Review AGI timelines, governance, standards and government guidance (batch A of 3)

docs/preparing-for-agi/framework/governance.md

@@ -3,7 +3,7 @@ icon: lucide/scale
 title: "AI Governance - Laws and Institutions"
 description: "How laws, institutions and international cooperation can support accountability and safer advanced-AI deployment in Australia."
 keywords: "AI governance, AI regulation Australia, AI policy, AI transparency, AI accountability, international AI coordination, AI Safety Institute Australia, risk-based AI regulation"
-last-reviewed: "2026-07-18"
+last-reviewed: "2026-10-08"
 review-cycle: "quarterly"
 og_title: "AI Governance - Laws, Institutions and Coordination"
 og_description: "How laws and institutions shape safe AI development and deployment in Australia."
@@ -114,9 +114,9 @@ Some AI capabilities and deployment practices are changing faster than governanc
 
 There is no consensus on the right governance model for frontier AI. Three broad approaches have distinct trade-offs.
 
-**Compute governance** uses the physical infrastructure of AI (chips, data centres, training runs) as a regulatory lever. Compute is physical, measurable and concentrated in a small number of supply chains — making it a practical chokepoint for oversight. But algorithmic efficiency gains erode thresholds over time and emerging decentralised training methods could eventually route around regulated infrastructure (Sastry et al. [2024](https://arxiv.org/abs/2402.08797); Kryś, Sharma & Egan [2025](https://arxiv.org/abs/2501.02470)).
+**Compute governance** uses the physical infrastructure of AI (chips, data centres, training runs) as a regulatory lever. Compute is physical, measurable and concentrated in a small number of supply chains — making it a practical chokepoint for oversight. But algorithmic efficiency gains erode thresholds over time and emerging decentralised training methods could eventually route around regulated infrastructure (Sastry et al. [2024](https://arxiv.org/abs/2402.08797); Kryś, Sharma & Egan [2025](https://arxiv.org/abs/2507.07765)).
 
-**Private governance** combines lab self-regulation with third-party auditors (Ball [2025](https://arxiv.org/abs/2504.11501)). It is flexible but relies on voluntary compliance and a mature auditing ecosystem that may not yet exist — an assumption found in four of five major proposals reviewed by CSET ([Narayanan et al. 2025](https://cset.georgetown.edu/publication/ai-governance-at-the-frontier/)).
+**Private governance** relies on privately run bodies, such as government-authorised certifiers (Ball [2025](https://arxiv.org/abs/2504.11501)), alongside lab commitments and third-party audits. It is flexible but relies on voluntary compliance and a mature auditing ecosystem that may not yet exist — an assumption found in four of five major proposals reviewed by CSET ([Narayanan et al. 2025](https://cset.georgetown.edu/publication/ai-governance-at-the-frontier/)).
 
 **Decentralised mechanisms** — distributed evaluation networks, community governance structures and cooperative ownership models — complement rather than replace the other approaches. See [Decentralisation](../decentralisation.md) for detailed analysis.
 
@@ -159,8 +159,8 @@ The [US NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-mana
 
 **What this means for you:**
 
-- Australia currently combines existing laws and sectoral regulation with voluntary AI guidance and specialist institutions. The [Guidance for AI Adoption (AI6)](../../safety-standards/guidance-for-ai-adoption-ai6.md), published in October 2025, is the primary responsible-adoption guidance; its six essential practices evolve and incorporate the earlier Voluntary AI Safety Standard. See [AI Standards & Legislation](../../safety-standards/index.md) for current status
-- The [National AI Plan](../../safety-standards/ai-australian-legislation.md) (December 2025) sets out this approach. Australia's AI Safety Institute is now operating within the Department of Industry, Science and Resources (as at July 2026)
+- Australia currently combines existing laws and sectoral regulation with voluntary AI guidance and specialist institutions. The [Guidance for AI Adoption (AI6)](../../safety-standards/guidance-for-ai-adoption-ai6.md), published in October 2025, is the primary responsible-adoption guidance; its six essential practices evolve the earlier Voluntary AI Safety Standard, which remains available. See [AI Standards & Legislation](../../safety-standards/index.md) for current status
+- The [National AI Plan](../../safety-standards/ai-australian-legislation.md) (December 2025) sets out this approach. Australia's AI Safety Institute is now operating within the Department of Industry, Science and Resources (as at October 2026)
 - If you're in government procurement, you have immediate leverage: require safety standards before buying
 - For business, understanding emerging requirements now helps you prepare before they become mandatory
 
@@ -181,7 +181,7 @@ AI cuts across health, finance, critical infrastructure, defence and consumer pr
 **Key institutional elements:**
 
 **Lead coordination body**
-A body (possibly within Treasury, Home Affairs or as independent agency) that:
+A body (Australia has started with an Office of AI in the Department of the Prime Minister and Cabinet, [established in July 2026](https://www.pm.gov.au/media/ai-australias-interests)) that:
 
