Digital duty of care: what the exposure draft means for your business

The Australian Government has released the exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (the Bill). If passed, the Bill would introduce a proactive, systems-based digital duty of care that would move beyond the Online Safety Act 2021 (Cth)’s (OSA) current co-regulatory framework. Persons responsible for ‘online services’, aterm spanning nine statutory categories, would be required to ensure, ‘so far as is reasonably practicable’, a ‘safe online environment’. Non-compliance would carry civil penalties of up to $109.2 million for corporations.

The Bill, introduced on 8 September 2026, would replace the existing basic online safety expectations (BOSE) and industry codes and standards for unlawful and harmful material following a 12-month transition period after Royal Assent. However, certain reforms, including reduced take-down timeframes and new removal powers, will take effect the day after Royal Assent. This shifts the regulatory model from industry-developed codes and standards (enforced by the eSafety Commissioner) to a statutory duty enacted by Parliament. Beyond the duty itself, the Bill would mandate annual risk assessments, as well as user empowerment tools. The government has announced these will include the 'My Feed, My Way' initiative, to be prescribed by legislative instrument under the Bill's framework. 

The Bill does not operate in isolation. It arrives alongside the Privacy Act Tranche 2 exposure draft (consultation closing 18 September 2026) and the Children’s Online Privacy Code (to be registered in December 2026). Together, these form part of a rapidly converging regulatory environment for businesses that provide online services. Consultation on the Bill closes on 22 September 2026, with legislation expected to be introduced to Parliament later this year.

In this Insight, we unpack what the Bill proposes, the entities that will be affected, and what affected entities should be doing now.

Who would be subject to the digital duty of care?

The duty would apply to every person 'responsible for' an 'online service'. Section 25A(1) defines 'online service' by reference to nine categories. Eight are existing OSA service types:

• internet carriage services (broadly, internet service providers and telecommunications carriers);
   
• social media services;
   
• relevant electronic services (broadly, services enabling direct messaging between users);
   
• designated internet services (including websites and other online platforms where people store and share content);
   
• hosting services (services that host electronic content, including web hosting and cloud infrastructure);
   
• internet search engine services;
   
• app distribution services (app stores); and
   
• services that manufacture, supply, maintain or install equipment for use in Australia in connection with a social media service, relevant electronic service, designated internet service or internet carriage service.

The Bill adds one new category that does not currently exist in the OSA. While aspects of these services are already captured under the existing industry codes and standards (and generally the designated internet services definition), the Bill now gives express, dedicated recognition to services that allow users to generate material using artificial intelligence and share it via any of the first seven existing service categories above (such as AI chatbots and image generators). 

Critically, the duty would apply to both the provider of the service and any person 'in a position to exercise day-to-day control' of the service (section 25A(2)). This means liability may extend to parent companies, operating subsidiaries or platform administrators, depending on the circumstances.

Two exemptions narrow the scope. The Minister may exempt classes of online services by legislative instrument where they pose little risk to Australian users or are used minimally in Australia. The duty also does not require any action in relation to lawful communications occurring in private, solely between consenting adults. Businesses that do not provide any online service falling within the nine statutory categories, and that do not exercise day-to-day control over such a service, would not be subject to the duty.

The digital duty of care standard: ‘reasonably practicable’ 

The central obligation is that a person responsible for an online service would need to ensure, ‘so far as is reasonably practicable’, a ‘safe online environment’ (section 26). The test is a direct transplant from Australia’s work health and safety regime – the Rickard Review explicitly drew this parallel in recommending the duty.

Section 25H defines ‘reasonably practicable’ by requiring a weighing of all relevant matters, including: 

• the likelihood of the harm concerned occurring;
   
• the degree of harm that might result;
   
• what the person knows, or ought reasonably to know, about the harm and available ways of eliminating or minimising the risk;
   
• the availability and suitability of ways to eliminate or minimise the risk;
   
• the cost of those measures, including whether the cost is grossly disproportionate to the risk; and
   
• the impact on the level of privacy an ordinary reasonable person would expect, including whether that impact is grossly disproportionate to the risk.

