Online Safety Bill Would Make Small Businesses Do Yearly Risk Checks

A bill now before federal Parliament would require the business behind most websites and apps in Australia to write a risk assessment every year. The Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced on 15 October, and nothing in it exempts a business because it is small.

Communications Minister Anika Wells pitched it at big tech: social media, games, apps and AI chatbots, with penalties of up to $109.2 million for a company. But the new duty applies to every "online service", and that term includes what the Online Safety Act calls a designated internet service. In 2024 eSafety said that category covers most apps and websites people in Australia can reach, naming the websites of cafes, hairdressers and plumbers as examples. Under the industry standard eSafety made that year, most of those sites have no obligations because they present low risk. The bill changes that default: the risk assessment duty applies unless the Minister grants an exemption.

What the bill asks for

Under the bill, the person responsible for an online service must take appropriate action to keep users safe from seriously harmful material, and to protect children from material and design features that harm them. That includes written risk assessments that identify the reasonably foreseeable risks, the features that create them and who could be affected, rate each risk's likelihood and severity, and record what is being done about it.

Assessments must be done at least once a year, and again before any significant change to the service that could add new risks. They must be kept for at least six years and handed to the eSafety Commissioner within 30 days of a request.

Where a small business sits

For a small operator, the key provision is that the cost of a measure must not be taken into account in deciding whether it is appropriate. A business cannot argue that a safeguard is too expensive for its size. The counterweight is proportionality: measures must match the level of risk, judged on how likely harm is and how serious it could be, and a page with opening hours and a phone number carries very little.

Relief would have to come from the Minister, who could exempt low-risk services, or whole classes of them, from the risk assessment requirement. No such exemption exists yet. The Council of Small Business Organisations Australia (COSBOA) asked for an exemption for low-risk small business websites in its submission on the draft bill.

The bill has been referred to the Senate Environment and Communications Legislation Committee, which is due to report on 20 November. That is the window for industry groups to argue for an exemption. If the bill passes, the duty and the risk assessments start 12 months after it receives Royal Assent, so nothing is required of any business yet.

What to do now

Start by working out where your site sits. A site that only shows information, such as prices, hours and contact details, is the case COSBOA has asked to have exempted. Anything that lets customers post or message, such as reviews, comments, forums, live chat or customer accounts, is where foreseeable risks start. AI services that generate material are listed in the bill as a separate kind of online service, so a chatbot on your site is the feature the bill names most directly.

Ask your web developer or agency, in writing, which features on your site let people post, message or upload anything, including plugins and widgets. Both the business that provides a service and whoever has the most day-to-day control over it count as responsible, so handing your website to an agency does not hand over the duty. You would need that list anyway, and it costs nothing now.

Because an assessment is required before any significant change, a chatbot or customer forum added after the law starts would bring its own paperwork. Hold off paying for a compliance audit. The bill does not require an external auditor, eSafety has not yet set the form an assessment must take, and the Minister may still exempt low-risk sites.

This article is general information only and is not financial advice.