Australian online safety legislation · Small business guide
Australia's Digital Duty of Care: what does it mean for your business website?
Australia's proposed online safety reforms could create new obligations for some business websites, hosting services and AI-powered tools. Understand the House-passed bill, its potential compliance burden and practical steps to take now.
Why should small businesses pay attention?
Australia's Online Safety Amendment (Digital Duty of Care) Bill 2026 is designed to make online services take greater responsibility for protecting Australians from serious online harm. Much of the debate has focused on major social platforms, online games and generative AI services — but ordinary business websites may also need to consider whether their activities fall within the broad definition of an online service.
For a local accountant, trade business, retailer or professional services firm, the issue is not necessarily that the website presents significant risks. It is whether a low-risk website may still need to assess, document and review those risks.
Australia's small business representative body, COSBOA, has called for clearer exclusions for low-risk small business websites. The government has suggested that low-risk services should have minimal obligations, and the bill allows the Minister to exempt categories of low-risk services. However, no blanket small business exemption is currently included, and an exemption cannot be assumed before it is made.
Small business concerns · Have your say
More compliance costs and red tape for small businesses?
Online safety and protecting children are important objectives. But many small business owners will reasonably question whether a straightforward business website should face a new layer of recurring risk assessments, record-keeping and possible professional compliance costs.
The Council of Small Business Organisations Australia (COSBOA) has warned about the potential burden and called for clear exclusions for ordinary, low-risk small business websites. It has also raised concerns about how changes to algorithmic feeds may affect small business discovery and the need for better review processes when platforms wrongly remove business content or accounts. Actual compliance costs have not yet been established, and the final rules may change.
An important change in the House-passed bill: when deciding what action is appropriate under the core duty, section 26A(3) says the cost of that action or measure must not be taken into account. This is different from the September exposure draft. It does not mean every website must adopt the same safeguards, but it makes clear why questions about proportionality and low-risk exemptions matter to business owners.
Do you think the bill should be rejected in its current form, or amended to exempt low-risk small business websites? You can raise your concerns directly with your local federal Member of Parliament. Explain how additional compliance work could affect your business, and ask what changes or safeguards they support.
As at 11 November 2026, the bill has passed the House of Representatives but has not become law. You can express support, opposition or suggestions for amendment when contacting your MP.
Important legislative update
What changed between the exposure draft and the House-passed bill?
MinterEllison's 14 October 2026 analysis examined the earlier exposure draft. The bill introduced on 15 October and amended by the House on 28 October retains the broad approach, but important legal details have changed. The comparisons below reflect the later House-passed version, as analysed by Johnson Winter Slattery (3 November 2026).
1. Core duty: appropriate action
The earlier draft referred to ensuring safety “so far as is reasonably practicable”. The House-passed version instead requires appropriate action to ensure a safe online environment, including effective measures to mitigate assessed risks. Section 26A(3) expressly excludes cost from consideration when determining appropriate action.
2. Written assessments stand alone
Under section 27, risk assessments are a separate proposed legal obligation for covered services. They would need to be written, reviewed at least annually and before relevant significant changes, kept for six years, and supplied within 30 days if requested by eSafety.
3. Who controls the online service?
The definition of a responsible person can include the service provider or the person with the greatest degree of day-to-day control over the service. A website owner, hosting company and developer may play different roles; providing a one-off web design service does not, by itself, settle who is responsible.
4. AI, age assurance and feed controls
The framework expressly reaches certain AI content-generation services. The later bill also adds targeted age-assurance measures where children could encounter pornography or specified fetish material, and obligations relating to user-empowerment tools when required under ministerial rules.
What about the $109.2 million penalty mentioned in media reports? This is a headline maximum for serious breaches by covered providers, not an automatic fine for operating a normal small business website. The precise penalty provisions and enforcement approach must be read in context, and the legislation is not yet in force.
Understanding the proposal
What could website operators be expected to do?
The bill proposes a core digital duty of care (sections 26 and 26A) and a separate written risk-assessment duty (section 27) for those responsible for services within scope. The following are key elements of the House-passed bill, not existing requirements imposed on every small business website.
Identify foreseeable risks
Consider who uses your service, its features, the potential for serious online harm and the measures already in place.
Keep a written record
Covered services would need written risk assessments, including an assessment of likely harm and mitigation measures.
Update assessments
The proposal calls for reviews at least annually and before significant changes introducing new risks.
Preserve records
The House-passed bill provides for assessments to be retained for at least six years.
Make records available
Covered operators would have to supply assessments to the eSafety Commissioner within 30 days of a request.
Address meaningful risks
Covered operators would need to take appropriate action, including effective measures to mitigate risks identified in their assessments.
How might different types of business websites be affected?
Website functionality matters more than the size of the business alone. These are illustrative practical risk profiles, not classifications made by the regulator or exemptions guaranteed by law.
| Website type | Typical exposure | What to examine |
|---|---|---|
| Brochure / informational website | Generally lower risk | Contact forms, embedded tools, visitor interaction and whether users can publish material. |
| WordPress or business blog | Depends on features | Public comments, membership features and moderation settings. |
| Shopify, WooCommerce or Maropost store | Depends on features | Customer reviews, product uploads, user messaging, community areas and third-party integrations. |
| Customer or member portal | Feature-dependent | Private messaging, file sharing, user submissions and access for children. |
| Website with an AI chatbot | Needs closer review | What the bot can generate, who can use it, escalation options and safety controls. |
| Web hosting or managed platform service | Service and control dependent | Whether the service is a hosting service under the bill, who exercises day-to-day control and what safety mechanisms are in place. |
| Forum or community website | Greater interaction risk | User-to-user conduct, content reporting, moderation and controls for vulnerable users. |
Risk descriptions above are indicative only. Whether a business is legally covered will depend on the final Act, applicable exemptions and regulatory guidance.
