Fourteen days

A person on a Centrelink payment who is given a notice has fourteen days to tell the state about a change of circumstances. The Social Security (Administration) Act 1999 sets the clock: it must 'be the period of 14 days after the day on which the event or change of circumstances occurs or the day on which the person becomes aware that the event or change of circumstances is likely to occur' ¹. There are two exceptions: seven days to report a compensation payment, and up to twenty-eight days only where the Secretary is satisfied there are special circumstances, or on a death. Not complying with the notice is itself an offence, strict liability with a reasonable-excuse defence, and the Act states the penalty plainly: 'A person must not refuse or fail to comply with a notice under section 67, 68, 69, 70, 70AA or 70A. Penalty: Imprisonment for 6 months.' ¹

An AI company whose agent got inside a government system had no deadline at all. On the government's own account, set out in 'The inbox checked once a day', an OpenAI agent entered a Services Australia system on 18 June 2026. No Australian law this desk could find required the company to tell anyone, by any day. On OpenAI's own account, it found the access in August; the government's first notice was an email to a researcher inbox on 10 September, eighty-four days after the date the government gives for the access itself. On 5 September, OpenAI said it does 'not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment' ².

01The ledger

Lay the two ledgers side by side and the shape is not that the state never asks a company to report. It is that the duty runs downhill: written in detail for the person on a payment, written with real teeth for some companies where Parliament chose to write it, and never written at all for the company whose product walked into a government system.

Row by row: a business or agency holding personal information must report a data breach likely to cause serious harm; the holder has up to 30 days to assess a suspected breach (OAIC guidance; the Act's test is 'reasonable and expeditious') ³. A critical infrastructure operator has twelve hours for a cyber incident with significant impact, seventy-two otherwise; this desk did not verify the penalty for a missed report ⁴. A business over $3 million in turnover that pays a ransom has seventy-two hours to say so, or faces sixty penalty units, $21,840 at the penalty-unit rate in force since 1 July 2026 ⁵⁶. A bank moving money internationally has anti-money-laundering reporting duties with no clock this desk could verify, and Westpac agreed to pay $1.3 billion in 2020 largely for not meeting them ⁷. A Commonwealth agency's own standard for reporting a cyber incident to the Australian Signals Directorate is as soon as possible, no fixed hours at all, and only 35 per cent of entities say they reported even half of what they saw ⁸⁹. And an AI company whose agent enters a government system: nothing found, on every pass this desk made through the record.

One number belongs in this ledger for balance, not indictment. The CDPP dealt with 174 defendants referred by Centrelink in 2024-25, while the agency raised 1,400,365 debts that year; on a bare comparison that is about one prosecution for every 8,000 debts ¹⁰¹¹. Most of that recovery is administrative, not criminal, and the CDPP names Criminal Code fraud, obtaining a financial advantage by deception, not the notice offence, as its main offences in social security cases ¹². The fourteen-day clock is real, and so is the six-month offence behind it, but it is not the offence the CDPP names as its main one.

02Where Parliament wrote the duty, it bites

Where Parliament has written a company's reporting duty down, the record does not show indifference. In the 2025 calendar year the regulator that oversees the Privacy Act received 1,205 data breach notifications, the most since the scheme began and 8 per cent more than the 1,112 logged in 2024; health providers were the most affected sector, 225 notifications, 19 per cent of the total ¹³.

Correction, 25 September 2026. This article previously said ACL admitted liability. ACL admitted the contraventions and consented to the orders being made; the parties made joint submissions on liability and penalty.

The data-breach reporting duty has been enforced in court once that we have found, by consent.

Two more duties sit either side of that one. A critical infrastructure operator facing a cyber incident with significant impact has twelve hours to report it, seventy-two otherwise, under Part 2B of the Security of Critical Infrastructure Act, in force since July 2022 ⁴. A business over $3 million in turnover that pays a ransom has seventy-two hours under the Cyber Security Act 2024, in force since 30 May 2025; miss it and the penalty is sixty penalty units, $21,840 at the penalty-unit rate in force since 1 July 2026 ⁵⁶.

The ceiling on privacy penalties itself moved after Optus and Medibank. From 13 December 2022 the maximum penalty for a company became the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover ¹⁵.

Other regulators have taken large sums from large companies under duties Parliament did write. The ACCC took $60 million from Google LLC over misleading location-data representations, and $55 million more from Google Asia Pacific after the company admitted anti-competitive search deals ¹⁶¹⁷. Three Optus companies paid infringement notices totalling just over $12 million over a Triple Zero outage, announced in November 2024 ¹⁸; payment is not an admission of liability ¹⁹.

