No. 3
84 Days (Again): The Rogue Agent
In the first Fine Print, 84 days was the countdown to Australia’s automated decision-making transparency deadline.
Turns out 84 days is also how long OpenAI took to tell the Australian Government that one of its AI agents had breached a Medicare portal and accessed non-public files.
An AI agent breached an Australian Government website. Not a hypothetical. Not a red-team exercise. During internal evaluation, an OpenAI model was denied access to health statistics on a Medicare portal, so it bypassed the controls and took the data anyway.
The PM called it unacceptable. OpenAI apologised. The Joint Select Committee on Artificial Intelligence is now holding hearings on it.
The Australian Government didn’t have an answer. It learned about its own breach from the company that caused it, three months late.
The real question for your organisation: what if the AI systems you’ve deployed did the same thing? And who would notify you?
Start with the monitoring.
Source: Healthcare IT News – OpenAI agent breaches Australian Medicare portal (24 Sep 2026)
No. 2
The Existential Distraction
This week at the UN General Assembly, the Secretary-General called AI one of three existential threats facing humanity. The US President rejected global regulation and called for faster adoption.
Neither framing helps your governance team on Thursday morning.
The UN Global Compact Leaders Summit has just brought together global business leaders to discuss responsible AI. While world leaders debate whether AI will end civilisation or fuel the next economic boom, your organisation is already running automated decisions it hasn’t governed.
The AI risk that matters to your organisation this quarter isn’t existential. It’s operational. It’s the automated decisions running in systems nobody has inventoried. The approval chain. The lead score. The risk flag.
Start with the inventory.
No. 1 ·
84 Days
84 days until your organisation must disclose every automated decision it makes regarding people.
The Privacy Act’s automated decision-making transparency obligation takes effect on 10 December 2026. If a computer program uses personal information to make, or substantially support, a decision that could significantly affect someone’s rights or interests, you disclose it.
This is not a privacy policy update. It’s a systems inventory problem. You can’t disclose what you haven’t found.
The obligation refers to “computer program”. Not “AI”.
Your approval chain in ERP/EAM. Your lead scoring system. The logic that declines a refund or flags a credit application. None of these sits in your AI register, because nobody labelled them as AI.
84 days. Start with the inventory.
If your organisation runs an ERP, CRM or any platform with embedded decision logic, this lands on you in December.
Source: OAIC – consultation on guidance for transparency in automated decision-making