Three features of this test stand out:

Systems-based liability model

This is a systems-based liability model, consistent with the approach taken in the existing industry codes and standards. Providers would not be liable for individual instances of harmful content reaching a user. Liability would attach to systemic failure to maintain appropriate systems and processes (the same approach adopted for the social media minimum age regime). A provider able to demonstrate it maintained robust safety systems could satisfy the standard, even if individual harms occurred.

Express privacy safeguard

The test builds in an express privacy safeguard. The test requires consideration of whether a safety measure’s impact on the level of privacy that an ordinary, reasonable person would expect is ‘grossly disproportionate’ to the risk being addressed. This limb was not among the Rickard Review’s recommendations. The practical effect is significant: before mandating or implementing safety measures such as age assurance systems or AI-based content moderation systems, providers will need to assess whether the resulting privacy intrusion is proportionate to the harm being mitigated. 

Forward-looking for foreseeable risks

The standard is forward-looking: it captures what the person ‘knows, or ought reasonably to know’. This imposes a constructive knowledge obligation – providers cannot rely on ignorance of foreseeable risks.

Like the 'reasonably practicable' standard in WHS law, the practical application of these obligations will inevitably involve interpretation and judgement. Regulator guidance will be critical. 

Safe online environment: three tiers of protection

The ‘safe online environment’ that providers would need to maintain is not a single standard. Section 25B defines it through three tiers of protection, each with increasing obligations.

Tier 1 – all people in Australia

Under the Bill, all people in Australia would need to be protected from ‘seriously harmful material and conduct’. Section 25C provides an exhaustive list of harmful material, including child sexual exploitation material, grooming, content promoting sexual or extreme violence, threats of physical violence, material promoting suicide or self-harm, terrorist and violent extremist content and abhorrent violent conduct. The Minister may expand this list by legislative instrument.

Tier 2 – children under 18

In addition to the Tier 1 protections, children would need to be protected from material and conduct that is ‘harmful to children’ (section 25D). This is a separate, broader category of material and conduct that poses particular risks to minors: pornography, content promoting disordered eating, material encouraging hostile attitudes towards women or gender equality, content glorifying crime or dangerous stunts, and abuse, harassment or bullying. Children would also need to be protected from harms associated with the operation of ‘design features’ of online services, for example, addictive features in online games, apps and AI chatbots that may affect self-esteem or encourage compulsive use.

Tier 3 – children under 16 on social media

For social media services specifically, ‘design features’ with ‘negative behavioural impacts’ would not be permitted to operate for children under 16 (section 25B(1)(c)). This is the most prescriptive tier: it effectively requires providers to disable specified features for this age group, going beyond the existing SMMA obligation to prevent under-16s from holding accounts. The design feature restrictions would apply regardless of whether an under-16 user holds an account, addressing, for example, children who continue to access recommended content on social media platforms without being logged in. 

Design features and user empowerment

The Tier 2 and Tier 3 protections described above refer to ‘design features’ and ‘negative behavioural impacts’ – both defined terms in the Bill. Section 25F identifies five categories of ‘design feature', each of which is taken to have ‘negative behavioural impacts’: 

• recommender features – content selected and displayed based on information associated with the user’s account;
   
• endless-feed features – continuous feeds of end-user content;
   
• feedback features – metrics such as view counts, follower counts and like counts;
   
• time-limited features – content (such as stories) viewable only within a limited period after posting; and
   
• logged-in features – any of the above features where the user must be logged in to access them.

The Minister may determine additional design features with negative behavioural impacts by legislative instrument. The blanket designation of these features as having negative behavioural impacts is notable. For example, recommender systems can improve service relevance and utility for users, but the Bill does not distinguish between harmful and beneficial applications of these features. 

To comply with the duty, providers would need to manage these features ‘appropriately’, including by providing ‘user empowerment tools’. These are tools that allow users to manage how design features operate for them (section 26(6)). The centrepiece initiative is ‘My Feed, My Way’, under which social media platforms would notify users and offer the following choice:

• opt in to personalised algorithmic content recommendations; or
   
• opt out and see only content from accounts they choose to follow.