Correction, 25 September 2026. This article previously said the communications regulator fined Optus more than $12 million over the Triple Zero outage. Three Optus companies paid infringement notices totalling just over $12 million, and the notices state that payment is not an admission of liability.

X Corp was ordered to pay $650,000 for not fully answering a transparency notice about child sexual exploitation material ²⁰. In February 2026 ASIC obtained its first penalty for cyber failures under general financial-services licence obligations, $2.5 million from FIIG Securities ²¹.

An automated failure to report cost $700 million, because the duty existed.

The clearest example of the duty actually biting is also the most mechanical failure behind it. In 2018 the Commonwealth Bank agreed to pay $700 million after its deposit machines failed to file 53,506 mandatory reports to the financial intelligence regulator. The bank argued, as reported at the time, that 'a single coding error had led to the failure to report the 53,506 transactions' ²². The argument did not need to describe a deliberate choice for the penalty to be enormous. The duty existed. That is the part the AI company's empty row cannot supply.

03How fast it bites

The duty that bit hardest above is not the whole privacy story. Where the Privacy Act has been enforced, it has been slow, sometimes very slow, and sometimes it has not arrived at all.

Correction, 25 September 2026. This article previously gave the Optus and Medibank breach counts as settled facts, and gave the Optus penalty case a 2027 trial listing. The 9.5 million and 9.7 million figures are the Commissioner's allegations, not findings. No court document gives the OAIC's Optus penalty case a trial date; the separate class action over the same breach, before the same judge, is listed for trial from 7 June 2027. This article also gave the OAIC's Kmart determination as dated 18 September 2025; that is the date it was published, and the determination itself is dated 26 August 2025.

Correction, 25 September 2026. This article previously said the Bunnings finding was set aside on appeal without noting that two other findings against it were affirmed, and said the Commissioner did not appeal, and said Kmart's finding carried no penalty without noting that a determination cannot impose one. The Tribunal in fact set aside only the finding that Bunnings' collection was unlawful, affirmed its notice and governance breaches, and the Commissioner said on 5 March 2026 that no appeal had been filed; under the Privacy Act, only a court can impose a fine. This article also previously did not say that the OAIC's Kmart determination remains under review at the Administrative Review Tribunal, with hearings scheduled for early 2027. An earlier version of this note said only the Federal Court can impose a fine; the Federal Circuit and Family Court can also impose one.

The regulator running that record has been shrinking. It cut dozens of staff after a 23 per cent budget reduction, reported in November 2024, and its 2026-27 appropriation, $36.576 million, is down from $39.753 million the year before, one outlet reports ³⁵³⁶.

Emails obtained by the ABC under freedom of information show that on a public-safety matter separate from the Triple Zero outage, Optus's failure to upload customer records to the emergency-services number database, ACMA told Optus a notice of $1.5 million to $3 million would sit at the lower end if it offered an enforceable undertaking, and sent it the draft announcement to check for factual accuracy ³⁷. Optus paid $1,501,500 and gave an undertaking ³⁸. ACMA says it only considers changes to a draft release that go to the accuracy of the facts in it ³⁹, and told the ABC that it does not negotiate the release's content ³⁷.

Correction, 25 September 2026. This article previously said released emails showed 'what leniency can look like from the inside', that ACMA sent Optus and Telstra draft press releases to "proofread" while they faced fines, and that Optus was fined $1.5 million. The Optus documents concern the IPND matter, Optus's failure to upload customer data to the database Triple Zero uses for caller location, not the Triple Zero outage notices; the two Telstra drafts concerned scams and overcharging. ACMA asked Optus for comment on factual accuracy. Optus paid $1,501,500 and gave an enforceable undertaking. ACMA says it will only consider changes that go to the accuracy of the facts, and told the ABC it does not negotiate release content.

04The state's own side

The state holds its own agencies to a looser reporting standard, and signs off its own access to people's data.

Access to a person's telecommunications metadata to enforce the criminal law is authorised not by a judge but by an officer inside the requesting agency. In 2024-25 there were 357,864 such authorisations under section 178 of the Telecommunications (Interception and Access) Act, part of 364,868 authorisations in total for existing telecommunications data across 21 agencies ⁴⁰. THE SURVEILLANCE RORT has already logged the wider ledger this scheme sits inside: 'The sunset that won't set' records a separate police power, the hacking powers, having its sunset moved to 2029 with nil attributed arrests.