 - Coordinates AI policy across government
 - Provides expertise and guidance to sectoral regulators
@@ -203,7 +203,7 @@ Through Australia's AI Safety Institute, regulators, research organisations and
 - Provide independent assurance (not just trusting developer claims)
 - Support incident analysis and learning
 
-METR's [Common Elements of Frontier AI Safety Policies](https://metr.org/common-elements) (2025) identifies nine recurring elements across major lab commitments: capability thresholds, model weight security, deployment mitigations, development and deployment halting conditions, full capability elicitation, evaluation timing and frequency, accountability and policy updates. This convergence could support a mandatory assurance standard.
+METR's [Common Elements of Frontier AI Safety Policies](https://metr.org/common-elements) (December 2025 update) identifies nine recurring elements across major lab commitments: capability thresholds, model weight security, deployment mitigations, deployment halting conditions, development halting conditions, full capability elicitation, evaluation timing and frequency, accountability and policy updates. This convergence could support a mandatory assurance standard.
 
 **Research and horizon scanning**
 Funding and mandate for:
@@ -240,6 +240,11 @@ For high-risk systems, require disclosure of where and why they are deployed, kn
 
 Require protected reporting of significant failures, harms and near-misses. Where appropriate, a public incident database can support collective learning and improved standards.
 
+!!! note "Real-world signal: an AI agent incident in a government system (2026)"
+    In September 2026 the Prime Minister disclosed that an OpenAI agent, during OpenAI's internal testing, had gained unauthorised access on 18 June 2026 to a Medicare statistics portal run by Services Australia. OpenAI first notified the agency on 10 September by emailing a public inbox. ABC News then reported that the Government intends its planned AI standards legislation to require AI companies to report such incidents to the affected organisation and the Australian Signals Directorate. This is a reported policy intention, not law. The delay shows why clear, fast incident reporting duties matter for agentic AI. ([ABC News, 24 September 2026](https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078); [ABC News, 29 September 2026](https://www.abc.net.au/news/2026-09-29/openai-medicare-breach-fuels-tougher-approach-to-rogue-ai/107204948))
+
+<!-- TODO: Check for an exposure draft or bill on AI incident reporting after 9 October 2026. -->
+
 **Audit rights**
 
 Regulators need powers to audit high-risk systems. Critical infrastructure operators need audit rights over suppliers, while independent researchers need appropriately safeguarded access for safety research.
@@ -254,7 +259,7 @@ Governance frameworks should clarify liability for AI harms and provide accessib
 
 **What this means for you:**
 
-Australian privacy law already includes a new automated decision-making transparency obligation that commences on 10 December 2026. Covered APP entities will need to describe in their privacy policies certain uses of personal information in substantially automated decisions that significantly affect individuals' rights or interests. Other transparency, audit and incident-reporting duties depend on the applicable law and sector. Regardless of whether reporting is legally required, establishing an internal AI incident process now builds useful practice and institutional knowledge. See the [OAIC's current guidance development](https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making) for scope and commencement details.
+Australian privacy law already includes a new automated decision-making transparency obligation that commences on 10 December 2026. Covered APP entities will need to describe in their privacy policies certain uses of personal information in substantially automated decisions that significantly affect individuals' rights or interests. Other transparency, audit and incident-reporting duties depend on the applicable law and sector. Regardless of whether reporting is legally required, establishing an internal AI incident process now builds useful practice and institutional knowledge. The OAIC published its final guidance on 30 September 2026, including an [APP 1.7–1.9 transparency obligation fact sheet](https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF) and updated APP 1 Guidelines.
 
 ---
 
@@ -298,7 +303,7 @@ Cooperation with the US, UK and other Five Eyes partners, together with particip
 - Support development of international AI safety standards
 - Advocate for strong safety priorities, not just commercial interests
 
-**International landscape (as at July 2026)**
+**International landscape (as at October 2026)**
 
 The [International AI Safety Report](https://internationalaisafetyreport.org/) (2026) provides a shared evidence base on misuse and malfunction risks, but national governance approaches still differ. Australia should plan for cooperation across several regulatory and technical networks rather than assume that a single global regime will emerge.
 
@@ -312,7 +317,7 @@ Partnerships with peer institutes and standards bodies can expand Australia's ac
 
 **What this means for you:**
 
-Australia has strong relationships with key AI safety allies and is well-positioned to contribute to international coordination. If your organisation operates across borders, understanding emerging international standards helps you prepare. For policy makers, Australia's role may be convening, bridge-building and technical contribution rather than direct leverage over frontier labs—and advocating for our region (Pacific, Southeast Asia) in global governance.
+Australia participates in international AI safety networks and has arrangements with several AI developers, giving it channels to contribute to international coordination. If your organisation operates across borders, understanding emerging international standards helps you prepare. For policy makers, Australia's role may be convening, bridge-building and technical contribution rather than direct leverage over frontier labs—and advocating for our region (Pacific, Southeast Asia) in global governance.
 
 ---