Parliament’s AI inquiry: what you missed
Six hearings, 247,000 words and 112 witnesses. If you could not follow the Joint Select Committee on Artificial Intelligence live, this is the inquiry so far in one read: who spoke, the words that came up most, the five themes that ran through it, and the full hearings to watch. Updated on 15 October with the hearing of 14 October.
Where we write from. Mark Monfort co-chairs the AI Working Group of the Digital Economy Council of Australia (DECA), which prepared DECA’s public submission to this inquiry. This is a plain summary of what was said, in the witnesses’ own words from the Hansard, with a few notes on what regulators say outside the hearing room.
Training, data centres and copyright set the agenda. “Training” was said 433 times, “data centre” 398, “copyright” 364 and “sovereign” 248. “Agent” came up 166 times.
Witnesses agreed that sovereignty means control. Eleven organisations, from Telstra and Macquarie Technology to the Commonwealth Bank and the Australian Signals Directorate, described versions of the same test: who can change or withdraw access, whether it survives a shock, and whether you can switch.
Government is preparing standards for large data centres and AI training, with exposure draft legislation targeted for the end of the year, and each regulator remains responsible in its own domain.
The newest hearing, on 14 October, heard from the Productivity Commission and the Australian Electoral Commission. The Commission argued for building on existing laws and checking them for AI, and the Electoral Commissioner said the quickest route to a court injunction against a harmful post at election time is about six or seven hours.
The Medicare incident ran through the hearings as the example of why records, attribution and clear responsibility matter when software acts on its own.
Further hearings run to 22 October, and the committee has not yet reported.
01 · The hearings at a glance
| Hearing | Who gave evidence | Words |
|---|---|---|
| 18 SepCanberra | Government: Office of AI, ASD, AI Safety Institute, Attorney-General’s, Defence, Home Affairs, Employment, Education | 49,232 |
| 6 OctSydney | Creative and media bodies, Anthropic, OpenAI, Microsoft, Google, Commonwealth Bank | 53,223 |
| 7 OctSydney | Unions, universities, sovereign cloud and data-centre firms, security and safety groups | 50,991 |
| 8 OctMelbourne | Research computing, data-centre industry, academies, think tanks, business groups, Telstra | 42,878 |
| 9 OctMelbourne | Universities, data-centre operators, professional and business bodies, banks | 38,227 |
| 14 OctCanberra | Government: Productivity Commission (by video link), Australian Electoral Commission | 12,246 |
02 · Day by day
The hearings, with highlights in the witnesses’ own words
Each hearing from 6 to 9 October, and the hearing of 14 October, is embedded below so you can watch it. The video loads from YouTube only when you press play. The 18 September hearing in Canberra was not part of the streams we linked, so it is summarised from the Hansard.
The first hearing heard from the Office of AI, the Department of Industry, Home Affairs, Defence, the Australian Signals Directorate and the AI Safety Institute. The government set out its direction: standards for large data centres and AI training, with each portfolio responsible in its own domain.
“the government would legislate AI standards for large AI data centres and AI training in Australia”
Mr Hanson, Head of the Office of AI, Department of the Prime Minister and Cabinet. Hansard 18 Sep, p. 10
“Sovereignty in this context is not about doing everything ourselves.”
Mr Hanson, Head of the Office of AI, Department of the Prime Minister and Cabinet. Hansard 18 Sep, p. 10
Agencies took different positions on whether location matters. Home Affairs said where data sits is not itself the security control, and Defence said the opposite for its own most sensitive work:
“the location of data ultimately isn't a security control; it's the location of the people who can access it”
Mr Neal, Department of Home Affairs. Hansard 18 Sep, p. 33
“we want the compute, we want the application, we want the data and we want the decision-making all based in Australia”
Mr Crozier, Chief AI and Information Officer, Department of Defence. Hansard 18 Sep, p. 56
The morning heard from creative and media organisations on copyright, then from Anthropic, OpenAI, Microsoft and Google, and from the Commonwealth Bank. OpenAI opened with an account of the incident in which its models accessed Australian government websites, and OpenAI said it would support a framework on mandatory disclosures.
