Part of the AI Regulation News hub.
Australia's Digital Duty of Care Bill, passed by the House of Representatives on 28 October 2026, would make services that generate material using AI subject to a duty of care enforced by the eSafety Commissioner
This is a bill that has cleared one house, not an Act. If enacted as it now reads, the duty would reach any service that generates material using AI over an internet carriage service, with civil penalties set in penalty units.
Bottom line: A bill, not law. It was introduced on 15 October 2026 and passed by the House of Representatives on 28 October 2026. A Senate committee report is due on 20 November 2026. The obligations described below would apply only if the bill is enacted, and the main duty would start no earlier than the day after twelve months from Royal Assent.
Who this affects: Providers of AI chatbots and other generative AI services available in Australia, social media and search providers, and the in-house counsel and trust and safety leads who would own the risk assessments.
Issue date: Introduced and read a first time 15 October 2026; third reading agreed 28 October 2026 (House of Representatives). Senate Environment and Communications Legislation Committee report due 20 November 2026.
What changed: The bill would replace the industry code framework and Basic Online Safety Expectations with a statutory digital duty of care, and it lists a service that generates material using AI as an online service.
Analysis: On our reading, the AI hook is the definition of online service in new section 25B, not a separate AI chapter. Whether a given chatbot is caught turns on that definition, the exemption power in the same section and the risk assessments the bill would require.
Primary sources: Parliament of Australia bill page (r7553) · Bill as read a third time (PDF) · Explanatory memorandum (PDF)
- Instrument (EN)
- Online Safety Amendment (Digital Duty of Care) Bill 2026, amending the Online Safety Act 2021
- Authority
- Parliament of Australia; government bill; eSafety Commissioner as regulator
- Jurisdiction
- Australia, Commonwealth
- Status
- Passed the House of Representatives 28 October 2026. The page's progress table lists no Senate stage
- Bindingness
- Not law. A bill has no force until it passes both houses and receives Royal Assent
- Issue date / next deadline
- Senate committee report due 20 November 2026
- Commencement as drafted
- Schedule 1 the day after Royal Assent; Schedules 2 and 3 the day after the end of 12 months beginning on the day of Royal Assent
- Penalties as drafted
- Civil penalty of 60,000 penalty units for failing the duty of care (s 26C); 6,000 penalty units for failing a remedial direction (s 26E)
- Primary source
- https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7553
Where does the bill stand?
The Parliament's bill page shows the bill introduced and read a first time on 15 October 2026, second reading agreed on 28 October and third reading agreed the same day, after amendments from the government and the crossbench were agreed. It was referred on 15 October to the Senate Environment and Communications Legislation Committee, with a report due on 20 November 2026.
The page's status field still reads Before Reps, and its progress table lists no Senate stage. We treat the bill as having passed one house and nothing more. Text can still change in the Senate.
How does an AI service get inside the duty?
New section 25B lists what counts as an online service. Paragraph (h) reads: a service that generates material using artificial intelligence and that uses an internet carriage service in the course of doing so. The person responsible for the service is the provider, or for the listed services the person with the greatest degree of day-to-day control over it.
Section 25B also lets the Minister exempt a service or class of services by legislative instrument if satisfied that they pose little risk to users in Australia. The explanatory memorandum, which accompanied the first-reading version, says the paragraph is included for the avoidance of doubt.
The duty itself, in section 26, would require a person responsible for an online service to take appropriate action to ensure a safe online environment, including effective measures to mitigate risks identified in risk assessments. The bill excludes cost from the matters considered when judging whether measures are appropriate or effective.
What would a provider have to do?
If enacted as read, a responsible person would need written risk assessments that identify reasonably foreseeable risks and the design features that give rise to them, assess likelihood and severity, and record the mitigations and their expected effectiveness. The assessments would be done at least annually and before significant changes, kept for at least six years and handed to the Commissioner within 30 days of a request.
The explanatory memorandum uses a public-facing generative AI service as an example of a provider that may need to assess the risk that the service will generate harmful material, and names testing before deployment and safeguards on prompts and outputs as possible controls. Those are examples in the memorandum, not text of the bill.
Two other provisions are relevant to chat products. Material that simulates emotional intimacy and encourages a child's dependence on it in place of human relationships is listed as harmful to children. And where there is a reasonably foreseeable risk a child could reach pornography, a responsible person would need, where technically feasible and reasonably practicable, a choice of at least two age assurance measures and access controls. Whether a particular companion app falls within either is our inference, not something the bill says.
What are the penalties and who enforces?
Failing to comply with the duty of care would carry a civil penalty of 60,000 penalty units. So would failing to keep, make available and retain risk assessments, and failing the age assurance requirement. Failing to comply with a Commissioner's remedial direction would carry 6,000 penalty units. The Commissioner could also issue formal warnings.
The bill text we read does not convert penalty units into dollars, and we have not done so. Schedule 1 separately raises several existing penalties to 6,000 or 60,000 units.
When would any of this start?
As drafted, Schedule 1, which deals with notices for certain material and information disclosure, would commence the day after Royal Assent. Schedule 2, which contains the digital duty of care, and Schedule 3, which repeals the online content scheme industry codes and standards, would commence the day after the end of the 12 months that begin on the day of Royal Assent.
Because Royal Assent has not happened, no commencement date exists yet. Any compliance calendar built today would rest on a bill that may be amended in the Senate.
What we did not verify
What we opened: the Parliament's bill page, the bill as read a third time (full PDF as extracted by our scraper) and the explanatory memorandum to the first-reading bill. Section numbers, penalty units and commencement terms come from the third-reading text.
What we did not open: the supplementary explanatory memorandum that explains the government amendments, the Bills Digest, the second reading speech, the amendments themselves, and any Senate committee submissions. We therefore cannot say which words in the third-reading text came from amendments, or whether the memorandum's examples still match them.
What we refuse to claim: that any named chatbot or company is covered, that the bill will pass the Senate unchanged, the dollar value of a penalty unit, or any enforcement outcome. Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
A bill that has passed the House would make AI-generating services subject to a statutory duty of care, with risk assessments and civil penalties of up to 60,000 penalty units, but only after Royal Assent and a further twelve months. Until the Senate acts it binds nobody. A trust and safety lead can still start by checking whether the service falls inside the section 25B definition.
Source File
Open the bill page and confirm the 15 and 28 October 2026 entries and the 20 November committee note. Then open the third-reading PDF and read sections 25B, 26, 26C, 26E and 27 and the commencement table in clause 2.
a service that generates material using artificial intelligence and that uses an internet carriage service in the course of doing so ยท Online Safety Amendment (Digital Duty of Care) Bill 2026, proposed section 25B(1)(h), as read a third time 28 October 2026
FAQ
Is the Digital Duty of Care Bill law?
No. It passed the House of Representatives on 28 October 2026. It has no force until the Senate passes it and it receives Royal Assent. A Senate committee report is due on 20 November 2026.
Does the bill cover AI chatbots?
It lists a service that generates material using artificial intelligence and that uses an internet carriage service as an online service. The Minister could exempt services that pose little risk. Whether a specific product is caught depends on those provisions.
What penalties does the bill set?
A civil penalty of 60,000 penalty units for failing the duty of care, and 6,000 penalty units for failing a remedial direction. The bill does not state a dollar amount.
When would the duty of care start?
As drafted, the day after the end of 12 months beginning on the day of Royal Assent. No date exists until the bill is enacted.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.