The Department of Industry listed 37 firms queued for mandatory high-risk artificial intelligence incident reporting from 1 October, extending a pilot that began with banks and telcos to logistics, healthcare scheduling and construction inspection providers.
Companies on the list must notify the department within 72 hours when deployed models cause material harm, discriminatory outcomes or systemic downtime affecting more than 50,000 users. Reports feed a confidential register shared with the Office of the Australian Information Commissioner and sector regulators.
What counts as high risk
Guidance published in September defines high-risk systems as those making eligibility, safety or credit decisions without meaningful human review, or computer-vision tools used in workplaces with biometric inference. Firms may self-assess out of the queue only with an external auditor sign-off filed quarterly.
Lawyers for several listed logistics firms said they were standing up runbooks to distinguish model drift incidents from vanilla IT outages, a distinction the department said it would clarify in template forms released this week.
Industry reaction
Tech council representatives welcomed harmonisation with European Union AI Act documentation formats, reducing duplicate paperwork for multinationals running models in Sydney and Singapore regions. Smaller local vendors argued the 50,000-user threshold still captures mid-size SaaS players that lack dedicated safety teams.
CSIRO’s national AI centre offered a free taxonomy workshop for firms unsure how to classify fine-tuned open-weight models embedded in customer service chatbots, a common pain point in the pilot.
Privacy and OAIC alignment
The OAIC said incident reports that involve personal information must also be assessed against notifiable data breach rules, but that a single coordinated form would be accepted when both regimes apply. Privacy advocates asked for public aggregated statistics starting in January so civil society can track harm trends without exposing trade secrets.
Parliamentary oversight
A joint select committee hearing set for mid-October will question department officials on enforcement tools, including whether civil penalties modelled on consumer law will be introduced in the spring sitting. Ministerial staff told reporters the government prefers industry standards that can move faster than statute while the Senate reviews broader AI safety bills.
For boards, the October queue means incident playbooks need sign-off before long weekends, and vendor contracts must require sub-processors to notify upstream providers within 24 hours when model behaviour shifts after retraining.
Startups not yet on the mandatory list said they are pre-emptively adopting the incident template to win enterprise procurement tenders, particularly in mining services where safety incidents trigger immediate shutdowns.