AUSTRALIAN BUSINESS GUIDE · CHECKED 29 OCTOBER 2026

Digital Duty of Care: what does your business need to do?

Australia is moving towards a new digital duty of care for online service providers. A useful starting point is to identify the services you operate, the people who use them and the harm your safeguards need to address.

Is a digital risk assessment a legal requirement?

The Bill proposes mandatory written risk assessments for covered online services. Its assessment regime would commence 12 months after Royal Assent under the introduced commencement provisions. Existing Online Safety Act obligations and eSafety industry codes are separate and may already apply. Whether a particular assessment is legally required depends on your service, applicable code and any exemption.

Does it apply to every Australian business website?

There is no sound basis to tell every Australian business that it must complete this assessment today. Coverage turns on the online service you provide or control. A business profile on a social network is different from operating the network. The proposed framework includes powers to exempt low-risk services; staff numbers and turnover alone do not determine coverage.

Under the current designated internet services age-restricted material code, qualifying general-purpose and enterprise services have an exemption from that code’s risk-assessment requirement. That exemption does not remove all other online safety obligations or decide coverage under the proposed duty.

What would a risk assessment need to cover?

The proposal is about foreseeable harm to people using online services. A useful assessment records the service’s features and audience, possible harms, people affected, current controls, outstanding evidence and the steps needed to reduce risk. It should consider children and other users who may face greater risks.

List your websites, apps, communities and public social profiles.
Review features such as user posts, messaging, recommendations and AI interactions.
Assess harmful content, contact and conduct that those features may enable.
Document safeguards, reporting routes, moderation and responses to incidents.
Assign actions to an owner, check whether controls work and review after changes.

How often would assessments be reviewed and kept?

The introduced Bill and agreed amendments propose annual written assessments, reassessment before significant changes that introduce additional risk, and retention for at least six years. The Commissioner could require a shorter assessment period. Check the final legislation, commencement and any service-specific requirements before relying on these proposed timings.

How Riskwise.au can help

Riskwise.au is designed to combine your answers with available public website and social-profile evidence into an AI-assisted risk assessment. The report separates observed evidence, your own information and unknowns, then recommends practical actions. It is a starting point for owner review, not a compliance certificate or a guarantee that every relevant risk has been found.

Public information cannot reveal every post, private setting, moderation process or internal safeguard. Verify the findings and keep your downloaded report with your supporting records. Riskwise.au does not archive assessments for you.

Explore a sample assessment Ask Lewis a question

Official sources and Bill downloads

Read the primary documents before making a decision about your obligations. Parliamentary status and the final text can change.

Independent general information, not legal advice. Legal context reviewed 29 October 2026.