A practical starting point
Six sensible steps for small business owners
There is no need to rush into expensive compliance software while the law is still being considered. Businesses can use the time to understand their websites and identify features worth checking.
- List your website's interactive features
Check forms, reviews, uploads, chat, user accounts, messaging, communities and AI tools.
- Consider who can access them
Think about whether children can use the service and whether users can interact with strangers.
- Review existing safeguards
Document moderation, reporting options, access settings and controls around user-generated content.
- Keep a simple dated record
Write down what you checked, potential risks, existing protections and any follow-up work.
- Check third-party features
Know what your plugins, generative AI chatbots, review systems and external platforms allow visitors to create, publish or share. Clarify who operates each service.
- Monitor the final rules
Revisit the position after the Senate process, any exemptions and eSafety guidance are clearer; avoid treating a draft checklist as legal certification.
What does the proposal not automatically mean?
Some of the headlines around the bill concern large platforms, adult content and high-risk services. Those provisions should not be interpreted as requiring every business website to install identical systems.
- Not every website would automatically need age verification. The House-passed bill's specific age-assurance provisions are triggered by foreseeable risks of children encountering pornography or specified fetish material. Where triggered, proposed controls include at least two appropriate age-assurance options and access restrictions, subject to the statutory conditions.
- Not every website needs a moderation team. A static website with no public interaction differs materially from a social network or forum.
- No single software product guarantees legal compliance. Good documentation and safeguards depend on what the website actually does.
- Hosting and website ownership are not necessarily the same responsibility. Responsibility depends on the legal definition of the service and the provider or person with the greatest degree of day-to-day control. It cannot be determined from a hosting or design contract alone.
Website security, privacy and cybersecurity remain important, but they involve separate legal and practical considerations. Do not confuse a general security checklist with the specific proposed Digital Duty of Care obligations.
A sensible approach for lower-risk sites
Start with a clear inventory and proportionate review of what your website actually lets people do.
If there is no public posting, messaging, sharing or harmful content, record those facts rather than purchasing tools that may not be relevant.
Revisit the position when the final legislation and regulatory guidance are available.
Frequently asked questions
Does the Digital Duty of Care Bill apply to all Australian business websites?
The proposed framework is broad and does not currently contain a blanket small business exemption. Whether an individual website is within scope, and what it would need to do, will depend on the final legislation, exemptions and guidance. Low-risk sites are expected to have fewer practical safety concerns than highly interactive services.
Is the Digital Duty of Care law already in force?
No. As at 11 November 2026, the Digital Duty of Care Bill had passed the House of Representatives but had not completed the Senate process or received Royal Assent. The proposed core duty would commence 12 months after Royal Assent if the current timetable is retained.
Will a small business need an annual website risk assessment?
Under the House-passed bill, covered online services would have written risk-assessment duties, including an annual review, six-year record retention and provision of assessments to the regulator upon request. Whether a particular low-risk site is a covered online service or is exempted is still an important unresolved question.
Could my website developer or hosting provider be responsible instead of me?
Potentially, depending on the kind of online service and who has the greatest degree of day-to-day control. Hosting services and websites need to be assessed separately. A developer does not automatically become responsible for a client's entire site just because they built it.
Does the bill allow businesses to weigh compliance costs against online safety risks?
The earlier exposure draft and the House-passed text differ. Under section 26A(3) of the House-passed bill, the cost of an action or measure is not taken into account when deciding what action is appropriate under the core duty. The eventual scope of exemptions and other statutory conditions still matters for small businesses.
Will the new rules affect how customers discover my business on social media?
Possibly. The proposal includes user controls over algorithmic recommendations, but implementation details are still being developed. COSBOA has called for the impact on small business discovery and wrongful account or content removals to be addressed.
Does a WordPress, Shopify or WooCommerce website automatically need age verification?
No. The targeted provisions relate to a reasonably foreseeable risk of children accessing pornography or material depicting specified fetish practices or fantasies. They do not automatically require every business visitor on every website to prove their age.
Should I remove comments, customer reviews or my AI chatbot?
Not automatically. Review how the feature works, the content it allows, who can use it and what safeguards exist. The right action should be driven by actual risks rather than assumptions.
Can HYM Digital help review the technical features of my website?
Yes. HYM Digital can help businesses identify interactive website functionality, review relevant settings and integrations, document technical observations and implement agreed website changes. Legal interpretation or formal compliance advice should come from a qualified Australian lawyer.
HYM Digital · Brisbane
Not sure what features your website exposes?
We can help you review your WordPress, Shopify, WooCommerce or Maropost website, identify its interactive functions and document practical technical improvements — without overcomplicating the process.
Sources and further reading
- Australian Government — Digital Duty of Care overview
- COSBOA — potential implications for small business
- Australian Electoral Commission — find your electorate and federal MP
- MinterEllison — 14 October exposure-draft analysis (note: predates House amendments)
- Johnson Winter Slattery — 3 November analysis of the House-passed bill and changes to sections 26–27
- Parliamentary debate — ministerial comments on low-risk small business sites
Information notice: This article provides general information about proposed Australian legislation as at 11 November 2026. It distinguishes the September exposure draft from the version amended and passed by the House on 28 October 2026. It is not legal advice and does not establish that any particular website is legally required to carry out an assessment. The bill may be amended before it becomes law. HYM Digital provides website and technical services, not legal advice.