On 15 September, the ABC's Cam Wilson reported that the Director-General of the Australian Signals Directorate, Abigail Bradshaw, had told the Australian Strategic Policy Institute's Sydney Dialogue that Australia has no formal early-warning system for AI incidents. Her words were precise: "What we are missing at the moment, which we have in a cyber context but we don't yet have it formalised in an AI context, is an early warning system." She went on to argue that individual incident reports, aggregated across intelligence agencies and AI companies, would reveal patterns no single organisation can see on its own, and that the exposure is not confined to cyber; biotechnology was the example she reached for. Read quickly, this is a story about a reporting obligation that is coming. Read properly, it is a story about a capability almost no Australian board currently has.
The instinct in most boardrooms will be to treat this as an extension of the cyber regime, partly because that is the analogy Bradshaw herself used and partly because the machinery already exists. That instinct is wrong, and it is worth being exact about why. Cyber incident reporting works because a cyber incident has a shape. Something was bypassed. A perimeter was crossed, a credential was misused, a system behaved in a way it was not configured to behave, and somewhere there is a log entry recording the moment. The detection stack has something to find. An AI incident frequently has none of that. The agent held the permissions it was granted. It called the tools it was permitted to call. It produced an output inside its operating envelope and caused harm anyway. Nothing failed, which is precisely why nothing alerts.
The gap is already measured, though not yet in Australia. EY's September survey of 202 senior AI executives at companies with revenue above a billion dollars found 91 per cent already running agentic AI, 49 per cent conceding their governance frameworks had not been updated for agentic risk, and 26 per cent admitting they could not detect unauthorised AI agents operating inside their own organisations. That last figure is the one to take to a board. An organisation that cannot enumerate its own agents cannot scope an incident, cannot attest to a control, and cannot answer an auditor. Meanwhile Capital Brief has reported that Home Affairs is considering mandatory reporting where a security incident arrives via an AI agent. The responsible agency, the scope and the timeline are all unspecified, so treat that as a signal rather than a deadline. The direction of travel is not ambiguous, and voluntary vendor disclosure is converging on it from the other side, with OpenAI now publishing its own framework for reporting model misalignment incidents.
Then there is the aggregation point, which is the part of Bradshaw's proposal directors should sit with longest. She is not proposing a filing cabinet. She is proposing that the Commonwealth assemble a picture out of many organisations' incidents in order to see the pattern inside them. Two consequences follow for a board. The first is that you may learn you were part of a pattern from a national agency rather than from your own monitoring, which is a lagging indicator arriving with no leading indicator in front of it. The second is that whoever reports first will shape what an AI incident is taken to mean for everyone who reports after them. Section 180 of the Corporations Act sets the standard as the care a reasonable person in that director's position would exercise, and it scales with the regulatory environment the entity sits in. Centro settled the point that acting in good faith is no answer to a failure to inform yourself. A director of an organisation running agents in production, in a year when the national signals agency has said in public that the warning system does not exist, is expected to know whether their own one does.
- If one of our agents did something we would have to report, what exactly would alert us, and how long would it take? I want the name of the control and the name of the person who sees the alert, not an assurance that we would know.
- Can management produce a complete register of AI agents running in this organisation, including the ones a business unit stood up without going through technology? If that register cannot be produced, the honest answer to the previous question is nothing, and never.
- We have a definition of a cyber incident and an escalation threshold that goes with it. What is our definition of an AI incident, who drafted it, and when did this board approve it rather than note it?
- Where an agent operates entirely within its granted permissions and still causes material harm to a customer, which of our three lines of defence is responsible for finding that, and would they currently be looking?
- If the Commonwealth told us tomorrow that we had featured in a pattern of AI incidents assembled from other organisations' reports, what would our honest reaction be: confirmation, or news?
- AI incident detection assigned to the cyber function on the assumption that the tooling transfers. The security operations centre watches for things that break, and an agent acting within its permissions does not break anything, so it will not appear.
- An AI policy that specifies acceptable use but never defines an incident. A policy that cannot tell anyone when to escalate is a statement of intent, not a control.
- An agent register maintained by the same team that builds the agents. Where the first line owns both the deployment and the record of deployments, the second line has nothing independent left to test.
- Comfort drawn from the fact that no AI incident has been reported internally. In an environment with no detection capability, a clean record is not evidence of a clean environment, because it is the expected output either way.
- Relying on the model vendor to tell you. The vendor observes its own system, not your agent's effect on your customer, and its disclosure framework is voluntary and of its own design.
- Treating this as a 2027 problem because no obligation has been legislated yet. The detection capability takes quarters to build and the reporting procedure takes a fortnight to write, and most organisations will find they sequenced those two the wrong way round.
The opportunity here is timing, and it is unusually clean. Bradshaw has described the gap in public, no obligation has yet been drafted, and a board that moves now does the work on its own terms rather than to someone else's template. The first deliverable is cheap: a definition of what this organisation will treat as an AI incident, agreed by the board, tested against three or four plausible scenarios, and written down. Everything else follows from it, because a detection requirement you can specify is a detection requirement engineering can actually build. There is a second and quieter advantage. Organisations that report early into a national aggregation scheme help set the norms of what gets reported and how, and they build a working relationship with the agency before the day they need one. Being early to a regime like this has consistently been cheaper than being caught by it.
The risk is that the work gets filed with cyber security and quietly disappears. It is the obvious home for it, the team is competent, and the analogy holds well enough to be persuasive for about a quarter. What follows is a board receiving a monthly AI incident report showing zero incidents, drawn from a monitoring stack that was never capable of finding one, and mistaking the silence for safety. That is a worse position than having no report at all, because it converts an open question into a closed one. The sharper exposure arrives later. When an obligation does land, the organisation will have to state what it detected and when, and any gap between the assurance this board was given and the events that actually occurred stops being an operational miss and becomes a documented failure of oversight.
Do not wait for the obligation, and do not hand this to the security function as a technology problem. Ask management for three things at the next meeting and put a date against each: a complete register of AI agents running in the organisation, including the ones stood up outside technology, with a named accountable owner on every line; a written definition of what this organisation treats as an AI incident, carrying an escalation threshold this board has approved rather than noted; and a straight answer on what would detect one, naming the control and naming the person who sees the alert. Then test that definition against a scenario in which an agent behaves entirely within its permissions and harms a customer anyway, because that is the case the cyber playbook cannot see and it is the one you will be asked about. If the register cannot be produced this quarter, that is the finding, and it belongs in the minutes as one rather than on a list of things to tidy up. The national signals agency has now said in public that the warning system does not exist. A board that has not asked whether its own does is relying on a silence it has no reason to trust.
Researched and drafted by Brad's agentic AI team. Edited and published by Brad Ferris.