When the US Cyber Safety Review Board was quietly wound down earlier this year under the Trump administration, it left a gap in the global model for learning from major cyber incidents without the threat of litigation or blame. Australia has now decided to fill that gap — for itself, at least.

The Australian government officially launched its Cyber Incident Review Board (CIRB) this week, designed to conduct no-fault, post-incident reviews of significant cyberattacks against Australian government agencies and critical industry. The explicit model is the CSRB — right down to the immunity-from-liability structure that made the US version effective before it was abandoned. The irony of building something America just dismantled is not lost on observers.

The CIRB's mandate is to focus on systemic lessons rather than individual or corporate culpability. Think of it like an air accident investigation — the goal isn't to prosecute the pilot, it's to figure out why the plane went down so the next one doesn't. That framing matters because it lowers the barriers for organisations to participate honestly, rather than lawyering up and saying nothing.

The timing is pointed. Australia has had a string of high-profile incidents over the past few years — Optus, Medibank, Latitude, and others — each producing a flurry of parliamentary inquiries, regulatory enforcement, and media coverage, but arguably not enough structured, public, technical learning. The CIRB is supposed to change that.

What it does in practice: after a significant incident, the CIRB can conduct a review — interviewing affected organisations, examining what failed, and publishing findings with concrete recommendations. Crucially, those findings aren't admissible as evidence of liability. That's the mechanism that makes honest disclosure possible.

The board sits within a broader Australian cyber policy stack that already includes the ACSC, the OAIC for privacy breaches, and the SOCI Act framework for critical infrastructure. The CIRB adds a dedicated learning function that the existing bodies don't really perform — regulators enforce, the ACSC advises, but nobody was systematically asking "what did we learn and how do we share it?"

There are still open questions. The CIRB's independence and resourcing will matter enormously — a board that can't compel information or lacks technical depth will produce anodyne reports. And "significant cyberattack" needs a workable definition that captures incidents worth reviewing without triggering every phishing campaign that hits a government inbox.

What to watch: which incidents the CIRB actually reviews first, how organisations respond to participation requests, and whether the findings have any teeth in terms of driving real change. The proof will be in whether future Medibank-scale events produce CIRB reports that defenders can actually learn from — or whether the board becomes another body that publishes PDFs nobody reads.

For now, though, Australia has built something the world's largest democracy decided it no longer needed. That's worth noting.