Reform at a glance
On 8 September 2026, the Australian Government released the exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026, and it is nothing if not ambitious in scope. If passed, this will be the most significant overhaul of the Online Safety Act 2021 (Cth) (Online Safety Act) since its commencement. At its heart is a single, sweeping idea: a new statutory “digital duty of care” that sweeps away the current Basic Online Safety Expectations and Online Safety Codes and Standards, replacing them with one duty enforceable directly by the eSafety Commissioner and backed by civil penalties of up to approximately AUD109 million for a body corporate.
What this means for your business
In short, anyone responsible for an online service must ensure, so far as is reasonably practicable, a safe online environment for people in Australia. That “reasonably practicable” test is borrowed deliberately from Australian work health and safety law: it weighs up the likelihood and severity of harm, what the business knew or ought to have known, and whether available safeguards are proportionate to their cost and privacy impact.
Who counts as “responsible”?
More organisations than you might expect. The definition extends beyond the eight sectors already regulated today (think social media and hosting services) and now captures services that let users generate material using artificial intelligence and share it elsewhere via those other services. It also reaches beyond the named provider of a service to anyone in a position to exercise day-to-day control over it – meaning both named providers and underlying technology providers can be captured. This represents a significant expansion of the existing Online Safety Act framework, which places obligations only on providers themselves.
The new definition of “online service” now covers:
- an internet carriage service;
- a social media service;
- a relevant electronic service;
- a designated internet service;
- a hosting service;
- an internet search engine service;
- an app distribution service;
- a service that manufactures, supplies, maintains or installs equipment used in Australia in connection with a social media service, a relevant electronic service, a designated internet service, or an internet carriage service; and
- a service that allows users to generate material by means of artificial intelligence and share that material by means of any of the services listed above.
The first eight categories correspond to the sectors already regulated under the current Online Safety Codes and Standards; the last is new and is aimed squarely at generative AI services.
Digital duty of care
The table below sets out the core obligations imposed on regulated online services.
| Core obligation |
What it involves |
| Digital duty of care |
Section 26 imposes on the person responsible for an online service (responsible person) a ‘digital duty of care’, requiring them to ensure, so far as is reasonably practicable, a safe online environment. |
| Design feature management |
To comply with the digital duty of care, the responsible person must manage design features such as recommender feeds and infinite scroll appropriately, including offering any user empowerment tools (being a tool that allows a user to manage
the way design features of the service operate for that user, including by providing control over the kind of content that is recommended) mandated by the Minister (for example, an opt-out from algorithmic recommendations under the Government's
proposed "My Feed, My Way" initiative). |
| Risk assessments |
The responsible person must conduct a written risk assessment at least annually, and before any change that could introduce new risks; retain it for six years; and produce to the Commissioner within 30 days of request. |
| Effective measures |
The responsible person must take effective steps to address the risks identified in each risk assessment. |
| Exception |
The digital duty of care does not require any action to be taken in relation to lawfu communications occurring in private solely between consenting adults. |
Safe online environment
What does a "safe online environment" require? This is one in which:
- all Australians are shielded from the most serious categories of harmful content and conduct (which includes material or conduct relating to child sexual exploitation or abuse, sexual violence, extreme violence or cruelty, terrorism, and incitement to criminal offences);
- children are additionally protected both from:
- a broader range of age-inappropriate material (which includes pornography, material or conduct promoting disordered eating, content promoting hostile attitudes towards women or gender equality, crime glorification or dangerous stunts, and abuse, harassment or bullying, together with a residual category capturing any other material or conduct that could inflict serious harm on a child); and
- the harms that can come from certain design features; and
- for social media services specifically, those design features that have negative behavioural impacts do not operate at all for children under 16 years of age.
Harm itself can be broadly caused by not just material, but conduct, meaning the duty reaches behaviour occurring on a platform, such as harassment, grooming or bullying, and not just in relation to the content posted or generated there.
Put together, this is a wide net: businesses need to think not just about what appears on their service, but about how it behaves, who is using it, and what those users might do to one another.
Key dates and status
- Stage: The Exposure Draft was released for public consultation on 8 September 2026 and the consultation period closed on 22 September 2026. The department will consider feedback provided and may publish a summary of all feedback received on the department's website.
- Next milestone: Introduction of the bill into Parliament.
- Target date: Digital duty of care to commence 12 months after Royal Assent; Schedule 1 take-down, removal and link deletion reforms commence the day after Royal Assent.
Our perspective
This is far more than a technical update to the Online Safety Act. It is a genuine change in regulatory philosophy, moving Australia away from a content-focused, industry-code model and towards the broader, risk-based approach already familiar from the European Union's Digital Services Act and the United Kingdom's Online Safety Act. Bringing generative AI services within scope is reflective of just how quickly that technology has moved into everyday use.
That said, businesses should not expect certainty on day one. Much of the detail, including how far the more open-ended harm categories reach and how the Minister will use various rule-making powers, is still to be worked out. The eSafety Commissioner's own guidelines will help, but will nott provide safe harbour, so businesses cannot simply point to following them and call it a day. Building a genuine, well-reasoned evidentiary trail of what "reasonably practicable" looks like for a service will matter more than ticking boxes against generic guidance.
What you should do now
The 12-month transition period is a head start, not just a grace period, and it is worth using it as one. Businesses operating online services accessible to Australians, particularly those offering generative AI products, should prioritise:
- Scoping: work out whether existing services fall within the expanded online service definition, including the new AI-generated content category.
- Stress-testing controls: assess current safety and age assurance measures against the "reasonably practicable" standard, not just against existing terms of service.
- Documentation: start preparing the first risk assessment now, so it is ready well before the duty commences and can withstand scrutiny if requested.
- Staying alert: public consultation on the exposure draft closed on 22 September 2026, so businesses should monitor for the bill's introduction into Parliament, the release of any supporting materials that may assist with interpretation (i.e. explanatory memoranda) and any resulting changes to its terms.
Implications for those who have already invested in complying with the Basic Online Safety Expectations and the Codes and Standards?
Encouragingly, the type of work responsible entities have been doing to date – including documenting risk assessments and implementing age assurance measures – is directionally consistent with what is likely under the new regime, even if the specific requirements differ in the detail.
If you would like further advice on how to approach this next transition period in online safety, or would like to understand the new digital duty of care better, we can assist.
