Australia's proposed Digital Duty of Care has small business owners asking whether their website will need a yearly "online safety risk assessment". The short answer: not yet, maybe never, and for most small business websites the job would be small. Here's what the bill says, where it's up to, and what it's likely to mean for a business like yours. Last updated 9 November 2026.
- The Digital Duty of Care is a bill before Federal Parliament. It isn't law yet, and it may change before it passes.
- As drafted, anyone running an online service would need a written risk assessment at least once a year. The draft has no automatic exemption for small businesses.
- If it passes, there's a 12-month transition before the duty starts, so nothing applies before late 2027 at the earliest.
- A simple website with service pages and a contact form is low risk. Features where people post, chat or upload are where the real work would be.
We build and manage websites. We're not lawyers. The bill may change before it passes, so check the final law or get legal advice before you rely on anything here. We'll update this post as the bill moves.
What is the Digital Duty of Care?
It's a proposed change to Australia's Online Safety Act. The Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced to Parliament on 15 October 2026, after a short public consultation on a draft in September.
The idea is to make the people running online services responsible for keeping users safe, instead of only reacting to complaints. They'd have a legal duty to take reasonable steps to prevent foreseeable harm to people in Australia who use their service.
The big targets are social media, messaging apps, search engines, app stores and AI tools. But the duty is written broadly, and it covers "designated internet services". That category takes in most websites, which is why small businesses are paying attention.
What would the risk assessment involve?
As drafted, anyone responsible for an online service would need to:
- Write down the risks of harm their service could reasonably cause, including from how it's designed
- Rate how likely and how serious each risk is
- Note what they do, or will do, to reduce each risk, and how well it works
- Review the assessment at least once a year, and before any change that could add new risks
- Keep each assessment for 6 years
- Hand it to the eSafety Commissioner within 30 days if asked
The draft doesn't require an outside auditor, and it doesn't say you have to send the assessment anywhere unless you're asked for it.
The maximum penalties are huge, up to 60,000 penalty units (around $109 million for a company). They're designed for the global platforms. eSafety would also be able to give warnings and directions before reaching for fines.
Does it apply to small business websites?
As the bill is written, possibly yes. There's no automatic exemption based on business size or turnover, and the law firms reviewing it agree that ordinary business websites could be caught.
There are two ways a small business could end up exempt:
- Ministerial exemptions. The Minister for Communications could exempt whole classes of services that pose little risk to users. A brochure website for a plumber is an obvious candidate.
- Changes before it passes. COSBOA, the council of small business groups, has asked for low-risk businesses to be left out. Others have suggested exempting businesses with fewer than 50 staff or under $5 million in turnover. The government has said low-risk websites would face minimal obligations.
So the honest answer is "wait and see". But the direction is clear: the more your website lets people do, the more there is to assess.
Where it's up to (November 2026)
What makes a website higher or lower risk?
The risks the law cares about come from what people can do on your site, and who's likely to be using it. Here's a rough guide, based on the bill as drafted.
| Website feature | Likely risk | Why |
|---|---|---|
| Service pages, prices and photos | Low | Visitors only read. Nobody can post anything. |
| Contact or quote form | Low | Messages come to you privately. Nothing is shown to other visitors. |
| Your Google reviews shown on the site | Low | The reviews are posted and moderated on Google, not on your site. |
| Online booking | Low | Private between you and the customer. |
| AI chat assistant | Worth a look | It writes replies in real time. Check what it can say and that it can't be misused. |
| Comments, forums or customer uploads | Higher | Other people can post things that every visitor sees. |
| Member logins, messaging between users, or users under 18 | Higher | This is the kind of service the duty is mainly aimed at. |
For a typical tradie or local service website, everything sits in the top half of that table. If the duty applies, a risk assessment for a site like that could be a page or two, reviewed once a year.
What should you do now?
Nothing is required yet. But a few small steps will put you in a good spot whatever happens:
If someone else builds and runs your website, ask them how they'll handle it if the law passes. They already know every feature on your site, so they're best placed to help you write the assessment.
A website you don't have to worry about
Our small business websites are built with only the features you need, and we look after them every month on a managed plan.
Frequently asked questions
No. As of 9 November 2026 it's a bill before Federal Parliament. A Senate committee is due to report on 20 November 2026, and the bill still needs to pass both houses.
Get website tips by email
One short email a month on winning more enquiries. No spam, unsubscribe any time.
Rhys builds and looks after every Reactive Web website himself, from Redwood Park in Adelaide, for local service businesses that want more calls, bookings and enquiries.
