Digital Duty of Care risk assessment: what to include
The proposed Digital Duty of Care asks online services to write down the risks their service poses to users and what they're doing about them. If you already do risk assessments for work health and safety or privacy, the idea will feel familiar.
Last updated
The short answer
Under the Digital Duty of Care Bill 2026, a provider of an online service would need a written risk assessment that identifies all reasonably foreseeable risks of harm the service poses in Australia, including from design features and to particular groups such as children, assesses the likelihood and severity of each risk, records the measures in place or planned and how effective they are expected to be, and is reviewed regularly. Under the exposure draft, assessments must be reviewed at least yearly and before risky changes, kept for six years and given to the eSafety Commissioner within 30 days if asked.
What the risk assessment is for
The risk assessment is how a service shows it is meeting the duty to provide a safe online environment. It isn't a one-off report. Under the draft bill, it has to be kept current as the service changes, and the eSafety Commissioner can set extra requirements for what it contains. Until the law is final and eSafety publishes guidance, the details below are based on the bill as drafted and introduced, and law firms' summaries of it.
What to include
The service and its users
What the service is, who uses it, whether under-18s can, and roughly how many Australian users it has.
Every reasonably foreseeable risk
Harmful material, harmful conduct such as bullying or grooming, and harm that comes from design features themselves.
Design features
Recommendation feeds, endless scroll, likes and counts, disappearing messages, direct messaging, live streaming and AI tools.
Who could be affected
Children, people experiencing vulnerability and any other groups at higher risk on your service.
Likelihood and severity
How likely each risk is and how serious the harm could be, rated consistently.
Measures and effectiveness
What you have in place or plan to add, such as moderation, reporting, blocking, safe defaults or age checks, and how well you expect each to work.
Review and records
When it was last reviewed, what triggers the next review, who signed it off, and where the six years of versions are kept.
Who should start one
- Businesses running apps, communities, marketplaces or platforms where users interact.
- Services used by children or young people.
- Websites with public comments, reviews, uploads or member areas.
- Businesses offering AI chat or content tools to the public.
- Small businesses with simple websites can wait for the final law and guidance, but a short list of what the site lets users do is still worth having.
A simple way to start
- Pick one service. Start with the one with the most users or the most interaction between users.
- List what users can do. Post, comment, message, upload, stream, follow, buy or use AI. Each one is a place a risk can come from.
- Ask what could go wrong. For each feature, write down the realistic harms, who they'd affect, and how likely and serious they are.
- Record what you do about it, and set a review date. Note each measure, who owns it and when you'll look again. Review before any change that could add new risks.
How WaTo can help
- We can produce the technical inventory a risk assessment needs: every service, plugin, integration and feature, and what each one lets users do.
- Our website security and compliance audit covers this for websites, along with security and privacy.
- We can build the measures the assessment points to, such as reporting buttons, moderation queues and safer defaults. Your lawyer should review the assessment itself.
Risk assessment questions
Is there an official Digital Duty of Care risk assessment template?
Not yet. The bill isn't law, and the eSafety Commissioner would be expected to publish guidance during the 12 months before the duty starts. Until then, use the parts on this page as a starting structure.
How often would it need reviewing?
Under the exposure draft, at least once a year and before any change to the service that could introduce new or additional risks.
How long would we need to keep it?
Six years under the exposure draft, and you'd need to be able to give it to the eSafety Commissioner within 30 days of a request.
Can we use our existing risk register?
Probably as a starting point. Work health and safety, privacy and cyber security risk registers already use likelihood and severity. You'd add the online harms and design features specific to your service.
Does a small business website need one?
As drafted there's no small business exemption, but a simple site where visitors can't post or interact poses little risk and the Minister could exempt low-risk services. Wait for the final law, and keep a short list of what your site lets visitors do.
How WaTo can help with this
Guides on this topic
- The Digital Duty of Care, explained
- Digital Duty of Care for larger businesses, apps and platforms
- Does the Digital Duty of Care apply to my small business?
- A practical cyber security policy for small business
Sources & references
- Clayton Utz: Safe by design, unpacking Australia's proposed digital duty of care for online services (September 2026)
- MinterEllison: Australia's new digital duty of care, what it means
- Allens: Australia's digital duty of care, what the draft bill means for online services (September 2026)
- Department of Infrastructure: Online Safety Amendment (Digital Duty of Care) Bill 2026, exposure draft (September 2026)
WaTo Consulting. Last reviewed 2026-11-07. Review after the Senate vote and when eSafety publishes risk assessment guidance.
Want help with the technical side?
Book a call and we'll map what your websites and apps let users do, so your risk assessment starts from facts.
Mon to Fri, 8:30am to 5pm
