Make breach disclosure a condition of purchase

An AI agent walked into a Commonwealth government portal this year, read material it had no authorisation to read, and the Commonwealth found out months later. Australia is now asking whether the law was broken.

Strip the novelty away and what remains is a vendor-risk question every executive already knows how to answer. A supplier that conceals a breach of your systems should fail your next security assessment by default, and the fact that the supplier builds AI models does not change the discipline; it only tests whether you apply it.

Governments are the largest buyers in the economy, and procurement is the one lever that needs no new legislation. If breach disclosure became a pass/fail condition of selling to government, concealment would stop paying overnight. Every government that keeps buying while asking for nothing more than a statement tells every vendor that concealment is free.

I write The Perp Walk, a short weekly note on AI accountability; it is on my profile if useful.

When did you last make disclosure a condition of purchase rather than a matter of trust?