Digital Duty of Care Bill: Does It Apply to You?
Australia's Digital Duty of Care Bill explained for small business websites: who it covers, the yearly risk assessment, the possible low-risk exemption.
The Digital Duty of Care Bill would cover most Australian websites, including small business ones, but a low-risk exemption may be considered and nothing is required yet. As introduced on 15 October 2026, the Bill asks every covered online service for a written safety risk assessment each year, kept for six years. It isn't law: if it passes, the duty starts 12 months after Royal Assent.
You may have seen headlines saying every small business website will need a yearly safety audit. This guide explains what the Bill says, which websites are most likely to be caught, and what's worth doing now. It's current at 11 November 2026, and we'll update it after the Senate committee reports.
What is the Digital Duty of Care Bill?
The Online Safety Amendment (Digital Duty of Care) Bill 2026 changes the Online Safety Act 2021. It replaces the current industry codes with one general duty on providers to keep their services safe. The ADM+S Centre's explainer describes the scope as "online service providers – everything from social media platforms to websites, online games and messaging apps".
The government's pitch is aimed at big platforms. Speaking on the Bill in Parliament on 27 October 2026, the Prime Minister said failing to comply "will result in a fine of up to $109.2 million", and that the Bill would "halve the length of time that digital service providers have to respond to cyberbullying complaints from 48 to 24 hours."
Where the Digital Duty of Care Bill is up to
- 15 October 2026: introduced into Parliament
- 28 October 2026: passed the House of Representatives with amendments
- 20 November 2026: Senate committee report due. The Opposition has said it won't support the Bill as it stands, so it may change.
- 12 months after Royal Assent: the duty itself would start
What would a website owner have to do?
If your site is covered and not exempt, the Bill as introduced in October 2026 requires you to:
- Do a written risk assessment of foreseeable online safety risks to users, how likely and serious they are, and what you do about them
- Repeat it at least once a year, and before any big change that could add new risks, such as adding a forum or a chatbot
- Keep each assessment for at least six years, and give it to the eSafety Commissioner within 30 days if asked
- Act on the risks the assessment finds
Under the Bill as amended by the House on 28 October 2026, failing to do, keep or produce the assessments carries a civil penalty of up to 60,000 penalty units, according to Johnson Winter Slattery's analysis. The $109.2 million figure is the maximum for breaching the duty itself.
Does the duty of care cover small business websites?
As the Bill stands, yes. In its September 2026 submission on the exposure draft, the Council of Small Business Organisations Australia (COSBOA) pointed out that "there is also no revenue, headcount or user threshold in the Bill", and warned that "hundreds of thousands of small business websites will be captured".
There is a way out. Under section 25B(3) the Minister can, by legislative instrument, exempt a service, or a whole class of services, that poses little risk to users. Comparing the Bill with the exposure draft, Johnson Winter Slattery notes that "the exemption now only applies where there is little risk posed to users." No exemption has been made yet. COSBOA said it "understands from discussions with the Department that an exemption for low risk websites may be considered, but that the position has not yet been settled", and wants it written into the Bill.
So our reading for a typical brochure website (pages, a contact form, a map) is: likely to be low risk, and possibly exempt, but nobody will know until the rules are final.
Which website features carry more risk?
Online safety risk comes from what other people can post, send or receive through your site. This is our rough guide, from lowest to highest, not a legal test:
| Feature | Risk | Why |
|---|---|---|
| Information pages, contact form, map | Low | Only you publish. Messages come to you, not other users. |
| Booking or payment forms | Low | Personal details, but no content shared between users |
| Embedded social feeds or YouTube | Low to medium | Content from elsewhere, moderated by the platform |
| Public reviews or comments | Medium | Strangers can post things other people read |
| AI chatbot | Medium | Software writes answers in your name, and the Prime Minister named AI chatbots among services that must protect under-18s |
| Forums, member profiles, direct messages | Higher | Users can contact and harass each other |
If your site has anything from the middle of that table down, it's worth thinking about the duty now, whatever the exemption says. Our AI website assistants log every conversation so you can see what they say in your name.
What should you do now?
- There's nothing to comply with yet. The rules aren't final, and an exemption could change everything for a simple site.
- List what your site does. Write down every form, embed, chat tool, review widget and sign-in. It doesn't take long and is the start of any future assessment.
- Fix the easy things anyway. Turn off comments you don't read, add spam filtering to forms, and make sure your chatbot says when it doesn't know something. These are good practice regardless.
- Watch for the Senate report on 20 November and any exemption from the Minister. We'll update this post when either arrives.
A static website, like the ones we build on Nuxt and Cloudflare, has no comments, logins or user uploads unless you ask for them, which keeps the list short.
Two other website rules that are already law
The Duty of Care isn't the only change coming. Two others are certain:
- From 10 December 2026, automated decisions in privacy policies. If the Privacy Act applies to your business and software makes decisions that could significantly affect people, such as credit checks or screening applications, your privacy policy must say so. Many businesses with turnover under $3 million aren't covered by the Privacy Act (its small business exemption).
- From 1 July 2027, dark patterns, drip pricing and subscription traps. The Unfair Trading Practices changes ban manipulative design, fees revealed late in checkout, and subscriptions that are harder to cancel than to start. See our drip pricing and dark patterns checklist.
Want us to check your site?
Our website compliance check covers all three rules for $490 ex GST. It tells you which apply, what to fix, and gives you a written record. If you're on one of our care plans, we'll do the yearly assessment for you if the Bill becomes law and your site isn't exempt.
Questions people ask
What is the Digital Duty of Care Bill?
The Digital Duty of Care Bill is a 2026 change to the Online Safety Act that puts one general safety duty on online services, backed by yearly written risk assessments and eSafety Commissioner enforcement.
Will the Digital Duty of Care Bill pass?
The Digital Duty of Care Bill passed the House of Representatives on 28 October 2026. A Senate committee reports on 20 November 2026, and the Opposition has said it won't support the Bill as it stands.
Does the Digital Duty of Care apply to small businesses?
The Bill has no turnover, staff or user threshold, so small business websites are covered as it stands. The Minister can exempt low-risk services; COSBOA says an exemption for low-risk websites may be considered but isn't settled.
What are the penalties under the Digital Duty of Care?
The Prime Minister says breaching the duty can bring a fine of up to $109.2 million. Failing to do, keep or produce risk assessments carries up to 60,000 penalty units under the Bill as amended by the House.
When does the Digital Duty of Care start?
The duty would start 12 months after the Bill receives Royal Assent. As of November 2026 the Bill is still before the Senate.
Does a chatbot on my website count?
A website chatbot is likely to be in scope. The Prime Minister named AI chatbots among online services that must protect under-18s from harmful content. Our AI assistant safety setup adds guardrails and logging.
This guide explains how the rules affect websites. It isn't legal advice.
Sources: Prime Minister: Digital duty of care (27 October 2026) · Parliament of Australia: Online Safety Amendment (Digital Duty of Care) Bill 2026 · Senate Environment and Communications Committee inquiry · COSBOA submission · Johnson Winter Slattery: Excluded, but not exempt · ADM+S Centre: what's in the bill · OAIC: transparency for AI and automated decision-making
Cover photo: Parliament House at dusk, Canberra, by Thennicke, CC BY-SA 4.0, resized.