Australia’s Digital Duty of Care: What It Means If You Run an AI Chatbot

Australia is about to put a legal duty of care on the companies behind online services, and AI chatbots are in it. The Online Safety Amendment (Digital Duty of Care) Bill 2026 passed the House of Representatives on 28 October 2026. If your business offers an AI chatbot or other AI tool to the public, this is the time to understand what is coming and to start building the evidence an auditor or regulator will ask for.

Short answer

The bill would require a broad range of online service providers, including services that generate material using AI, to identify and manage foreseeable online harms proactively, carry out regular risk assessments, and meet transparency, user empowerment and age assurance requirements, with the eSafety Commissioner enforcing it. Amendments accepted in the House target chatbots that simulate emotional intimacy with children. The duty would apply 12 months after Royal Assent. It is not law yet, but the risk assessment work it will require is the same work ISO 42001 already asks for.

Where the bill is up to

What the bill does

• A proactive duty of care. Providers would have to identify and manage foreseeable online harms, including harms that arise from platform design, recommender systems and AI features, rather than reacting to complaints.
• Broad coverage. Social media, search engines, hosting services, app distribution services, and services that generate material using AI.
• Risk assessments. Regular, documented assessments of the harms a service could cause.
• Transparency, user controls and age assurance. Requirements to explain how services manage harm, give users tools to protect themselves, and take reasonable steps on age.
• One framework. The duty would replace the current industry codes, standards and basic online safety expectations after a 12-month transition.
• Stronger enforcement. Expanded eSafety Commissioner powers and higher penalties, reported at up to A$109.2 million.

Law firm Pinsent Masons has a useful summary of the bill as introduced. The exact compliance standard, penalties and any private right of action are among the points still being debated, so treat the detail as provisional until the Senate votes.

What it means for AI chatbots

AI is not an afterthought in this bill. Services that generate material using AI are named in scope, and the duty extends to harms arising from AI features. Independent MP Kate Chaney’s amendments, accepted by the government in the House, go further for chatbots: providers must address material or conduct that simulates emotional intimacy and encourages a child’s dependence on it. That provision is aimed at children, not adults using AI companions.

Which business chatbots are caught will depend on the final definitions. A public-facing AI assistant or content tool, especially one young people can reach, is the most likely to be in scope. An internal tool used only by staff is less likely. Either way, the work the duty will require is the same work that good AI governance already calls for.

What to do now

Nothing in the bill is in force yet, and there is at least a year between Royal Assent and the duty applying. But the obligations will centre on documented risk assessment, and that takes time to do well. These steps are worth taking now whatever the Senate decides:

1. List your public-facing AI. Every chatbot, assistant or content generation tool customers or the public can use, who it is for, and whether young people can reach it.
2. Assess the harms. For each one, document what could go wrong for users: harmful or misleading output, dependence, privacy, manipulation, and harms to children in particular.
3. Check the design. Guardrails, content filters, escalation to a human, and how the tool responds to a distressed or vulnerable user.
4. Set up reporting and response. A way for users to report a problem, a process to act on it, and records of what was done.
5. Keep the evidence. Dated assessments, decisions and reviews. When a regulator asks, the record is what counts.
6. Watch the definitions. Check the final text after the Senate vote to confirm whether and how your services are covered.

Where ISO 42001 fits

ISO 42001, the AI management system standard, already requires most of this. It asks organisations to assess AI risks, carry out AI system impact assessments on individuals and groups, treat the risks, and monitor how AI systems behave in use, with documented evidence at each step. An organisation that builds those processes now will be well placed when the duty of care arrives, whatever its final shape. Our guide to ISO 42001 requirements sets out what the standard asks for, and who can read your AI chats covers the privacy side of running AI tools.

We will keep this updated

This article reflects the bill as passed by the House on 28 October 2026. We will update it when the Senate committee reports, when the Senate votes, and when the bill receives Royal Assent, including what the final text means for business chatbots.

How Streamline helps

We help organisations build ISO 42001 AI management systems, including the AI risk and impact assessments that a digital duty of care will expect. Read about our ISO 42001 consulting, or talk to us about governing your AI tools.

Frequently asked questions

Is the Digital Duty of Care law yet?

No. The Online Safety Amendment (Digital Duty of Care) Bill 2026 passed the House of Representatives on 28 October 2026. It is before the Senate, where a committee is due to report by 20 November 2026. It becomes law only after it passes the Senate and receives Royal Assent, and the duty is expected to apply 12 months after that.

Does the Digital Duty of Care apply to AI chatbots?

The bill covers online services that generate material using AI, alongside social media, search, hosting and app distribution services. Amendments accepted in the House add chatbot conduct that simulates emotional intimacy and encourages a child’s dependence to the harms providers must address. Exactly which business chatbots are caught will depend on the final definitions.

What will providers have to do?

Based on the bill as passed by the House, providers will have a proactive duty to identify and manage foreseeable online harms, including harms arising from design and AI features, carry out regular risk assessments, and meet transparency, user empowerment and age assurance requirements. The detail may change in the Senate.

How does ISO 42001 help with the Digital Duty of Care?

ISO 42001 requires documented AI risk assessments, AI system impact assessments, risk treatment and ongoing monitoring. That is the same discipline a duty of care will expect, so an organisation with an ISO 42001 system will have most of the evidence already in place when the obligations are finalised.