The Joint Select Committee on Artificial Intelligence finished four days of public hearings on Friday. Two days in Sydney, two in Melbourne.
It decided nothing, and it was never going to. A select committee takes evidence and reports later. This one reports to Parliament by 30 November. There are no findings, no recommendations and no bill. [1]
That is worth saying plainly, because a lot of coverage this week has read as though something was settled. Nothing was. What did happen is that a shape became visible, and it is a shape anyone who already reports under SOCI will recognise immediately.
Here is the week, back to front, because the last two days got the least attention and carried some of the most useful material.
If you did not follow the hearings, this is the shape of them. Tuesday and Wednesday ran in Sydney. Tuesday was the AI companies, one of the major banks, and evidence from performers about consent. Wednesday was safety, cyber and automation specialists, along with the unions. The inquiry then moved to Melbourne. Thursday was infrastructure, energy and sovereignty. Friday was the banks. [2] We wrote about the Sydney days earlier in the week [3], but nothing below assumes you read that piece.
1. Thursday and Friday
Thursday, Parliament House, East Melbourne. Infrastructure, energy and sovereignty.
The inquiry had left Sydney, and the subject changed with it. Thursday was about where the machines physically sit and who controls them.
Telstra’s head of digital infrastructure, Steven Worrall, told the committee that AI labs are looking at Australia as a training destination, and called it “a threshold moment”. His argument was that these firms run their models almost nowhere outside the United States today, so hosting them here would give Australia capability it does not currently have. He said defending the country now means operating “at machine speed” with tools built largely overseas, and that some models could be used in ways “detrimental to the national interest”. His line on what sovereignty actually means is the one worth keeping: “It doesn’t necessarily mean ownership, but it does mean control.” [4]
Belinda Dennett of Data Centres Australia gave the committee the numbers underneath all of that. Australia has roughly 1.6 gigawatts of data centre capacity, heading for about 3 gigawatts by the 2030 financial year. Data centres account for around 2 per cent of national electricity demand today and are expected to reach 10 per cent by 2050. On the trade-off between that growth and the energy system, she was blunt: “There’s no free ride in there.” She warned that renewable build has to keep pace, and that slowing data centres would simply push the capital somewhere else. [5]
One concrete regulatory fact came out of that session. National AI standards are due to be drafted by the end of this year, and they are expected to require new data centres to offset their electricity use with renewable investment. That is a date for the clock. [5]
There were others in the room on Thursday: Per Capita, the National Computational Infrastructure, the Pawsey Supercomputing Research Centre, the Australian Academy of Technological Sciences and Engineering, Good Ancestors, the Minderoo Foundation and the Australian Chamber of Commerce and Industry. ACCI’s written submission argues there is insufficient evidence of systemic AI-related harm in workplaces, which sits at the opposite end of the week and sentiment from the union evidence on Tuesday and Wednesday. [6]
Friday, same venue. The banks.
Three of the big four appeared on Friday afternoon, along with the industry body. The fourth had already given evidence on Tuesday, so all four majors were heard across the week, just not together. [7]
The Australian Banking Association’s Simon Birmingham put the clearest position of the day. Regulate standards and conduct, he argued, not the technology, because individuals and corporations are ultimately responsible either way. He also said everyone has a role in lifting community confidence about AI, warning that “if a country is entirely driven by the fear and the concerns, that’s really going to be harmful”. He pointed to scams and fraud as the area where public enthusiasm for AI sits, and said banks should explain how they use it there. He flagged risks too, naming “the use of agentic agents intersecting the financial system”. [7]
Worth noting who said that, and when. The banks’ own representative body put agentic AI on the risk list in the same evidence where it argued against regulating technology.