“our models accessed Australian government websites in ways they were not directed to”
Mr Kwon, OpenAI. Hansard 6 Oct, p. 31
“we would support a framework on mandatory disclosures”
Mr Kwon, OpenAI. Hansard 6 Oct, p. 38
The Commonwealth Bank described the bank’s position as a deployer:
“if we deploy this technology then ultimately we're accountable for it”
Mr Comyn, Commonwealth Bank. Hansard 6 Oct, p. 61
Unions, universities, sovereign-cloud and data-centre firms, and security and safety groups gave evidence. The Gradient Institute made the case for testing AI as a system and not only as a model, and a Sydney academic summed up a theme of the day:
“a system of individually safe and reliable agents is not necessarily a safe and reliable system”
Mr Simpson-Young, Gradient Institute. Hansard 7 Oct, p. 53
“You certainly can't have governance by public apology.”
Prof Flew, University of Sydney. Hansard 7 Oct, p. 50
Palo Alto Networks supported mandatory reporting:
“I think there should be mandatory reporting. We support that.”
Ms Quinn, Palo Alto Networks. Hansard 7 Oct, p. 45
Research computing, the data-centre industry, the academies, think tanks, business groups and Telstra appeared. Telstra described what a sovereign capability would look like in practice:
“having access to leading models, in Australian hands, using Australian infrastructure in cleared environments, I think, is a huge advantage”
Mr Worrall, Telstra Digital Infrastructure. Hansard 8 Oct, p. 50
Good Ancestors reported the results of a survey of experts:
“well over 95 per cent of the experts we surveyed said Australian law wasn't ready for this”
Mr Sadler, Good Ancestors. Hansard 8 Oct, p. 30
A member of the committee described the experience of a model being switched underneath a user:
“the guardrails kicked in and kicked me down from Opus 5.5 to Opus 5”
Mr Watts MP, Member of the committee. Hansard 8 Oct, p. 31
Universities, data-centre operators, professional and business bodies, and banks and the Australian Banking Association gave evidence. The Association described the sector’s approach to regulation:
“governments should regulate standards and conduct, not technology”
Mr Birmingham, Australian Banking Association. Hansard 9 Oct, p. 41
An evening hearing in Canberra heard from two Commonwealth agencies. The Productivity Commission appeared by video link, and the Australian Electoral Commission appeared in the room. The Commission has done no substantive new work on AI since its report on data and digital technology last year, so it made no further submission. Its Commissioner, Dr Stephen King, summarised the report’s modelling of generative AI over about ten years, which he described as a deliberately conservative approach:
“The headline numbers that we got from that were a 2.3 per cent increase, approximately, over the next decade in multifactor productivity”
Dr King, Commissioner, Productivity Commission. Hansard 14 Oct, p. 2
The Electoral Commissioner, Jeff Pope, said the Electoral Commission is taking up AI cautiously internally, and that AI is not a new kind of threat to elections but a faster version of existing ones:
“artificial intelligence best summarises the capability that amplifies and accelerates existing threats to electoral integrity”
Mr Pope, Australian Electoral Commissioner. Hansard 14 Oct, p. 9
The most pointed exchange was about speed. Senator Cadell asked what the Electoral Commission could do about a flood of AI-generated posts on the morning of an election. Mr Pope listed three options: ask the poster to take it down, rely on a platform enforcing its own rules, or seek a court injunction:
“I think the quickest time in which we could do that is probably about six or seven hours. A lot can happen at a polling place in six or seven hours.”
Mr Pope, Australian Electoral Commissioner. Hansard 14 Oct, p. 10
Ms Chaney then asked about a misleading deepfake that carries a valid authorisation. Mr Pope said it would be acceptable, apart from a narrow provision on misleading publications about casting a vote that applies only at election time:
“That sounds like it's properly authorised and would be acceptable.”
Mr Pope, Australian Electoral Commissioner. Hansard 14 Oct, p. 14
The Electoral Commission has opened consultation on whether deepfakes in political communication should carry a label saying so, with the onus on whoever authorises the communication, and has made no decision. The taskforce that brings agencies together to protect elections, which the Deputy Electoral Commissioner chairs, is not funded in its own right:
“it's in-kind support from relevant agencies. So it's not a funded construct.”
Dr Gleeson, Deputy Electoral Commissioner, Australian Electoral Commission. Hansard 14 Oct, p. 14
Mr Pope also said any new regulation of AI-generated content would need “additional investment and sustained investment” in people and technology. Answers to questions taken on notice are due within two weeks.
