Andrew Charlton stood at UTS earlier this month and instructed Australian companies they had been standing at a sliding doors moment.
Purchase Australian AI, or turn out to be a everlasting renter of intelligence from overseas. He used the economist Justin Wolfers’ thought experiment to make the purpose:
Think about a employee, an employer, and an AI that does the employee’s job. If the employee owns the AI, productiveness rises and everybody wins. If the employer owns it, the positive factors are cut up. If a overseas firm owns it with monopoly energy, the employee loses the job, the employer is barely higher off, and the worth flows offshore.
Three days later, Alastair MacGibbon wrote in the AFR that the rulebook each Australian board has been working on is damaged. Anthropic’s Mythos and OpenAI’s GPT-5.5 can now autonomously chain vulnerabilities a human knowledgeable would take 20 hours to use, they usually can do it for a couple of {dollars} in tokens.
The UK authorities’s AI Safety Institute confirmed it. Inside a fortnight of Mythos being introduced, Anthropic was investigating reviews that unauthorised customers had already accessed it by means of a third-party portal. The containment failed on the beginning gate.
Australia was not within the coalition that received entry first. Australia is, in MacGibbon’s phrases, not well-defended.
The argument they’re circling
Charlton needs the non-public sector to behave. MacGibbon needs authorities to behave. Each are proper. Neither is sufficient.
The argument they’re each circling with out fairly naming is institutional. Everyone keeps calling AI infrastructure. The Microsoft dedication final month was framed as infrastructure funding. The info centre frameworks Charlton’s division revealed in March had been written for infrastructure. The Treasury convenes financial institution CEOs over AI cyber threat as a result of the menace is now systemic. Charlton himself referred to as intelligence the brand new oil.
Australia is aware of tips on how to regulate infrastructure. Telecommunications has the Telecommunications Business Ombudsman, statutory, obligatory, enforceable, created in 1993 as a result of a deregulating market wanted a dispute decision physique that might really compel issues. It has the ACCC for pricing. It has ACMA for compliance. Power has the Australian Power Regulator. Water has utility frameworks. When Optus went down for fourteen hours in 2023, it triggered a Senate inquiry, a regulatory assessment, and reporting obligations that didn’t beforehand exist.
When Microsoft’s Azure OpenAI endpoint went down for twenty hours throughout seven areas in early March, together with Australia East, main Australian enterprise clients obtained zero communication. No real-time alert, no standing replace, no acknowledgement. The outage was detected, fastened quietly, and by no means publicly addressed.
There is no such thing as a AI ombudsman. There is no such thing as a AI pricing regulator. There aren’t any uptime mandates. There aren’t any outage reporting obligations. There is no such thing as a statutory physique any Australian buyer can complain to when a overseas lab shuts down their accounts with out clarification, or quietly degrades the mannequin they pay for, or raises costs as soon as the workflow is embedded.
The Commonwealth has completed genuinely helpful work on procurement, and Charlton introduced extra of it in a single day. The foundations now require companies to method Australian companies first under the Free Commerce Settlement threshold. The streamlined procurement threshold has been lifted to $500,000. Procurements valued at $1 million and above should take into account financial profit to the Australian financial system as a part of the value-for-money evaluation. The Purchase Australia Plan is being augmented to prioritise native AI distributors. Tech bosses from the nation’s greatest companies are being convened this month to make the case immediately. These are actual levers. They present what Australian authorities can do when it decides AI procurement issues.
What there’s not, but, is the regulatory structure that every other piece of nationwide infrastructure already has. The Australian AI Security Institute was introduced in November 2025 with $29.9 million in funding. Speculated to be operational early 2026. Advisory solely, no enforcement energy. As of MacGibbon’s piece on Monday, it nonetheless has not publicly stood up.
That is the hole New Dialogue is constructing to bridge. Not by changing the establishments that ought to exist, however by giving Australian organisations a approach to keep sovereign over their knowledge and platform-agnostic about what runs on high of it, whereas we anticipate the regulation to catch up.
The error we already made
Australia spent fifteen years treating social media as shopper software program. The eSafety Commissioner got here in 2015. The On-line Security Act in 2021. The under-16 ban in 2024. Every was a retrofit, after the externalities had already formed public life, after the leverage had already moved offshore, after the sample was seen to everybody.
The sample was all the time the identical. Construct the infrastructure first, regulate it as soon as the hurt is simple. Deal with the factor as a product when it fits the suppliers. Deal with it as infrastructure when it fits the speaking factors. Keep away from constructing the establishments that will really do the regulating till the politics pressure the difficulty.
We’re working the identical play with AI, sooner. Charlton’s procurement push asks the non-public sector to lean Australian. MacGibbon’s resilience push asks vital infrastructure operators to harden defences and authorities to barter entry to frontier functionality. Each are crucial. Each are non-public sector workarounds for a public failure.
If AI is infrastructure, regulate it like infrastructure. Create the physique that may compel uptime reporting. Construct the dispute decision scheme any Australian organisation can use when a overseas lab makes a unilateral resolution that breaks their workflow. Give the Security Institute tooth. Stand it up. Rent the director. Publish the principles.
The second the dialog shifts from “ought to companies lean Australian” to “what infrastructure regulation does AI really require” is the second Australia stops carrying the load alone.
Yet one more factor
Invoice Withers wrote Lean on Me in 1972, three years after he stopped working in a manufacturing unit making bathroom seats for 747s. He as soon as instructed an interviewer the music was in regards to the small West Virginia city he grew up in, the place if your own home caught fireplace the neighbours confirmed up with buckets, as a result of no one was coming in the event that they didn’t.
The music just isn’t about feeling supported. It’s about who really reveals up when your own home is on fireplace.
Now we have spent two months watching Australia announce frameworks, signal memoranda, host visiting CEOs, and publish strategic plans. The Security Institute was funded in December and is meant to be operational early this 12 months. The plan was revealed. The procurement guidelines had been up to date. The speeches got.
The place are the neighbours with these buckets?