NAB’s Peter Steel argued Australia should not pass up the chance to host data centres and model training, calling it “quite a unique opportunity to become relevant and a significant participant in AI globally”. He also said it was extremely important that government fraud regimes extend upstream, and agreed technology companies should be held accountable to some extent for AI-enabled scams. [7]
Westpac’s chief AI officer Dan Jermyn argued that maintaining access to frontier AI models is critical for national cyber defence and for protecting critical infrastructure like banking. The inquiry also heard that AI is saving bankers 150,000 annualised hours in assessing mortgage and credit applications. [7]
ANZ’s Kai Yang said there had been no job losses at the bank due to AI, and that he saw more opportunities created by it. [7]
The jobs question is where Friday got uncomfortable. Senator Tony Sheldon asked Westpac whether its AI use was linked to the bank recently offshoring jobs. Jermyn said he did not think so. Sheldon’s response was “This is a social license question.” He then asked ANZ for the actual number of AI-created jobs onshore and offshore. Yang said “I can take that on notice”, so that answer is still outstanding. [7]
2. What Tuesday and Wednesday were actually about
Tuesday, NSW Parliament House, Sydney. The apology, and the consent problem.
OpenAI’s Chief Strategy Officer Jason Kwon flew in to say the company’s handling of its agents reaching Australian government systems “was not good enough”, and that it “should have informed the impacted parties much sooner”. He agreed the breach might never have been discovered had the company not sent an email. [8] Since then it has emerged that parts of that disclosure email were themselves AI-drafted, with human review before sending, which Kwon was asked about and offered to confirm. [9]
Microsoft, Google, Google DeepMind and Anthropic also appeared. [10][2] Anthropic gave part of its evidence in camera, with media asked to leave the room, which drew criticism from other witnesses for reducing scrutiny at exactly the moment the country is settling its first AI standards. [11]
The same day, two voice actors gave evidence about work being replicated without consent. One told the committee “I never gave consent for my work to be taken.” The other said “It is not about payment; it is about consent.” And a major bank’s chief executive was questioned about a long-serving employee asked to train a chatbot that then replaced her. He said he owned the error and had apologised, and added “I think people do and will feel that they are training technology.” [6]
Wednesday, same venue. The day that matters most for risk people.
The witnesses were safety, cyber and automation specialists, and the proposals started converging.
Outside experts put forward a 12 hour initial notification and a 72 hour follow-up for AI incidents, modelled directly on the SOCI Act. They also proposed an objective trigger, so that an AI agent reaching a system outside its authorised scope would be reportable by default, rather than left to a judgment call about materiality. Others proposed a central public incident reporting hub and an independent AI advisory council. [10]
The transcript records two more. One is mandatory monitoring, with regulators able to compel a developer’s internal logs after an incident. The other is an independent investigator for agent failures, on the model used for air accidents, where whoever works out what happened is independent of both the airline and the manufacturer. [2]
The Gradient Institute described simulated agents that kept colluding despite being instructed not to, in ways that were hard to detect. [2]
Industry did not oppose mandatory reporting. Anthropic’s representative argued that a web of different regulations around the world adds complexity and slows compliance, and the industry position across the week was for international consistency rather than against the obligation. [10] Google DeepMind’s counter was to push much of it into industry standard setting instead of law. [2]
On the record, both major AI companies went further than they had before. OpenAI said it would support a framework on mandatory disclosure and would now notify even on partial information. Anthropic said it would reach out “within a matter of days, or sooner”, and described notification today as largely voluntary. [12][2]
Wednesday also carried the union evidence on automation at work. The SDA told the committee that AI already sets rosters, assigns tasks and increasingly decides who goes on performance management. Sheldon described that as “treating people like barcodes with a pulse”. [6]
And the line of the week came from Professor Terry Flew. [2]
You certainly can’t have governance by public apology.
3. Takeaways, and what to do before the report lands
Four things are now reasonably clear.
The obligation taking shape is a notification obligation, not a technology one. Nobody is proposing to regulate models directly. The proposals are about who has to tell whom, how fast, and on what trigger. That is a familiar discipline, not a new one.
It is being modelled on SOCI. If 12 and 72 hours survive into a bill, energy and water operators will recognise the clock immediately, and everyone else will be learning it from scratch. [10]
The proposed trigger is objective, not material. This is the part most people will miss. An agent reaching a system outside its authorised scope would be reportable by default. No materiality assessment, no internal debate about whether it counts. That is a much lower bar than most incident frameworks run today. [10]
Industry has stopped arguing against it. When the regulated parties are asking for international consistency rather than for nothing, the obligation is coming. The argument now is about its shape. [10]
So here is the pre-emptive list. It is addressed to the risk function, and none of it requires a law, a bill or a consultation paper. The separate question of whether your function has been given the capacity to do any of it is dealt with below.
