Digital Duty of Care, explained

The short answer

The Digital Duty of Care is a proposed Australian law that would require providers of online services, including many ordinary business websites, to take appropriate action to keep users safe and to keep a written risk assessment. It is still a Bill. If passed, it would start 12 months after Royal Assent, so nothing changes today under this Bill.

What may already apply today is different: eSafety's industry codes, which cover some websites, hosting and chatbots now. More on that below.

What is the Digital Duty of Care?

The proposed law is the Online Safety Amendment (Digital Duty of Care) Bill 2026. It would amend the Online Safety Act 2021.

In plain terms, it would do three things:

1. Set one general duty. A "person responsible" for an online service would have to take appropriate action to ensure a safe online environment for users in Australia.
2. Require a written risk assessment. Each person responsible for an online service would have to make sure the foreseeable risks of harm, how likely and serious they are, and what is being done about them are written down.
3. Replace parts of today's system. When the duty starts, it would repeal the current Basic Online Safety Expectations and the eSafety industry codes and standards, and replace them with the new duty.

The Bill is aimed mainly at large platforms such as social media, but it is written broadly. It does not set a size, turnover or user-number threshold.

Does this apply to my business?

Possibly, yes. Under the Bill as introduced there is no small business exemption. Whether it applies depends on what your online services do, not how big you are.

The Bill covers "online services". That includes the categories already used in Australia's online safety law: social media, messaging, designated internet services (which in practice covers many ordinary websites), hosting services, search engines and app stores. It also adds a category for services that generate material using artificial intelligence.

Here is how common small business setups are likely to be treated. These are my reading of the Bill as introduced, not legal advice, and they have not been tested by eSafety or a court.

Who is the "person responsible"?

The Bill names two people as responsible for a service:

• the person who provides the service, and
• the person who exercises the greatest degree of day-to-day control over it.

If those are different people, both carry the duty, and both must make sure a risk assessment is done. The Bill does not divide the duty between them, and a contract can't move it off either one. For most businesses, the provider is you, even if a web developer built the site. If an agency or IT provider hosts, administers and configures your site day to day, they may also be a person responsible alongside you. A clear agreement about who controls what, who does which task and who keeps which records is still worth having now.

Is there an exemption for small or low-risk businesses?

Not automatically. The Minister may exempt a service, or a class of services, by legislative instrument if satisfied it poses "little risk" to users in Australia. That is the only test. The Bill has no size, turnover, user-number or "minimal use" threshold, the Minister doesn't have to make any exemption, and none has been made. Don't plan around one until it exists.

Need Help With This?

What would the duty ask you to do?

1. Take appropriate action to keep users safe

The core duty is to "take appropriate action" to ensure a safe online environment, including effective measures against the risks you identify.

Three points worth knowing:

• It is about systems, not perfection. According to the Explanatory Memorandum, one harmful post or reply does not automatically mean a breach. The question is whether your systems and processes were appropriate.
• Cost is not a defence. The Bill says "the cost of the action or measures must not be taken into account" when deciding what is appropriate. How likely harm is, and how serious it would be, still count. This is stricter than the earlier draft, which allowed a "reasonably practicable" test.
• The harms are defined. The Bill lists the types of harmful material and conduct it targets, with extra protection for children. It also excludes some content types, such as professional news.

2. Keep a written risk assessment

This is the part most likely to land on a small business's desk. Every person responsible for an online service would need to make sure a written risk assessment is done that:

• identifies reasonably foreseeable risks of harm to users
• rates how likely and how severe each risk is
• lists the measures you take to reduce each risk and how effective you expect them to be.

You would need to:

• do it at least once a year
• update it before any significant change that could add new risks (for example, adding a chatbot, reviews or public comments)
• keep it for six years
• give it to eSafety within 30 days if asked.

The Bill has no exception for routine updates. The test is whether a change is significant and could introduce new or additional risk, so build a quick "does this need a new assessment?" check into every change. Failing to do the assessment is itself a breach.

Need Help With This?

Risk assessments, explained simply

A risk assessment is a short document that answers four questions:

1. What could go wrong for the people who use this? For example: a chatbot gives self-harm advice; someone posts abusive comments in reviews; a child uses the service.
2. How likely is it, and how bad would it be? Low, medium or high is enough to start.
3. What are we doing about it? For example: the chatbot is limited to booking questions and refuses other topics; reviews are checked before they appear; there is a "report this" link.
4. Is it working? Note how you will check, and when you will review it.