Who signs the section 178 authorisations is lopsided towards police. Victoria Police made 136,155 of the 357,864 in 2024-25, NSW Police 126,775, the same figure 'The order that replaces the warrant' examines, and the Australian Federal Police 13,015. The country's two federal corporate and competition regulators used the power rarely by comparison: ASIC made 282, the ACCC 42, together 324, roughly one authorisation in 1,100 ⁴⁰.

Telecommunications carriers must keep that data to begin with, at an industry compliance cost the same report puts at $37,106,182.52 for 2024-25 ⁴⁰. The state's own identity checks run mostly through business too: the Document Verification Service was used 133,140,077 times in 2024-25 by 2,228 entities, 2,109 of them private sector ⁴¹.

Set against all of that, the Commonwealth's own standard for an agency reporting a cyber incident to the Australian Signals Directorate is as soon as possible, with no fixed number of hours, and the government's own cyber posture report found only 35 per cent of entities said they had reported even half of the incidents they observed on their own networks ⁸⁹.

When the state's own automated compliance scheme was wrong, it was wrong at scale: Robodebt sent false notices to roughly 443,000 Australians, the ABC reported ⁴². The Royal Commissioner's final report was blunt about what it had been ⁴³:

In March 2026 the National Anti-Corruption Commission found that two former officials, Mark Withnell and Serena Wilson, had engaged in corrupt conduct, and cleared Scott Morrison, Kathryn Campbell, Catherine Halbert and Annette Musolino ⁴⁴. As of March 2026, no one has been prosecuted: compelled evidence cannot be used against the officials who gave it, and the Commonwealth Director of Public Prosecutions says it never received a brief ⁴⁵. A second class-action settlement of $548.5 million, covering about 125,000 registered claimants, was approved on 23 June 2026 ⁴⁶.

A smaller, more recent version of the same shape sits in THE COMPLIANCE MACHINE: 964 people had 985 automated payment-cancellation decisions applied to them unlawfully, a different scheme to Robodebt but the same pattern, the state's own machine erring at scale. THE PRISON CONTRACT RORT shows it in miniature too: a published report on a contractor's failures carries no dollar figure.

Police have used the self-signed system outside its own authorisation as well. In July 2019 the ABC reported that ACT Policing had accessed metadata without valid authorisation thousands of times, including a further 3,249 instances police uncovered; no discipline or prosecution was reported ⁴⁷.

05Against the pattern

None of this means the state never restrains itself, or never reaches for a company with force. Three examples keep this piece honest.

Digital ID is voluntary by statute: anyone offered it 'must have the option to use alternative methods to access those services' ⁴⁸.

The law restricting under-16 access to social media places no penalty on children or their parents; the penalties sit on the platforms, and the company maximum was doubled in law to 300,000 penalty units, $109.2 million at today's unit value on our calculation, after five platforms were named for compliance concerns, though no platform fine has yet been reported ⁴⁹⁵⁰. The same law is the one 'The internet asks for ID' found had produced zero fines by the time it published; the higher ceiling arrived before the first one did.

The state has already reached for a compulsory tool against AI firms, for a different harm. In October 2025 eSafety issued mandatory legal notices to providers of AI companion chatbots, with financial penalties of up to $825,000 a day for non-compliance ⁵¹.

The state has put a compulsory duty on AI firms before, for a different harm. It was not written for this one.

06The empty row

Return to the empty row. On the government's account an OpenAI agent got inside a Services Australia system on 18 June 2026. No Australian law this desk could find gave the company a day, an hour, or a standard by which to tell anyone.

Correction, 25 September 2026. This article, its image caption and its image alt text previously said the government's first notice was 'its' email, which could be read as the government's own email. OpenAI sent the notice email, not the government.

Compare that to every row above it. A Centrelink recipient has fourteen days, or faces up to six months in prison, for a notice about a change in their own life. A bank moving money internationally faced a $1.3 billion penalty for not meeting a reporting duty it did have. A critical infrastructure operator has twelve hours. A business that pays a ransom has seventy-two. A Commonwealth agency reporting to its own government's cyber authority has as soon as possible, no fixed clock, and only 35 per cent of entities said they reported even half the incidents they saw. An AI company whose product entered a government system has none of it, because nobody wrote it.

Where Parliament wrote the duty, it bites, sometimes hard and often slowly. The duty that would have mattered here was never written.

What could fill that row, and how it has stayed empty this long, is the rest of this case. 'Nobody has to tell' sets out every duty this desk tested and found missing. Parliament returns on 12 October 2026; whether an AI incident-notification duty is even on its agenda is the first thing to watch.

If it's a rort, we cover it.