The detail of these tools (default settings, prompt frequency, granularity of controls) would be prescribed by legislative instrument. There is a tension here: the duty is deliberately framed as a general, outcomes-based obligation, yet the Minister may prescribe specific tools for specific services, adding a prescriptive element to an otherwise principles-based framework. 

Mandatory risk assessments

A key compliance mechanism under the Bill is the mandatory risk assessment. A person who provides an online service must conduct a written risk assessment for each such service at least annually (section 26A). Each assessment must: 

• identify all reasonably foreseeable risks (including those relevant to the digital duty of care), the content, design features, systems and processes giving rise to those risks, and persons who may be affected;
   
• assess the likelihood and potential severity of those risks;
   
• document implemented or proposed mitigation measures;
   
• record the provider’s assessment of each measure’s expected effectiveness, its basis and expected duration; and
   
• provide for regular review and reassessment.

Risk assessments would also need to be conducted before any changes to the service that could introduce new or additional risks. The eSafety Commissioner would have the power to impose additional requirements in relation to the manner, form, content, metrics and frequency of assessments, meaning that providers could be required to conduct assessments more frequently than annually.

A critical practical point: risk assessments would need to be retained for at least six years and made available to the eSafety Commissioner within 30 days of a request. In practice, these are discoverable enforcement documents. Providers should approach them with the same rigour and legal privilege considerations they would apply to any document likely to be produced in regulatory proceedings. Poorly drafted or incomplete assessments may prove more damaging than having no assessment at all.

Providers of low-risk services may be exempted from the risk assessment requirement by Ministerial legislative instrument.

Enforcement and penalties

The duty would be backed by a significantly expanded enforcement regime. The Bill, if passed, would materially expand the eSafety Commissioner’s enforcement toolkit. 

Civil penalties: The headline penalty for breaching the digital duty of care is 60,000 penalty units – currently $109.2 million for a body corporate. Separate civil penalties apply for contravention of other provisions.

The government chose not to adopt the Rickard Review’s penalty model. The Rickard Review recommended penalties calculated as the greater of 5% ofglobal annual turnover or $50 million (Recommendation 34). The government instead chose fixed penalty units. For the largest global platforms, the difference is significant: a 5% turnover penalty for a platform generating $100 billion in revenue would have been $5 billion, yet the Bill caps the exposure at $109.2 million, regardless of platform size.

Formal warnings: The Commissioner may issue formal warnings for non-compliance with the duty, which may be published on the eSafety website as a ‘name and shame’ measure (section 183AA).

Binding remedial directions: The Commissioner may direct a provider to take specified corrective action, with a separate penalty of up to $109.2 million for a body corporate (section 26D(3)).

Information gathering powers: The Commissioner may compel the production of information and documents and summon individuals for examination on oath (sections 199 – 205).

Increased existing penalties: Penalties for bodies corporate failing to comply with take-down notices and the SMMA obligation would be increased to 6,000 penalty units (currently $10.92 million) and 60,000 penalty units (currently $109.2 million) respectively.

The Bill would also add the eSafety Commissioner as an ‘enforcement body’ under the Privacy Act 1988 (section 63 of Schedule 2, Part 2). This would formalise the ability for the Commissioner to receive personal information disclosures from APP entities for enforcement purposes.

Transparency, compliance and other reforms

Beyond the digital duty of care, the Bill contains a suite of additional measures aimed at increasing transparency and strengthening the Commissioner’s operational powers. 

Transparency and compliance reporting

A new transparency reporting regime (replacing the BOSE reporting) empowers the Commissioner to issue written notices that require providers to prepare reports about service safety, compliance with the OSA, resources available for compliance, and performance against specified metrics.

Information publishing

The Commissioner may make legislative instruments requiring entire classes of providers to publish specified safety-related information. This would include risk assessment summaries, content moderation data, complaints data, account removals and average active user numbers.

