Australia's Digital Duty of Care

Australia’s proposed digital duty of care is one of the most important online safety reforms now moving through the policy pipeline. It is not just another content takedown scheme. It is an attempt to shift online safety law from a reactive model, where platforms respond after harm has already happened, to a systems-based model, where services must identify foreseeable risks, reduce those risks in product design and operation, and show regulators that they are doing so.

The reform matters for AI safety because the online environment is increasingly shaped by algorithmic ranking, recommender systems, automated moderation, generative AI, synthetic media, chatbots and agentic tools. Harm is no longer only a matter of individual users posting bad content. It can arise from the design of the service itself: what gets amplified, what gets recommended, how easy abuse is, how opaque decisions are, whether children are exposed to dangerous material, and whether AI-enabled tools make deception or exploitation easier.

In May 2026, the Australian Government released an issues paper called A Digital Duty of Care for Australia. In September 2026, it released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026. Public consultation on that draft closed on 22 September 2026. The proposal remains politically and legally contested, but its direction is clear: Australia wants online services to take responsibility for foreseeable online harms as part of ordinary product governance.

What a digital duty of care means

A duty of care is a familiar idea in other areas of law and regulation. Employers must manage workplace safety risks. Product suppliers must consider consumer safety. Professionals may owe duties to clients. The digital duty of care applies similar logic to online services. If a service creates or controls an environment where foreseeable harms can occur, it should take reasonable steps to prevent or reduce those harms.

The important word is “reasonable”. A duty of care does not mean perfect safety. It does not mean every bad event becomes the platform’s legal fault. It means the provider must take proportionate steps, based on the nature of the service, the risks it creates, the users it serves, the design features it controls and the practical measures available to it.

This is a major shift from older online safety frameworks. Traditional online safety rules have often focused on specific categories of content, complaint systems and removal notices. Those tools still matter. But they are limited. They usually act after the harm has been reported. They also struggle when harm is produced by ranking systems, addictive design patterns, private messaging abuse, synthetic media, livestreaming, coordinated harassment, algorithmic amplification or AI tools that can generate harmful material at scale.

A systems-based duty asks different questions. What risks are foreseeable before launch? Which product features increase exposure to harm? How does the recommender system behave? Are children likely to access the service? Are vulnerable users given effective controls? Does the service make reporting easy? Are enforcement systems working? Are safety decisions measured, audited and improved over time?

Why Australia is pursuing the reform

The digital duty of care comes out of the broader review of the Online Safety Act 2021. Australia’s online safety framework was seen as strong when first developed, particularly because of the eSafety Commissioner and the use of removal schemes. But the online ecosystem has changed quickly. Social platforms, search engines, gaming services, messaging services, livestreaming platforms and AI-enabled products now mediate much of public and private life.

The Office of Impact Analysis summary says the review found that the existing approach had not kept pace with rapid changes in the online environment. It also notes that other jurisdictions, including the United Kingdom and European Union, have moved towards systems-based regulation that places responsibility on online services to proactively manage user safety risks. The Australian proposal is part of that wider international turn.

The government’s stated goal is to move from a model that depends heavily on individual users reporting harm to one that makes service providers responsible for safety by design. That is a sensible ambition. Users should not have to carry the whole burden of defending themselves from systems deliberately optimised for engagement, attention and behavioural influence.

At the same time, the reform needs careful limits. Online safety law can easily collide with freedom of expression, privacy, anonymity, access to information and the legitimate operation of low-risk services. A good duty of care should be targeted, proportionate, transparent and contestable. A bad one could become vague, censorial or administratively heavy.

The core obligations

The September 2026 exposure draft proposes a broad duty on providers of online services to ensure, so far as reasonably practicable, a safe online environment for people in Australia, with particular attention to children. In practical terms, that means services may need to identify and assess risks, take steps to mitigate them, document their reasoning and respond to regulatory directions.

The impact analysis describes the proposed model as a singular overarching duty of care underpinned by safety-by-design principles, risk assessment, risk mitigation and measurement. It also refers to reporting and transparency obligations for high-risk services, code-making powers to support compliance, possible audit requirements, internal dispute resolution, expanded removal powers for certain harmful services, and stronger monitoring and investigation powers for eSafety.