One. Find out whether you would see it at all. Not whether you have an AI policy. Whether an automated, unauthenticated client reaching one of your internet-facing services would appear in anything you actually read. In the five government cases, nobody found it. The vendor told them. [12]
Two. Go looking for exposed keys and credentials. At one of the five, the way in was an access key that should not have been exposed. [12] That is the single most repeatable finding of the whole episode, and it is nobody’s fault but the organisation’s.
Three. Decide your own reportability trigger now. If an agent reached a system outside its authorised scope tomorrow, is that an incident under your framework today, or a judgment call? Answer that before someone answers it for you.
Four. Work the 12 hour clock on paper. Who makes the call at 2am on a Sunday. Who can reach the board. What you can actually say in twelve hours when you know almost nothing. Run it as a tabletop, not a policy update.
Five. Read your AI contracts for three clauses. Incident notification, audit rights, and notice of model changes. APRA named all three as gaps in its 30 April letter to every regulated entity. [13] Include the AI that arrived inside a supplier’s product, because that is where most of it is.
Six. Put it on the register and give it an owner. Including the model provider sitting behind an embedded feature, and a note that it can change without telling you. An exposure nobody has assessed is an unmanaged risk sitting under a board attestation.
The BayRisk comment
The temptation this week is to read the hearings as a story about artificial intelligence. We do not think it is.
Go back through the six items above and ask what any of them actually requires. Log review on internet-facing services. A credential and key sweep. A defined incident trigger. A tabletop run against a clock. Three clauses in a contract. A line on a register with an owner against it.
Not one of those needs a new tool. Not one needs a law. Not one needs a capability that did not exist five years ago. Everything that came out of four days of evidence sits well within reach of a risk function that has the time to do the work.
That is the encouraging part, and it is worth saying first. This was not a week that revealed a gap nobody knows how to close. The methods are ordinary and well understood. What they take is capacity.
What the week did show is how easily visibility falls between people who each reasonably assume somebody else has it. That is not a new problem brought on by AI. It is one of the oldest patterns in operational risk, wearing a new coat.
Nothing that came out of four days of evidence needed a new tool. It needed someone with the time to look.
Which is the part worth dwelling on, and it is not really a question for the risk function.
A note for the people who fund the function
If a risk team cannot get to the six things above, that is rarely a judgement anyone made on purpose. It is usually the quiet arithmetic of a function that has absorbed several years of new obligation without a matching change in capacity. Nobody decided it. It accumulated.
What makes it worth a board’s attention is a feature of the governance model rather than a criticism of any particular board. In most functions, the people who set the budget and the people who carry the consequence are not the same people. Here they are. The board approves and attests the CIRMP report. CPS 230 and CPS 234 place responsibility for operational and information security risk at board level. The AICD’s own governance principles say the same. [14] That was a deliberate design choice, and we think it is the right one.
It does mean the six items above are not a wish list from the security team. They are part of the evidence base behind a signature the board has already given. Which makes capacity a governance question rather than a budget line.
The attestation and the budget sit with the same people. That is an opportunity, not an accusation.
We have written about the arithmetic before. Security budgets growing at their slowest rate in five years and sitting under eleven per cent of the IT budget. Fewer than half of security leaders able to add any net new headcount, down from two thirds three years earlier. Most of the money that did move going to platforms rather than people. [15] Meanwhile the obligations keep arriving on a quarterly cadence. CPS 230 is live. The enhanced CIRMP Rules are phasing in. Tranche 2 programs are due. And now an AI reporting regime is taking shape in a committee room.
When we asked readers in September why the supplier questionnaire still goes out when every regulator has said it is no longer enough, the two answers at the top were; waiting because nobody else had moved, and no capacity. [16] The second is the honest one. Most people know what good looks like. They do not have the hands to do it.