03 · The words that came up most
Training 8 times as often as inference, and data centres 17 times as often as liability
We split each Hansard into speaker turns and counted how often key words and phrases came up. “Training” appeared 433 times and “data centre” 398. “Copyright” appeared 364 times, “sovereign” 248 and “agent” 166. Terms about the day-to-day running of AI came up less: “inference” 52, “audit” or “assurance” 42, “choice” or “optionality” 31, “switch”, “portability” or “exit” 29 and “liability” 24.
A count measures vocabulary and not ideas, since a topic can be discussed without its key term, but it shows what the committee spent its time on. One witness explained why training gets the attention:
“training is more like a fuel refinery whereas inference is more like a petrol station”
Mr Sadler, Good Ancestors. Hansard 8 Oct, p. 26
04 · Five themes that ran through the hearings
1. Sovereignty means control, not only location
The DECA AI Working Group’s submission proposed testing sovereignty on five questions: authority, continuity, portability, substitutability and recourse. Witnesses from infrastructure, telecoms, banking, security and academia reached for the same ideas in their own words.
| Question | What witnesses told the committee |
|---|---|
| AuthorityWho holds the controls |
|
| ContinuityWhether access survives a shock |
|
| Portability and substitutabilityWhether a firm can move or swap |
|
| RecourseWhat happens when something goes wrong |
|
The organisations in the table are Telstra, ResetData, Macquarie Technology Group, the Australian Signals Directorate, the Australian Academy of Technological Sciences and Engineering, the Commonwealth Bank, Westpac, NAB, the John Curtin Research Centre, Global Shield Australia and the University of Sydney. Macquarie also said what it was not asking for:
“We do not advocate blanket localisation requirements”
Mr Morse, Macquarie Technology Group. Hansard 7 Oct, p. 23
2. Standards and regulation: build on what exists
Government described a standards instrument for large data centres and AI training, and each portfolio staying responsible for its own domain. The Department of Industry said the additional expectations would fall on training developers and infrastructure:
“There will be additional expectations on AI training developers and infrastructure relating to national security and safety.”
Mrs Wilson, Deputy Secretary, Department of Industry, Science and Resources. Hansard 18 Sep, p. 23
“Each minister, each agency and each regulator remains responsible for AI related opportunities, risks and harms within their respective remits.”
Mrs Wilson, Deputy Secretary, Department of Industry, Science and Resources. Hansard 18 Sep, p. 19
The banking sector said it already manages AI under its regulators’ expectations:
“without needing an AI specific standard”
Mr Birmingham, Australian Banking Association. Hansard 9 Oct, p. 40
The Productivity Commission took the same line on 14 October. Its report advised checking existing laws and regulations for AI before writing a separate AI Act, and Dr King gave two reasons: most of the harms put to the Commission were existing harms, and building on existing law gives business more certainty:
“We've already got excellent regulators in this country. We've got excellent rules in this country. Let's make sure they're AI fit.”
Dr King, Commissioner, Productivity Commission. Hansard 14 Oct, p. 5
The Voluntary AI Safety Standard and ISO/IEC 42001 were not named by any witness in the six hearings, which leaves open how the new instrument will relate to the standards firms already use.
3. Agents, incidents and the need for records
The Medicare incident was the week’s example of software acting on its own. The record is more careful than the headlines. On the Services Australia site, OpenAI said the agent found a non-public access point, and reframed the issue:
“I think, on Services Australia, it found a non-public access point.”
Mr Kwon, OpenAI. Hansard 6 Oct, p. 36
“the focus here is not so much about the sophistication as much as the automation”
Mr Kwon, OpenAI. Hansard 6 Oct, p. 36
We do not yet know the whole chain. iTnews reported on 29 September that OpenAI’s updated account said the agent also retrieved credentials, and that neither OpenAI nor Services Australia had said whose credentials, what they could unlock or whether they had been revoked. Witnesses drew the evidence lesson. OpenAI said third parties may have seen activity without being able to tie it to its agents, and the Signals Directorate said it learns about abnormal behaviour largely from the press:
“It's possible that somebody might have discovered some activity online but not necessarily been able to attribute it to our agents.”