This is not a narrow moderation rule. It reaches product governance. That is why businesses should pay attention even if they are not social media giants. The more a service has user-generated content, algorithmic ranking, recommender systems, messaging, community features, child users, anonymous interaction, synthetic media tools or AI chat functions, the more likely it is to raise duty-of-care questions.

The duty also appears intended to be technologically neutral. That matters because online harms mutate. A law that only lists today’s tools will be stale by the time it is enforced. A duty framed around foreseeable harm, risk management and reasonable steps is more adaptable. It can cover deepfakes, nudification tools, AI-generated child sexual abuse material, algorithmic radicalisation, harassment, scams, impersonation and other emerging risks without rewriting the Act every year.

Safety by design

The proposed duty closely matches the eSafety Commissioner’s long-running Safety by Design work. Safety by Design rests on three broad ideas: service provider responsibility, user empowerment and autonomy, and transparency and accountability. The point is that safety should be built into the lifecycle of a product, not bolted on after abuse is already visible.

For online services, this can mean testing harmful-use cases before launch, giving users meaningful controls, defaulting children into safer settings, creating accessible reporting channels, making blocking and muting effective, limiting amplification of harmful material, training moderation systems, measuring enforcement quality, consulting affected communities and publishing transparency information.

For AI-enabled services, safety by design should also include model evaluation, red teaming, misuse testing, safeguards against synthetic intimate abuse, provenance and labelling where appropriate, escalation pathways, human review for sensitive decisions, and careful control over what autonomous agents can do. If a platform lets users generate realistic images, run persuasive chatbots, automate outreach or simulate real people, the duty-of-care analysis becomes more serious.

Safety by design is not anti-innovation. Done properly, it is disciplined innovation. It asks builders to understand the harms their systems can create and to design against them early, when controls are cheaper and more effective. Retrofitting safety after a scandal is almost always worse.

The AI safety connection

Australia’s digital duty of care is formally an online safety reform, not a general AI Act. But AI is now part of the online safety problem. The government’s July 2026 AI consumer safety priorities expressly linked the digital duty of care to AI companies, saying the duty would put the onus on AI companies to build in safety by design and proactively address potential harm.

The link is easy to understand. AI can increase the speed, scale and personalisation of online harm. Deepfake tools can create non-consensual intimate images. Voice cloning can support scams and impersonation. Chatbots can manipulate vulnerable people. Recommender systems can push users towards harmful content. Generative systems can produce convincing misinformation. AI agents can automate spam, harassment, phishing or fraud. Even well-intentioned systems can cause harm if their outputs are over-trusted, biased or poorly governed.

A digital duty of care therefore becomes one layer in Australia’s AI safety architecture. It sits alongside privacy reform, consumer protection, workplace AI safety, automated decision-making rules for government, the National AI Plan, the AI Safety Institute and voluntary AI safety standards. It does not solve every AI governance issue, but it creates a legal route for asking whether services have designed and operated AI-enabled systems responsibly.

This is especially important because many AI harms are not only model-level harms. They are product-level harms. A model may be technically capable, but the product may deploy it with poor defaults, weak reporting, excessive automation, no human escalation, misleading anthropomorphic design or unsafe recommender incentives. The duty of care focuses attention on the deployed service, where users actually experience the risk.

Risk assessment as the centre of gravity

The practical heart of the duty is risk assessment. A service should be able to explain what harms are foreseeable, which users are most exposed, which design features contribute to risk, what controls have been implemented, how those controls are measured, and what happens when they fail.

For a social platform, that might include analysis of recommender systems, viral amplification, harassment dynamics, child access, private messaging abuse and content moderation failures. For a gaming platform, it might include grooming risk, voice chat, monetisation, loot mechanics, user reporting and age-appropriate design. For an AI chatbot, it might include self-harm responses, manipulation, impersonation, unsafe advice, privacy leakage, hallucination and inappropriate engagement with minors.

A serious assessment should not be a checkbox document produced after launch. It should be part of product management. It should influence feature design, engineering priorities, policy rules, vendor procurement, incident response, testing and board reporting. It should also be updated when the product changes, when new misuse patterns appear or when the user base shifts.

