The Digital Duty of Care bill reaches services that generate material using AI. That's the chatbot on your website. Here's what it would owe.

On 28 October the Online Safety Amendment (Digital Duty of Care) Bill 2026 passed the House of Representatives, with 23 amendments agreed on the way (Parliament of Australia, 2026). Most of the coverage was about big tech, the algorithm opt-out and chatbots that get too close to children.

The bill puts a duty, enforced by eSafety, on whoever's responsible for an "online service" to keep it safe. In the version that passed the House, the list of online services takes in ordinary websites and anything that generates material using AI, with no size threshold. That's the chatbot in the corner of an ordinary business website, and the Senate inquiry is where to ask whether it's meant to be.

Proposed section 25B(1) lists nine kinds of online service. Paragraph (d) is "a designated internet service", a category eSafety's own register says "includes websites" (eSafety Commissioner, 2026). Paragraph (h) is "a service that generates material using artificial intelligence and that uses an internet carriage service in the course of doing so" (Parliament of Australia, 2026). The explanatory memorandum says (h) is there "for the avoidance of doubt", and lists "chatbots providing inappropriate and harmful responses" among the problems it's meant to fix (Explanatory memorandum, 2026).

So a support chatbot is on the list twice: as part of your website, and as an AI service in its own right. The September exposure draft only caught AI services whose users could "share that material" through another listed service (Exposure draft, 2026). A bot answering delivery questions shares nothing. Paragraph (h) dropped that condition.

Section 25B(2) then says "Each of the following is a person responsible": "the person who provides the service" and "the person who exercises the greatest degree of day-to-day control over the service". Note the "each". If your bot's a vendor's widget, the vendor may well be responsible for it as an AI service. That doesn't take you out, because you still provide the website it sits on. The EM adds that the definition "does not provide for any defence to liability".

There's no user-number, turnover or small-business threshold anywhere in the Part, and the EM says "the Duty applies to all online services under the Act". The one off-ramp is a ministerial power to exempt services that "pose little risk to users" (s 25B(3)), and the bill's own note says one could lift the risk-assessment requirement. None can exist until it's law. COSBOA's chief executive, Skye Cappuccio, told SmartCompany on 22 October: "We are very concerned that, as drafted, the bill will increase the compliance burden on small businesses that are exceedingly low risk." Her example was a hairdresser's website (SmartCompany, 2026).

Jim Stewart, an SEO, put the site owner's version on 28 October.

Jim Stewart

@jimboot

The proposed Digital Duty of Care is bad enough but it gets worse. The scope is broad enough to potentially capture ordinary business websites and ecommerce stores. Assuming you're outside it because you only sell products online would be a mistake.

For services covered by the

3

28 Oct 2026

What a chatbot would owe

The person responsible would have to:

• "take appropriate action to ensure a safe online environment, including by taking effective measures to mitigate risks identified in risk assessments" (s 26)
• judge that action by whether it works and is "proportionate to the level of risk", while "the cost of the action or measures must not be taken into account" (s 26A)
• ensure "written risk assessments are conducted for the service" at least annually and before any significant change that "could introduce new or additional risks", and keep them "for at least 6 years" (s 27)

Each one has to identify the "reasonably foreseeable risks" and the "persons who may be affected", rate likelihood and severity, and record how well the mitigations are expected to work. For a bot answering questions about returns, proportionality probably keeps the action light. The paperwork doesn't shrink the same way, and a useful assessment has to deal with what the model says when a 14-year-old pushes it off-script.

A safe online environment includes protecting children from the s 25E harms, whatever the service is aimed at. The House added Kate Chaney's paragraph (da), aimed at companion apps but written into the general list: "material or conduct that simulates emotional intimacy and encourages or fosters a child's dependence on it in place of human relationships". The EM's softer line is that "individual pieces of harmful content found on an online service will not necessarily constitute a breach".

The duty starts 12 months after Royal Assent, the Bills Digest says (Parliamentary Library, 2026). The ceiling for breaching it is 60,000 penalty units (s 26C), which at $364 a unit (ASIC, 2026) is $21.84 million, or up to $109.2 million for a body corporate, the figure in the minister's own release (Minister for Communications, 2026). A ceiling, not a forecast for a florist's chatbot.

Who's out, and what's unclear

Section 25A(1) says the Part "does not apply in relation to an authority or agency of a State or Territory" to the extent it provides or controls the service. A state health department's bot looks excluded. Commonwealth agencies, private clinics and GPs aren't excluded. Councils are created under State law, but the bill doesn't mention local government, so whether a council's chatbot is caught is unclear.

So is how two responsible people share one duty. As far as I can see, the bill doesn't say who should've caught it when a vendor's model says something harmful on your site. For most businesses that's the question to put to the committee, and to the vendor.

The best case against this piece is that the duty's risk-scaled, the EM says the definition is "intended to align with the entities currently regulated or otherwise captured by the Act", and websites have sat under eSafety's standards since 2024. Fair. What's new is a written, annual risk assessment kept for six years, and until an exemption names your kind of service, it applies.

The Senate committee holds public hearings in Canberra on 9 and 10 November and reports on 20 November (Parliament of Australia, 2026). The Coalition opposed the bill and the Greens want it wider, with "real teeth" and a right to sue (ABC News, 2026). No law-firm note or submission I've read has asked the narrower question: is a support bot on an ordinary website meant to be inside, and if so, whose?

Two things cost nothing. Read s 25B and s 27 in the bill itself rather than a summary, this one included. Ask your chatbot vendor, in writing, who controls the bot day to day and who they think carries the duty.

This is a reading of a bill that hasn't passed the Senate, and it isn't legal advice.

If someone asks me next year whether the chat widget on their site needs a written risk assessment, I don't yet know what I'll tell them. It depends on the Senate, and on an exemption that doesn't exist yet.

---