When OpenAI fronted a parliamentary inquiry into AI in Sydney, its chief strategy officer, Jason Kwon, apologised over an incident involving Medicare. “We are sorry and we know we have work to do to rebuild trust with the Australian people,” he told the committee, acknowledging the company should have alerted the Government sooner and outlining changes, including immediate incident reporting.
Des Viranna, Head of Advisory and AI at Altis Consulting, says the apology is a useful reminder for business owners of where responsibility actually sits.
“Those commitments are welcome, but they came after the event and only when a parliament asked for them,” Viranna says. “The protections that matter most will not be handed down by regulators or offered up by technology companies. They have to be built inside the organisation.”
A fractured global response
The incident lands against a backdrop of inconsistent global rules on AI. Australia joined more than 20 countries calling for AI to remain under human direction, oversight and control, a position the United States and China have not signed onto, instead pursuing their own bilateral discussions. New Zealand, meanwhile, has taken a lighter touch, leaning on existing laws rather than introducing AI-specific legislation.
Viranna says that divergence is not going away soon. “Governments are taking different approaches, and for businesses operating across both sides of the Tasman, navigating that uncertainty is likely to be a reality for some time,” he says.
Drawing on experience implementing technology ahead of the regulation meant to govern it, including early cloud adoption in banking and some of the first real time decisioning and natural language systems, Viranna says a pattern tends to repeat. “The organisations that did well were the ones that worked out how to govern it themselves, rather than waiting to be told. With AI, the pace of change makes waiting an even greater risk,” he says.
Four questions to ask
Viranna sets out four questions he believes business leaders should be putting to their management or themselves now, each tied to something that can be acted on within the quarter.
The first is about risk appetite. “What is our appetite for AI risk, and is it written down?” Viranna says. He argues that without a documented position, decisions get made case by case, and that’s where problems tend to start. He recommends a short risk appetite statement linked to the existing risk register, revisited every six months.
The second asks whether a business would even know if something had gone wrong. Viranna points to the Medicare case, where the system owner learned of the access from the vendor almost three months later. He suggests testing public facing systems against automated and agent traffic, with clear monitoring and alert thresholds agreed in advance.
The third concerns supplier contracts. “What do our contracts require of suppliers when AI is involved in an incident?” Viranna says, noting that OpenAI’s first notification in the Medicare case went to a public inbox. He says agreements with critical technology and AI suppliers should specify who must be notified, how quickly, and what cooperation is required, and that businesses don’t need to wait for a contract renewal to raise it.
The fourth is about dependency. Many AI models are built in the United States or China, where regulatory and geopolitical shifts could carry consequences for businesses relying on them. Viranna recommends mapping which processes depend on which providers, with a credible fallback for anything the business couldn’t operate without.
Accountability starts at home
Both OpenAI and Anthropic told the same inquiry they would support mandatory reporting of serious AI incidents, a development Viranna says would help if it arrives. But he’s clear that it isn’t a substitute for internal oversight. “An obligation on a vendor to report will never tell an organisation what is happening inside its own systems,” he says.
For business owners without a formal board, Viranna’s four questions translate directly: they’re the questions to be asking of yourself, or whoever in the business is responsible for how AI tools get used day to day.
“Governments and technology companies have important roles to play, but neither can take responsibility for how AI is used within an organisation,” Viranna says. “That responsibility sits with its leadership, and it can’t wait for governments to catch up.”