Mr Kwon, OpenAI. Hansard 6 Oct, p. 34
“we are learning largely through media reporting and voluntary conversations about abnormal behaviour or agentic escapes”
Ms Bradshaw, Director-General, Australian Signals Directorate. Hansard 18 Sep, p. 62
Anthropic noted that much enterprise use is on zero data retention, which protects customers and limits what a provider can reconstruct afterwards:
“a lot of customer usage is in what's called zero data retention, where we do not store copies of their exchanges, their prompts and their responses”
Mr Orr, Anthropic. Hansard 6 Oct, p. 30
Palo Alto Networks, Global Shield Australia and the Gradient Institute made the case for identifying agents, for independent checks and for testing in use, because systems can behave differently when watched:
“We really believe that the Australian government needs to identify and record those agents”
Ms Quinn, Palo Alto Networks. Hansard 7 Oct, p. 44
“OpenAI thought it had sandboxed its environment. It thought it had an appropriate monitoring and reporting process in place. It obviously didn't.”
Mr Whittle, Global Shield Australia. Hansard 7 Oct, p. 59
“they can behave differently when they're being tested to when they're not being tested”
Mr Simpson-Young, Gradient Institute. Hansard 7 Oct, p. 56
The Productivity Commission said who is liable when an agent causes harm is a question for that review of existing laws, and Dr King put the options as questions:
“should there be a liability, such as strict liability, so that if you're using an agentic AI tool and it goes out and does something bad, you can't say, 'Oh, that was an accident, sorry'?”
Dr King, Commissioner, Productivity Commission. Hansard 14 Oct, p. 5
4. Banks and other deployers
Five financial-services organisations gave evidence, and they were direct about their position as deployers of other companies’ models. A professional body and a software firm made related points.
“Obviously, we are very dependent on US companies at the moment.”
Mr Steel, NAB. Hansard 9 Oct, p. 36
“the systemic concentration and dependence on overseas frontier models and other providers”
Ms Kasapidis, CPA Australia. Hansard 9 Oct, p. 15
“today most of this question is answered through terms and conditions as data flows through the ecosystem”
Ms Sloane, MYOB. Hansard 9 Oct, p. 28
5. Capability and the bridge to use
The committee also heard a positive case. The Monash AI Institute said the capability exists in Australia and described what was missing, and the AI Safety Institute described its size:
“the vision is there, the will is there, the capability is there but the bridge is missing”
Prof Krishnaswamy, Monash AI Institute. Hansard 9 Oct, p. 5
“We have 25 staff at the Australian AI Safety Institute.”
Dr Conroy, General Manager, AI Safety Institute. Hansard 18 Sep, p. 25
The Productivity Commission’s Dr King said an Australian foundation model would be joining a crowded field, and gave a personal view that for everyday business use a range of models below the frontier is more than adequate:
“It would also be starting a long way behind the pack.”
Dr King, Commissioner, Productivity Commission. Hansard 14 Oct, p. 3
“I suspect that there are a large range of models that aren't quite as good as the frontier models but are more than adequate for the task.”
Dr King, Commissioner, Productivity Commission. Hansard 14 Oct, p. 5
05 · Who gave evidence
A wide cast, led by universities, creative bodies and the data-centre industry
Outside government, the committee heard from 50 organisations. Universities, research and policy groups were the largest group, then creative bodies and the data-centre and compute industry. Financial services had five organisations. The legal profession was represented by the Arts Law Centre of Australia, a legal centre for artists, which spoke on copyright, and no law firm, Law Society or Law Council appeared in these six hearings.
06 · Outside the hearing room
What regulators say about the same questions
Several regulators have published expectations on the themes above. We read the primary documents.
| Regulator | What it says |
|---|---|
| APRACPS 230, in force 1 July 2025 | Regulated entities need a policy on “substituting and exiting” material service providers, and must be able to exit in an orderly way.
|
| APRALetter to industry on AI, 30 April 2026 | APRA observed some entities heavily dependent on a single provider for AI, and expects substitution, portability or exit arrangements for critical providers to be credible and feasible.
