PwC welcomes new AI safety measures to support adoption at scale

Tuesday, 10 November 2026

PwC Australia has welcomed the Federal Government's new mandatory AI safety and security protections, and said their success will depend on a cohesive approach that brings together Australia's regulatory frameworks and can be enforced consistently across jurisdictions.

The protections, announced alongside the Rapid Review into the AI-driven cyber incident affecting Services Australia, include independent model evaluation, rapid incident notification and a new AI safety regulator with the power to impose significant penalties. 

PwC Australia chief executive Kevin Burrowes said the announcement was an important step towards realising Australia's economic opportunity from AI.

PwC Australia's Digital and AI Trust Leader, Nicola Costello, said integration across regulators will be critical, to ensure the new protections work seamlessly with existing frameworks.

"The new AI safety regulator will join several regulators that already have a stake in how AI is used. To reduce duplication and unintended grey areas, an integrated and cohesive approach will be critical. This means setting clear expectations once and then applying them consistently across sectors, in line with existing and recognised standards," Ms Costello said.

"With the most advanced AI models being built offshore, having the ability to enforce these new rules will also be important. This includes working alongside the regulatory regimes of our international counterparts, and having an enforcement capability that matches the scale and speed of the technology it oversees.”

Ms Costello said the recent AI-driven cyber incident shows that the lessons apply beyond frontier developers.

"Every organisation deploying AI agents should know which agents are operating in its systems, what they are authorised to do, who is accountable for their actions, and how quickly they can be stopped. Having clear oversight and verifiable evidence that these controls work in practice will be essential to building confidence among businesses, regulators and the public."

PwC Australia cybersecurity and privacy partner Rob Di Pietro said the Rapid Review made clear that AI risk is now an operational resilience and governance issue.

"An AI agent probing for access behaves much like any other attacker, only faster and more persistently. The review's call to get back to cyber basics, reduce exposed systems and use AI in defence applies just as much to the private sector. Organisations may need to treat misbehaving agents as security incidents by detecting, containing and reporting them quickly, including near misses," Mr Di Pietro said.

In its submission to the Joint Select Committee on Artificial Intelligence, PwC Australia recommended a standing regulator coordination mechanism so that economy-wide AI expectations are set once and applied consistently by sector regulators. It also recommended clear rules for AI agent identity and authorisation, and that any mandatory guardrails be anchored in a recognised assurance framework.