A few weeks ago the Prime Minister confirmed that an AI agent had got into a Services Australia Medicare statistics portal it was never meant to reach. It was researching public medicine spending. When it was refused access, it found another way in and took non-public statistics and internal files.
It happened in June. It was found in August. Government was told in September.
The Federal Government has responded quickly. It plans to introduce legislation on AI safety standards, mandatory incident reporting and stronger penalties by the end of this year. That is the right direction. But councils can’t wait for the law to tell them what good looks like.
The wrong lesson
It would be easy for councils to read this story and decide AI is too risky. Pause the pilots. Wait and see.
I think that would be a mistake.
Councils are under real pressure: rising costs, skills shortages, and communities that expect services to be as easy as the apps on their phones. AI is one of the few tools that can genuinely help. Stepping back now doesn’t remove the risk. It just means the risk arrives later, with less experience to manage it.
In our white paper, Governing in the Age of Disruption, we argued that the answer to AI isn’t fear but leadership and wisdom: people in charge, and trust at the centre of every decision. This is the first real test of that message.
The right lesson
The right lesson is simpler. Only use AI you can control.
We’ve already proven this can be done. Our AI Infringement Assistant was developed with Warrnambool City Council and is now in production. We kept the Ombudsman and the Department of Justice informed from the early design stage right through to updates after go-live. It combines automation and AI to do one job, within clear limits. Its decisions are fair, explainable and reviewable, as Australian law requires.
It isn’t the most exciting AI story you’ll read this year.
But it works.
It’s saving the council time and money now, and it shows councils can get real value from AI without giving up control.
Four questions for any council AI
Before an AI agent is given access to council systems or community data, someone should be able to answer four questions:
- What can it access? Name the systems and the data. Nothing more.
- Who approves its decisions? A person stays accountable for anything that affects a resident.
- Can you see everything it did? Every action is logged. Every decision can be explained.
- Can you switch it off? Instantly, without breaking everything else.
If a vendor can’t answer these in plain English, that tells you something.
Control lives in the connections
Most of the risk with AI agents comes from what they’re connected to. An agent that can wander across systems, scrape websites or borrow logins is hard to govern. An agent that can only reach council systems through defined, monitored connections is not.
That’s where integration matters. Governed connections let a council decide exactly what data an agent can see, record every request, and cut off access in seconds. It’s not the exciting part, but it’s where control lives. It’s also why we built SmartGlue the way we did.
Holding ourselves to the same standard
We should be judged by the same four questions. So Symphony3 is committing to:
- Keep a register of every AI agent we run for customers.
- Keep a person accountable for every decision that affects a resident.
- Log every action our agents take.
- Tell customers promptly if something goes wrong, without waiting for the law to require it.
Local government needs a seat at the table
Councils hold some of the most personal data in the country: rates, permits, infringements, and family and community services. Yet local government is often an afterthought in national technology policy. As the new rules are drafted, councils need to be part of the conversation. We’ll be working with the sector to make sure they are.
The bottom line
Whether you’re leading a council, running a business or simply trying to use AI well, the principle is the same. Know what it can touch. Keep a person in charge. See everything. Keep your hand on the switch.
AI doesn’t have to be rogue. It has to be governed.
If you’d like to talk about what that looks like for your council, I’d welcome the conversation.
Thomas Hynes, CEO, Symphony3