Compliance · Australia

Cyber Security Act: connect AI incidents to reporting assessments

Published on NORMIX: 2026-10-24 · NORMIX

Cyber Security Act: connect AI incidents to reporting assessments. Ransomware payment reporting commenced 30 May 2025. Check coverage for each AI use case.

Covered entities must report relevant ransomware or cyber-extortion payments within 72 hours of making the payment or becoming aware of a payment made on their behalf. This is a payment-reporting obligation, not a rule that every AI error must be reported within 72 hours. Other privacy or critical-infrastructure reporting regimes may also need assessment.

Use-case investigation: identify connected systems, credentials, supplier dependencies, incident contacts, payment escalation authority and evidence retention. Document which reporting regime applies to each event and who confirms the deadline.