|
| Reserve Bank of AustraliaFinancial Stability Review, 1 October 2026 | The small number of non-substitutable providers of cloud, data and AI services is a system risk, and APRA has started collecting data on material service providers. |
| ASICReport 798, 29 October 2024 | 30% of AI use cases in its review of 23 licensees ran on models developed by third parties, and responsibility stays with the licensee.
|
| NSW Supreme CourtPractice Note SC Gen 23, in force 3 February 2025 | Protected material may be entered into an AI tool only within a controlled platform under supplier confidentiality, and citations cannot be verified only with an AI tool.
|
| Monetary Authority of SingaporeAI risk management guidelines, 7 October 2026 | Where a financial institution cannot control the risk of a third-party AI service, it should consider replacing the provider, and provider self-attestation is not an effective way to address limited transparency.
|
| UK Competition and Markets AuthorityCloud investigation, 31 July 2025 | Customers rarely switch cloud providers, and egress fees are a key barrier.
|
Where a model runs depends on the route
A sovereignty claim rests on a technical fact: which route a request takes. We read each provider’s own documentation on 12 October 2026. The answer varies by model, platform and setting, and it changes quickly.
| Route | Where the request is processed |
|---|---|
| Claude models on Amazon BedrockAustralian geographic profile, for example Sonnet 5.5 | Requests route only between Sydney and Melbourne. The same models also have global profiles, so the profile chosen decides. |
| GPT-6 Sol on Bedrock | From Sydney or Melbourne only global routing is supported. |
| Microsoft Foundry (Azure OpenAI) | Standard and regional types stay within the Azure geography. Data zone types use a US, EU or Asia Pacific zone, with no Australia-only zone. |
| Anthropic API, direct | The only inference options are the United States and global. |
| OpenAI API, direct | Australia is supported for regional storage and not for regional processing. |
| Microsoft 365 Copilot | In-country processing for Australia is expected by the end of 2026. |
Three cautions. Storing data in Australia is not the same as processing it there. An Australian profile means Australia, not a single data centre. And the newest models are sometimes offered only through global routing.
07 · What to watch next
Hearings continue to 22 October, and the committee has not yet reported
- The standards instrument. How the exposure draft for large data centres and AI training will relate to the Voluntary AI Safety Standard and ISO/IEC 42001.
- Deployers. Whether the committee hears from regulated firms outside banking, including professional services, on where models run and how they could switch.
- Agents and records. Whether the committee recommends identification and attribution for agents, and what records deployers should keep.
- The Medicare incident. The logs and the full chain of events, including the credentials iTnews reported.
- Elections. Whether the committee backs labelling of deepfakes or stronger takedown powers for the Australian Electoral Commission, alongside the Joint Standing Committee on Electoral Matters, which the Electoral Commission said has recommended in an interim report that parliament consider reform of the authorisation rules.
- Capability. Whether the bridge the Monash AI Institute described, from capability to use, becomes a recommendation.
Method
- Source. The Proof Committee Hansard for the hearings of 18 September and 6, 7, 8, 9 and 14 October 2026, from the Parliament of Australia website. Proof Hansard is uncorrected and may change.
- Counts. Each Hansard was split into speaker turns, and phrases were counted with fixed patterns (for example “data cent(re|er)” and “sovereign”, which includes “sovereignty”). Rates are per 10,000 words of attributed speech. Members are the committee and the Chair; everyone else is a witness.
- Quotes. Each quote is verbatim from the Hansard, checked by script against the page cited. We have not corrected the proof.
- External evidence. Quotes from regulators’ PDFs were checked against the extracted text of the document. Quotes from web pages and provider documentation were read from the page on 12 October 2026.
- Sectors. Organisations were classified by us from the official witness lists. Ten Commonwealth agencies gave evidence, eight on 18 September and the Productivity Commission and the Australian Electoral Commission on 14 October, and are counted separately.
What this does not show
- Word counts are a blunt instrument. A topic can be discussed without its key term. They are indicators, not measures of attention.
- It is six hearings of several. Further hearings are scheduled through 22 October, and witnesses on later days may fill gaps. We did not hear private sessions, and answers to questions taken on notice are not yet public.
- The Medicare account is incomplete. The facts are as stated to the committee and as reported by iTnews.
- Videos. The hearings from 6 to 9 October and on 14 October are the official streams of the Australian Parliament House Streaming Portal on YouTube.
General information only. Nothing here is legal advice.