The reflex in this market is to answer that with another tool handed to a team already at capacity. A tool reports on what it is pointed at. It does not decide what matters, keep the position current as the obligations move, or put a costed and defensible read in front of a board. That is an operation, and an operation needs to be funded and staffed like one.
So one question is probably worth a few minutes at the next board meeting, and it is a question for the table rather than for the CISO. If a regulator picked today and asked what we knew, when we knew it and what we can show, would the answer come out of a current document, or would it take a fortnight to assemble? Either answer is useful. If it is the fortnight, the follow-up is not why. It is what would it take.
We should say plainly that running risk as a continuous operation is what we sell, so we are not a neutral party to that argument. That does not make it less true, and every one of the six items above costs nothing to go and check for yourself.
The committee reports by 30 November. [1] Whatever it recommends will land on the same function, under the same signature. The organisations that take it in their stride will be the ones who looked at the capacity question before the rules arrived.
This piece follows on from Third-party risk assumes there is a counterparty. This one had none. published earlier this week.
References
1. Clayton Utz, “From patchwork to playbook: the Joint Select Committee on AI and what it means for business”, August 2026, for the committee’s establishment and 30 November reporting date. https://www.claytonutz.com/insights/2026/august/from-patchwork-to-playbook-the-joint-select-committee-on-ai-and-what-it-means-for-business
2. Joint Select Committee on Artificial Intelligence, uncorrected proof transcripts of public hearings, 6 to 9 October 2026, as summarised by a public tracker of Australian AI agent rules. Confirm against the corrected transcripts when published.
3. BayRisk, “Third-party risk assumes there is a counterparty. This one had none.”, 7 October 2026. https://bayrisk.com.au/blog/2026/10/07/third-party-risk-assumes-a-counterparty/
4. The Epoch Times, “Telstra Says Bringing AI Training to Australia Could Benefit National Security”, 8 October 2026. https://www.theepochtimes.com/world/telstra-says-bringing-ai-training-to-australia-could-benefit-national-security-6101049
5. Australian Associated Press, reporting on data centre capacity and energy evidence to the committee, 8 October 2026. https://www.mandurahmail.com.au/story/9364636/business-lobby-looks-beyond-the-hype-and-risks-of-ai/
6. Australian press reporting on performer, union and employer evidence to the committee, 9 October 2026. Original outlet to be confirmed before publication.
7. ABC News, live coverage of the parliamentary inquiry into AI, 9 October 2026. https://www.abc.net.au/news/2026-10-09/asx-markets-business-live-news-9-october-2026/107246104
8. Australian Computer Society, Information Age, “OpenAI grilled over rogue agents by Australian inquiry”, 6 October 2026. https://ia.acs.org.au/article/2026/openai-grilled-over-rogue-agents-by-australian-inquiry.html
9. Cybernews, reporting that parts of the breach disclosure email were AI-drafted, 8 October 2026. https://cybernews.com/ai-news/openai-australia-government-hack-email/
10. Dark Reading, “Australian Gov’t Weighs Mandatory AI Incident Reporting”, 7 October 2026. https://www.darkreading.com/cybersecurity-operations/australian-govt-ai-incident-reporting
11. InnovationAus, “AI giant’s closed-door evidence to lawmakers under fire”, 7 October 2026. https://www.innovationaus.com/ai-giants-closed-door-evidence-to-lawmakers-under-fire/
12. OpenAI, “How we will do better for Australia”, 28 September 2026, updated 4 October 2026. https://openai.com/index/how-we-will-do-better-for-australia/
13. APRA, “Letter to industry on artificial intelligence (AI)”, 30 April 2026. https://www.apra.gov.au/apra-letter-to-industry-on-artificial-intelligence-ai
14. Australian Institute of Company Directors, Cyber Security Governance Principles, for board-level accountability.
15. IANS Research and Artico Search, 2025 Security Budget Benchmark, for the budget growth, IT budget share and headcount figures, as cited in “Why you will never read a breach story on this blog”.
16. BayRisk reader poll on third-party assurance, September 2026, reported in RiskWatch Issue 02.