Digital Duty of Care for larger businesses, apps and platforms
If your business runs an app, a member community, a marketplace, a platform with user content or a service used by young people, the proposed Digital Duty of Care is likely to need real work. The bill would replace today's online safety codes with one broad duty, written risk assessments and penalties of up to $109.2 million. If it passes, there would be 12 months before the duty starts, and that's the time to do the groundwork.
Last updated
The short answer
Under the Digital Duty of Care Bill 2026 as introduced, the person responsible for an online service would have to provide a safe online environment for Australian users, manage design features such as recommendation feeds, provide user empowerment tools where required, conduct written risk assessments identifying all reasonably foreseeable risks, and take effective measures to address them. The bill as introduced uses an 'appropriate and effective' test and doesn't allow cost as a reason to do less. Civil penalties for companies could reach $109.2 million, and the duty would start 12 months after Royal Assent.
Who's responsible
Law firm Allens notes the duty applies to the provider of the service and to anyone in a position to exercise day-to-day control of it, and that it reaches overseas services used by Australians. Larger businesses often run several online services at once, such as a customer app, a website with reviews, a staff platform and an AI assistant. Each may need to be looked at separately. Lawful private communications solely between consenting adults are excluded from the duty under the exposure draft.
What you'd need to do
Written risk assessments
Identify all reasonably foreseeable risks of harm, including from design features, rate likelihood and severity, and record the measures in place. Under the draft, review at least yearly and before risky changes.
Records for six years
Keep each risk assessment for six years and be able to give it to the eSafety Commissioner within 30 days of a request, under the draft.
Design feature controls
Manage features such as recommender feeds, endless scroll, engagement counts and disappearing content. Social media services would face extra limits for under-16s.
User empowerment tools
Where required, let users control how features work for them, such as an option to turn off an algorithmic feed.
Complaints and transparency
The eSafety Commissioner could set minimum standards for complaint and dispute processes, require transparency reports and require an Australian point of contact.
Faster takedowns
Compliance periods for several removal notices would drop from 48 hours to 24 hours.
Who this page is for
- Businesses with customer apps, marketplaces or booking platforms where users interact.
- Membership organisations, clubs and associations with online communities.
- Education, childcare, sport and youth services where under-18s have accounts.
- Businesses offering AI chat or image tools to customers.
- Hosting providers and IT companies that run services for other businesses.
How to use the 12 months
- Map your online services. List every website, app, community and tool you run, who uses it, whether under-18s can, and what users can post, share or send.
- Draft a first risk assessment. Start with the highest-risk service. Our guide to Digital Duty of Care risk assessments sets out what to include.
- Fix the obvious gaps. Reporting buttons, moderation, blocking, age-appropriate defaults and the ability to remove content quickly.
- Set up a review cycle. Make risk review part of how you release changes, so a new feature isn't launched without one.
How WaTo can help
- We can map the online services, plugins and integrations your business runs and document what each one lets users do, which is the groundwork for a risk assessment.
- We build and maintain websites, apps and hosting, so we can add reporting, moderation and safer defaults, or remove features that carry more risk than value.
- We work alongside your lawyers. We handle the technical side, and they advise on the legal duty.
Larger business Digital Duty of Care questions
What's changed since the exposure draft?
According to law firm Pinsent Masons, the bill as introduced replaced the draft's 'reasonably practicable' standard with an 'appropriate and effective' test that excludes cost as a factor, and removed the Minister's power to expand the categories of harmful content. Law firm Johnson Winter Slattery also reports new carve-outs for some media and entertainment content.
What are the penalties?
Up to 60,000 penalty units: $109.2 million for companies and $21.84 million for individuals, according to Johnson Winter Slattery. The eSafety Commissioner could also issue formal warnings, which can be published, and remedial directions.
Does it replace the online safety codes?
Yes. Once the duty starts, it would replace the existing online safety industry codes and standards with one overarching duty.
Could people sue us directly?
Not under the bill as introduced. The Greens have asked for a right for people to sue, and the Minister has said the government is open to considering it, so watch for amendments.
When should we start?
Now is sensible if you run user-facing apps or communities. The duty wouldn't start until 12 months after Royal Assent, but a first risk assessment and the fixes it points to take time.
How WaTo can help with this
Guides on this topic
- The Digital Duty of Care, explained
- Digital Duty of Care risk assessment: what to include
- Does the Digital Duty of Care apply to my small business?
- Practical AI governance for small businesses
Sources & references
- Department of Infrastructure: Digital Duty of Care
- Pinsent Masons: Digital duty of care legislation introduced into Australian parliament
- Johnson Winter Slattery: Australia's proposed digital duty of care, what online services need to know
- Clayton Utz: Safe by design, unpacking Australia's proposed digital duty of care for online services (September 2026)
- Allens: Australia's digital duty of care, what the draft bill means for online services (September 2026)
- MinterEllison: Australia's new digital duty of care, what it means
WaTo Consulting. Last reviewed 2026-11-07. Review after the Senate committee reports (due 20 November 2026), after the Senate vote, and when eSafety guidance is published.
Running apps or online communities?
Book a call and we'll help you map your online services and get the technical groundwork for a risk assessment in place.
Mon to Fri, 8:30am to 5pm