This is where many organisations will struggle. They may have privacy impact assessments, cyber risk registers and trust-and-safety teams, but not an integrated method for assessing online safety and AI-enabled harms. The duty of care pushes toward a more mature governance stack: risk taxonomy, ownership, evidence, mitigations, metrics, escalation and review.

What reasonable steps might look like

Reasonable steps will vary by service, but some patterns are likely. Services may need clearer governance of safety risks, documented risk assessments, safer default settings, effective complaint pathways, stronger age-appropriate protections, transparency reporting, testing of high-risk features, moderation quality assurance, protections against abusive automation, and evidence that senior leadership receives and acts on safety information.

For AI systems, reasonable steps may include pre-deployment testing, model and feature-level red teaming, limits on high-risk outputs, safeguards against non-consensual intimate material, mechanisms for users to report harmful AI outputs, monitoring of misuse trends, robust vendor review, clear user disclosures, and human escalation for sensitive categories.

The strongest organisations will treat this as operational safety rather than legal paperwork. They will ask: what can go wrong, who is harmed, which design choices contribute to the risk, what can we change, how do we know whether the control works, and who is accountable when the evidence says it does not?

The hard questions

The proposal also raises hard questions. How will “harm” and “serious harm” be defined? Which services are in scope? How will the framework avoid pulling low-risk business tools, infrastructure providers or heavily regulated services into unnecessary compliance burdens? How will privacy be protected if regulators receive more investigative powers? How will lawful speech and access to information be preserved?

The Australian Human Rights Commission supports the proposed duty but has argued that clearer definitions of harm, limits on delegated rule-making and stronger human-rights considerations should be built into the Bill. Business groups have raised scope and proportionality concerns. Digital rights advocates have warned about overreach, censorship and surveillance risks. These concerns should not be dismissed as hostility to safety. They are part of making the framework legitimate.

A duty of care can be both necessary and dangerous if drafted poorly. The policy challenge is to make platforms responsible for preventable harm without giving government or large platforms an incentive to suppress lawful but controversial expression. The best version of the reform would focus on systems, design choices, risk controls, evidence and accountability rather than broad discretionary control over speech.

What businesses should do now

Even before the final Bill is settled, Australian organisations that operate online services should start preparing. First, map the service. Identify user-generated content, messaging, recommender systems, AI features, child access, identity features, reporting tools and moderation processes. Second, identify foreseeable harms. Include harms to children, adults, vulnerable groups, privacy, dignity, safety and autonomy.

Third, assess the controls. Are safety settings meaningful? Are complaints handled quickly? Are high-risk features tested before launch? Does leadership receive safety metrics? Are AI vendors reviewed? Are synthetic media risks addressed? Is there a process for responding to incidents? Fourth, document the reasoning. A regulator will not only ask whether the company cares about safety. It will ask what evidence supports that claim.

Fifth, connect online safety to broader AI governance. The same organisation may need an AI policy, AI risk assessments, vendor checks, privacy impact assessments, cyber controls, staff training and incident response playbooks. Digital duty of care compliance should not sit in a lonely legal folder. It should be connected to product, engineering, trust and safety, privacy, cybersecurity, procurement and executive risk management.

The bottom line

Australia’s digital duty of care is part of a broader move from reactive internet regulation to proactive technology governance. The old model asked platforms to remove harmful material after users complained. The new model asks whether the service was designed, tested and operated in a way that reduced foreseeable harm in the first place.

That shift is overdue. Online harms are increasingly systemic, algorithmic and AI-enabled. But the details matter enormously. A strong duty of care should be clear, proportionate, rights-respecting, evidence-based and focused on risks that services can actually control. It should make powerful platforms safer without turning online safety into a vague licence for censorship or surveillance.

For Australian businesses, the message is simple: safety is becoming a design obligation. If your service uses AI, recommender systems, user interaction, synthetic media or online community features, you should be able to explain your foreseeable risks and the steps you have taken to reduce them. That is not just compliance. It is the direction responsible digital business is heading.

Australia’s Digital Duty of Care