Australia's government announced strict expectations for artificial intelligence data centre development on 23 March, setting conditions for the nation's $7 billion infrastructure bet. The focus was clear: renewable energy investment, local employment creation, and community benefit. What was missing from those expectations proved more revealing than what was included.
One day later, Baltimore's lawsuit against xAI and Grok laid bare what that omission might cost. The city alleged that Grok has generated approximately 3 million non-consensual sexualised images in just 11 days, including more than 23,000 images of children. The AI system Grok lacks, according to Baltimore's complaint, meaningful safeguards despite being marketed as safe.
Australia faces the same problem. The eSafety Commissioner has been investigating Grok since late 2025, receiving multiple reports of sexualised deepfakes, including those involving children. Yet the Commissioner operates under existing laws that lack specific tools to force design changes. The government's March 23 data centre expectations mention renewable energy, water stewardship, and local capability building. They do not mention child safety by design.
The timeline matters. Meta paid $375 million in penalties for misleading consumers about child safety on its platforms. The US Pentagon has blacklisted Anthropic's Claude models, raising questions about government oversight of AI companies. Yet as these precedents accumulated, Australia's government designed conditions around data centre development that prioritise economic benefit over safety-by-design.
This reflects a broader pattern: Australia's newly established AI Safety Institute, launched with only AUD$29.9 million in funding, is playing catch-up. The government's March expectations assume safety will emerge through regulation and corporate responsibility after infrastructure is built, not built in from the start.
The eSafety Commissioner has signalled willingness to take action, but the legal framework governing her authority treats deepfakes and exploitative content as problems to address reactively, not problems to prevent through mandatory design standards. Australia's age verification rules, effective from 9 March, require tech companies to prevent children's access to explicit content, but they do not require the companies to stop generating it in the first place.
What Baltimore's lawsuit reveals is the cost of that approach: millions of images created, thousands involving children, billions in potential liability, and years of litigation. Australia's government has welcomed the infrastructure and set conditions around energy and employment. The question now is whether the eSafety Commissioner will have the legal tools to learn from Baltimore's experience, or whether Australia will learn the same lesson the US did, only more expensively.