For a brochure website, this can be a page or two. For a site with a chatbot or public posts, it will be longer, because there is more that can go wrong. The Bill does not prescribe a template, and eSafety has not yet published guidance under the new duty.

A practical checklist

You don't need to wait for the Bill to pass. These steps are useful under today's rules and would prepare you for the duty if it becomes law.

1. List your online services. Website, booking tool, chatbot, reviews, forms, any app, any sites you host for others. Note who built each one and who runs it.
2. Work out who controls what. For each service, name who holds the admin logins, who changes content and who configures any AI tool. Put AI vendor accounts and API keys in your business's name.
3. Find the higher-risk features. Anything where users post content, talk to an AI or where children might be users.
4. Write a first risk assessment. Use the four questions above. One or two pages per service is a reasonable start.
5. Add basic safeguards to any chatbot. Limit it to your business topics, turn on the AI vendor's safety filters, have it refuse harmful requests and point people in crisis to support such as Lifeline (13 11 14), offer a way to reach a human, and test it before launch.
6. Set up a complaints and reporting path. A visible "report a problem" link or email, and a simple process for removing harmful content quickly. If the Bill passes, for cyber-bullying and cyber-abuse material eSafety could issue a removal notice once a complaint to you has gone unresolved for 24 hours (down from 48 today). It could also skip the complaint step if your service has no working complaints mechanism.
7. Keep records. Store assessments, test results and changes in a business-owned folder. Plan to keep them for six years.
8. Check your agreements and get advice. Review contracts with your web developer, host and AI vendors, and ask your lawyer whether today's eSafety codes apply to you.

Need Help With This?

What applies now: eSafety's industry codes

This is the part many businesses miss. While the Bill is debated, eSafety's Phase 2 industry codes are already in force:

• The hosting services code took effect on 27 December 2025.
• The designated internet services, relevant electronic services and social media services codes took effect on 9 March 2026.

According to eSafety's overview, the codes deal with chatbot functionality, and adding a chatbot can require a service to carry out a risk assessment. The hosting code requires hosts to have clear policies on relevant material and to take appropriate and proportionate enforcement action.

What the codes require depends on the type of service and its risk level, so not every website has the same obligations. Read eSafety's overview, or ask your lawyer, to check where you sit. The codes stay in place until the duty starts, and their future repeal does not excuse non-compliance today.

The Bill also raises the stakes on the codes before it repeals them. From the day after Royal Assent, the maximum civil penalty for breaching a registered industry code or standard would rise to 60,000 penalty units. The codes would only be repealed 12 months after Royal Assent. So if the Bill passes, the codes, not the new duty, are the nearest high-penalty risk.

Timeline

The government has said it wants the Bill passed before Christmas 2026, but that depends on the Senate. If the timetable holds, the earliest start date would be late 2027.

Penalties, in context

The maximum civil penalty for breaching the duty, or for failing to do a risk assessment, is set at 60,000 penalty units. A penalty unit is a dollar amount set by Commonwealth law and indexed over time, so check the current value before quoting a dollar figure.

Maximums are reserved for serious cases. The Bill sets out a graduated approach: eSafety can issue formal warnings, remedial directions and infringement notices before taking a matter to court. Infringement notices are 12 penalty units per contravention for an individual, including a sole trader, and 600 for a company. A breach of the duty itself can't be dealt with by infringement notice; it would go to court. The Explanatory Memorandum says business size is a factor in setting penalties. For most small and medium businesses, the realistic risk is not a headline fine. It is not being able to show what you did and why.

Breaching a current eSafety industry code would also carry up to 60,000 penalty units from the day after Royal Assent (see above).

Not the same thing: NSW's digital work systems law

New South Wales has a separate law that is easy to confuse with the Digital Duty of Care. In February 2026, NSW Parliament passed amendments inserting section 21A into the NSW Work Health and Safety Act 2011.

It is about workers, not website users. A business must ensure, so far as reasonably practicable, that its workers are not put at risk by digital work systems, such as algorithms, AI, automation or online platforms used for rostering, task allocation, performance tracking or monitoring.

A chatbot that talks to your customers is a Digital Duty of Care question. Software that sets your staff's rosters or tracks their output is a NSW WHS question. Check SafeWork NSW for when s 21A starts and what guidance applies.

Frequently asked questions

Is the Digital Duty of Care law yet?

No. As at 19 October 2026 it is a Bill before federal Parliament. It was introduced on 15 October 2026 and a Senate committee is due to report on 20 November 2026. It can still be amended or rejected.

When does the Digital Duty of Care start?

