Australia’s proposed digital duty of care laws are intended to make online services safer. While much of the attention has focused on major technology platforms, businesses and not-for-profit organisations should also be watching how the legislation develops.
The Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced to Parliament on 15 October. It would place greater responsibility on online service providers to identify and reduce foreseeable online harms.
However, questions remain about whether ordinary organisational websites could be covered and what smaller operators might need to do.
What would the laws change?
The Australian Government’s proposed framework would require online service providers to take reasonable steps to keep Australian users safe, with additional protections for people under 18.
The approach shifts responsibility towards preventing harm through the way online services are designed and managed, rather than primarily responding after harmful material or conduct has been reported.
The reforms also include greater user control over recommended social media content through “My Feed, My Way”, which we explored in an earlier article. This article focuses on the potential implications for websites and other online services operated by businesses and NFPs.
The legislation has not yet passed, and its final requirements may change.
Why are small business organisations concerned?
The definition of an online service is broad enough to raise questions about the inclusion of straightforward business websites.
The Council of Small Business Organisations Australia (COSBOA) supports the objectives of safer online services and greater platform accountability. However, it has called for an explicit exemption for low-risk small business websites.
Its concern is that businesses with websites providing basic information about their services, opening hours and contact details could face additional compliance work despite presenting little risk.
In its submission on the exposure draft, COSBOA highlighted the absence of a threshold based on business revenue, employee numbers or user numbers. It argued that smaller operators need certainty about whether they would be covered.
The Government has said low-risk small business websites and applications would have minimal obligations, with further regulatory guidance to follow. However, minimal obligations are different from an explicit exemption.
That distinction matters for organisations trying to understand what the reforms could mean for them.
What about not-for-profit organisations?
The potential relevance extends to NFPs because the proposed framework focuses on the online service being provided. Organisations should not assume that charitable or not-for-profit status automatically excludes them.
Legal analysis from Allens highlights the broad scope of the exposure draft, including many website operators.
For an NFP, relevant services could include community forums, member discussion spaces or features that allow people to upload and share content. A website providing service information presents different risks from an interactive platform where participants communicate with one another.
COSBOA’s submission specifically represents small business concerns. However, the broader questions about coverage, proportionality and administrative workload are also relevant for smaller NFPs with limited staff and resources.
Whether particular obligations apply will depend on the final legislation, the service an organisation operates and any applicable exemptions.
What could covered organisations be required to do?
COSBOA’s submission identifies potential obligations for covered services to prepare written online safety risk assessments, review them at least annually and before relevant service changes, and retain records for six years.
These assessments concern foreseeable online safety harms associated with a service and its features. They should not be confused with a routine website security check.
Recent reporting by SmartCompany examines the potential administrative burden and costs for small businesses. Although its headline refers to mandatory audits, the article explains that the proposed assessments would not automatically require an external auditor.
The extent of any work required would depend on the final requirements and regulatory guidance. It would therefore be premature to assume every business or NFP needs to purchase a compliance assessment.
What should businesses and NFPs consider now?
Understand what your website allows people to do. A website displaying information operates differently from one that allows users to upload material, post comments or communicate with each other. Ask your website provider to explain the features your site includes.
Consider online safety when adding new features. Community forums, user-generated content and AI tools can introduce different risks. Understanding how these features operate, who uses them and how concerns are addressed is useful regardless of the final legal requirements.
Clarify responsibilities. Establish who manages website content, interactive features and complaints, including where an external agency or developer is involved. For NFPs, this may also involve clarifying the roles of staff and volunteers.
Monitor the legislation and guidance. The Government’s digital duty of care information page provides an official source for updates. Industry associations and sector peak bodies can also help organisations understand relevant developments.
Clear guidance will be essential
Businesses and NFPs have an interest in safer online services, both as operators and as users. Smaller organisations also need to understand what is expected of them without taking on unnecessary administrative work.
Clear exemptions, proportionate requirements and practical guidance will help organisations plan for any changes. For now, understanding how your website operates and who is responsible for its features is a sensible place to start.