Security News

Who Pays When an AI Agent Gets It Wrong? Australia's AI Inquiry Leaves the Question Open

Key Takeaway Until accountability for AI agents is settled, limit the permissions you give them, especially for payments, and keep a human approval step for financial actions.

A review of evidence given to the Australian Parliament's Joint Select Committee on Artificial Intelligence has found broad support for AI, but continuing uncertainty over accountability when AI agents act for consumers. The concern includes cases where an agent stays within the permissions it was given but does something the user never intended.

The 106-page report, AI on Australia's Terms, was published by the Sydney-based Humanware Institute, with Kate Cooper as principal author. It analysed 564 public submissions, ten hearing days and 66 answers to questions on notice, representing 575 contributors. According to the report, nine financial-system institutions gave evidence, including three major banks, their peak body, four regulators and Treasury. When asked who is responsible in that scenario, "none said who carries the loss". The report argues existing law applies to AI, but how it applies here is contested or untested.

The report also cites evidence that Mastercard reported Australia's first authenticated agent transactions in January 2026, in trials on two major banks' cards. It notes the Reserve Bank's Review of Payments System Regulation, which it says covers agentic commerce, is due to announce conclusions in 2028. Overall, 367 of 575 contributors supported AI, and 290 of those attached conditions. Cooper said contributors "mostly said yes to AI. Then they set terms."

AI agents accountability Australia payments regulation
Answering to more than one framework? Run them as one security and AI governance programme ->

Summarised by CISO AI from Australian Cyber Security Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.