Complaint and dispute processes

Providers of prescribed online services would need to maintain complaint and dispute processes equally available to all Australians, and comply with Commissioner-determined requirements (section 26F). Non-compliance carries a penalty of 6,000 penalty units.

Fake nude material removal

The Commissioner may issue removal notices for apps and websites designed for, or predominantly used to generate, fake nude material. Providers of app distribution services and search engines would need to comply within 24 hours (section 86C). Non-compliance carries a penalty of 6,000 penalty units.

Reduced take-down timeframes

Existing take-down timeframes for removal notices are reduced from 48 to 24 hours across the cyber-bullying, intimate images and cyber-abuse schemes. These changes take effect the day after Royal Assent – they are not subject to the 12-month transition.

Complaint waiver provisions

The Commissioner may waive the requirement for a complaint to have been made to the provider before issuing a removal notice, where the service lacks a functional or accessible complaints mechanism or where requiring the complaint would create a reasonably foreseeable risk of further harm.

Reposted material

The Commissioner may issue removal notices without a prior complaint where material that was previously the subject of a removal notice within the last six months has been reposted, even if the material has been altered (e.g. cropped, screenshotted, or edited).

Research data access scheme

The Bill establishes a data access scheme enabling approved researchers to access providers’ data for online safety research (Part 14). Eligibility is limited to employees of Australian universities who have ethics committee approval and meet prescribed requirements. The Commissioner may set data access rules by legislative instrument.

‘Sock puppets’

Both approved researchers and the Commissioner may assume false identities to test platform safety. The statutory immunity is broad: it overrides ‘any other law (whether written or unwritten) of the Commonwealth, a State or a Territory’ and ‘any agreement, contract, deed, policy or other document’ (sections 205H – 205L). Activities authorised include creating accounts, observing and downloading content, testing features, and, for the Commissioner, generating AI content.

Australian points of contact

If required by the Commissioner (by written notice or legislative instrument), providers would need to nominate a person ordinarily resident in Australia as their point of contact. Non-compliance would carry a penalty of 1,000 penalty units (currently $1.82 million) (section 229A).

Regulatory convergence: the digital duty of care in context

The digital duty of care is not a standalone reform. It sits within a broader, evolving digital regulatory framework including the Privacy Act tranches, the Children’s Online Privacy Code, the Social Media Minimum Age and the AI standards. 

We explore how these reforms interact in Digital regulation in Australia: how new reforms converge and intersect.

What the digital duty of care means for your business

Understand whether your organisation is in scope: The definition of ‘online service’ under section 25A(1) is broad. It extends well beyond social media platforms. Businesses should consider whether their services fall within any of the nine statutory categories, as many organisations not traditionally considered ‘online platforms’ may be captured. If your business operates a website, app, messaging platform, search tool, content hosting service, connected device or AI tool that is accessible to users in Australia, you should undertake a more detailed assessment.

Engage with the consultation: The consultation closes on 22 September 2026. Businesses with concerns about scope, proportionality, the interaction with privacy obligations, or specific operational impacts should consider making a submission. 

Map the regulatory landscape: The digital duty of care arrives alongside Privacy Act Tranche 2, the Children’s Online Privacy Code and emerging AI regulation. Rather than treating each reform in isolation, businesses should take a whole-of-landscape view and identify where obligations overlap or create tension, particularly around data collection, content moderation and children’s protections.

Brief your board and senior leadership: The potential penalties (up to $109.2 million), the breadth of the proposed regime and the pace of concurrent regulatory reform make this a board-level issue. Senior leadership should understand the direction of travel, even while the final form of the legislation remains uncertain.

Plan ahead: If the Bill is passed in its current form, the digital duty of care framework would not commence until 12 months after Royal Assent, and the eSafety Commissioner will need to publish regulatory guidance. Detailed compliance programs and risk assessment frameworks are best developed once the legislation is finalised, but the building blocks, like understanding your service landscape, your existing safety practices, and where the gaps are likely to be, can be put in place now.