If passed, the duty would start 12 months after the Bill receives Royal Assent. If it passed in late 2026, that would mean late 2027 at the earliest.

Does the Digital Duty of Care apply to small businesses?

There is no small business exemption in the Bill as introduced. It applies to online services, including many ordinary websites, regardless of size. The Minister can exempt low-risk services, but no exemption exists yet.

Does my simple brochure website need a risk assessment?

Based on the Bill as introduced, probably yes, because the risk assessment obligation applies to every person responsible for an online service and the Bill has no size threshold. For a brochure site it should be short. This is an interpretation, so confirm with your lawyer.

Does the Digital Duty of Care apply to AI chatbots?

Yes. The Bill covers services that generate material using artificial intelligence. A chatbot on your website is likely to be in scope, and eSafety's current codes already deal with chatbot functionality. The Bill would also let eSafety and approved researchers test services, including whether an AI tool can be made to generate illegal material, using pseudonymous accounts, whatever your terms of use say.

Who is responsible if a developer or agency built my website?

The Bill makes the provider of the service responsible, and also the person with the greatest degree of day-to-day control. If those are different people, both carry the duty and both must make sure a risk assessment is done. The provider is usually the business that owns the website. Your agreement with your developer can't remove either person's duty, but it should say who controls and maintains what, who does which task and who keeps the records.

Do I need to do anything now?

Nothing under this Bill is required yet. But eSafety's Phase 2 industry codes already apply to some websites, hosting and chatbots. Listing your online services and writing a first risk assessment is useful either way.

What are the penalties under the Digital Duty of Care?

The maximum is 60,000 penalty units per breach. eSafety would also be able to use warnings, remedial directions and infringement notices (12 penalty units for an individual or sole trader, 600 for a company). A breach of the duty itself would go to court, not an infringement notice. Maximum penalties are for serious cases.

Can customers sue my business under the Digital Duty of Care?

Not under the Bill as introduced, which relies on eSafety to enforce it. Some senators want a right for people to sue, so this could change during the Senate process.

Does it cover my Facebook or Instagram business page?

Probably not as the provider. Meta provides those services and carries the duty for them. Moderating comments on your page is still good practice.

Is this the same as the NSW digital work systems law?

No. NSW's s 21A of the Work Health and Safety Act is about protecting workers from risks created by digital work systems. The Digital Duty of Care is a federal online safety law about protecting users of online services.

What happens to the eSafety industry codes?

They apply now. If the Bill passes, the maximum penalty for breaching a code would rise to 60,000 penalty units from the day after Royal Assent. The codes would be repealed when the duty starts, 12 months after Royal Assent, and replaced by the duty.

Need Help With This?

Glossary

• Bill — a proposed law. It becomes an Act (law) only after both Houses of Parliament pass it and it receives Royal Assent.
• Royal Assent — the Governor-General's formal signature that turns a passed Bill into an Act.
• Explanatory Memorandum — the government's document explaining what each part of a Bill is meant to do.
• eSafety — the eSafety Commissioner, Australia's online safety regulator.
• Online service — the Bill's term for the services it covers, including websites, hosting, social media, messaging, search, app stores and AI services.
• Designated internet service — an existing legal category that covers many websites and online services not covered by other categories.
• Person responsible — under the Bill, the provider of a service and the person with the greatest degree of day-to-day control over it. A service can have two.
• Risk assessment — a written record of what could harm users, how likely and serious it is, and what you do about it.
• Industry codes — rules registered by eSafety that set online safety obligations for sections of the online industry. Phase 2 codes are in force now.
• Penalty unit — a fixed, indexed dollar amount used to set fines in Commonwealth law.
• Legislative instrument — a rule made by a Minister or regulator under the authority of an Act, such as an exemption.
• Section 21A (NSW WHS Act) — the separate NSW law on digital work systems and worker safety.

How Enod Works can help

Enod Works helps small and medium businesses with the technical and operational side of online safety:

• a systems inventory of your website, tools, chatbots and who controls each
• drafting support for your risk assessment, in plain English, for your lawyer to review
• chatbot safeguards: scope limits, safety settings, escalation to a human and pre-launch testing
• records: a simple, business-owned folder structure for assessments, tests and changes.

We don't provide legal advice or legal sign-off. For that, work with your lawyer. We make sure the technical facts they rely on are accurate and written down.

Need Help With This?

About the author

Pauline Grech is the owner of Enod Works, a Sydney-based technology consultancy. She has spent more than 18 years running technology for Australian publishers, including websites, hosting, newsletters and editorial systems, and now applies that experience to small and medium business systems.