperson did not immediately respond to a Reuters question about Albanese's comments.
The fallout brings urgency to a pressure point between the countries: laws keeping under-16s off social media and levies for platforms which post Australian news content have angered the Trump administration.
New plans by Australia to require companies to take responsibility for user safety, including letting users opt out of algorithms, were decried as "censorship" by Washington.
Canberra, which has two other ongoing inquiries into AI, in addition to two state inquiries, also wants federal laws requiring data centres to supply their own energy and cap water usage, while stopping them from using Australian content for training without paying.
It may now update privacy laws to require AI companies to report breaches they are responsible for. They may also have to contribute to testing of public-facing websites to preserve national security, the policy experts said.
Australia's record of tech regulation in the face of US resistance puts it in position to lead other countries in a campaign for better AI guardrails, said Johanna Weaver, executive director of the Tech Policy Design Institute and Australia's former chief cyber negotiator at the United Nations.
"The question is whether that is the path that we choose and what the US response will be," she said.
Even if the US objects or retaliates, the Australians seem empowered to seize the moment, said Henry Fraser, a technology law researcher at Queensland University of Technology.
"I don't think that they would be expecting backlash from the US - or to the extent they are, they've decided that the local politics of people's concerns about these types of risks is in favor of taking action," he said.
The incident raises the practical stakes of a data center buildout that economists estimate will be worth A$150 billion ($105 billion) by 2030.
Since OpenAI teamed with Australia's NextDC in December for a 612-megawatt facility in Sydney, Canberra has said it would impose data center planning restrictions.
The companies have said they will comply but have yet to secure sign-off by New South Wales state authorities, who are awaiting planning documents. After Albanese's Medicare disclosure, NSW Premier Chris Minns said an OpenAI bot had accessed a research database of the state's Bureau of Crime Statistics and Research.
"The buy-in of social license actually has to go up the stack a bit," said Rob Nicholls, a researcher at the University of Sydney's Centre for AI, Trust and Governance.
"Just saying 'we'll knock 200 bucks off the energy bill of everybody who's near our data center' ... should be the minimum."
Anthropic has a local partner for a 2.16-gigawatt data center in Queensland, which needs Foreign Investment Review Board and state government approval. An Anthropic spokesperson declined to comment.
NSW state Greens lawmaker Abigail Boyd, who chairs an inquiry into data centers, said the state "absolutely needs to consider the social harms created by these technologies when considering the planning approvals for these hyperscale data centers."
