- What the Bill says
- Every person responsible for an online service must conduct a risk assessment at least once a year and before any significant change, keep it for six years, and give it to eSafety within 30 days if asked (section 27).
- Our reading
- A small business with its own website would need one. For a site with no risky features it should be short. For a site with reviews, a forum, uploads, messaging or a chatbot, it is real work.
- Not yet decided
- The form and level of detail. eSafety has not published its requirements. The Department has described the low-risk version as a short checkbox process.
What has to be in the risk assessment?
Under section 27 of the Bill, each assessment would need to:
- identify the reasonably foreseeable risks
- identify what gives rise to them: the material or conduct, the design features of the service, and other systems or processes
- identify the people who may be affected
- assess how likely each risk is and how severe it could be
- document the measures you have in place or plan to take
- record how effective you expect those measures to be, why, and for how long
- provide for regular review of whether the measures are working.
The eSafety Commissioner could add requirements about format, detail and the standards to use.
Is the business expected to work all this out itself?
Yes. The Bill puts the job on the person responsible for the service. Nobody assesses your site for you, and eSafety sees your assessment only if it asks for it.
How heavy that is depends on the site:
- No risky features: the Department has described a short checkbox process. Most owners could do it in minutes.
- Reviews, a forum, uploads, messaging or a chatbot: you would need to think through what could go wrong with each feature, who could be affected, how likely and serious it is, and what you do about it. Then you would repeat that each year and before each significant change.
That second group is who Duty Check is being built for. See which group your site is in.
How often do I need to do one?
At least once a year. The eSafety Commissioner could set a shorter interval.
Will a low-risk website need a full risk assessment?
Probably not a long one. The Department told the Senate inquiry it expects eSafety to set different forms for low-risk through to high-risk services. For very low and low-risk services, it expects the task would likely be a small number of questions confirming the service does not host or enable higher-risk material, conduct or features.
That is an expectation, not a rule in the Bill. See what has been said about low-risk small business sites.
What might a short risk assessment look like?
Nobody knows yet, because eSafety has not published its form. Going on how the Department described it to the Senate hearing, it could be as simple as this.
Illustrative example only. Not an official form.
Online service risk assessment
- Does the service offer pornography or other adult content?No
- Can users post material that other users can see?No
- Can users interact with or message each other?No
- Can adults and children interact on the service?No
- Does the service have an AI chatbot?No
All answers are no. Low-risk service. Assessment complete.
A single yes changes the picture. Each feature then needs its own entry, as in the worked example below.
When will eSafety publish the risk assessment form?
eSafety has said it aims to publish its risk assessment materials at least six months before the requirement starts, after public consultation. Until then nobody knows the exact format.
When would the first risk assessment be due?
The Bill does not give a separate date. The requirement starts with the duty, 12 months after Royal Assent. eSafety has asked Parliament to make it explicit that the first assessment must be finished by that day. The safe plan is to have yours done before the duty starts.
Do I need a new one before changing my website?
Yes. The Bill requires an updated assessment before any significant change that could introduce new or additional risks (section 27). The assessment comes before the change goes live, not after.
Changes likely to count include adding a chatbot, public reviews or comments, a forum, file uploads, or a new audience such as children. A new page of text or a price update would not.
How long do I have to keep it?
Six years. You would also have to give it to the eSafety Commissioner within 30 days if asked.
Can I write my own risk assessment?
Yes. The Bill does not prescribe a template, and it does not require a lawyer or consultant. eSafety has not yet published guidance under the new duty. The owner of the business is the person who signs off on it either way.
A worked example
This is an illustration for a tutoring business with a booking form, public reviews and an AI chatbot. It is not an approved template.
| Risk | Who is affected | Likelihood | Severity | What the business does |
|---|---|---|---|---|
| Someone posts an abusive or harmful review | Students, parents, staff | Low | Medium | Reviews are held for approval. A "report this" link sits on every review |
| The chatbot gives a harmful reply to a student | Students under 18 | Low | High | Bot is limited to booking questions. Vendor safety filter is on. Tested before launch, results kept |
| A problem is reported and nobody sees it | All users | Medium | Medium | Reports go to a monitored inbox, checked each business day |
The record should also say who wrote it, the date, and when it will next be reviewed.
What happens if I don't do one?
Under the Bill, failing to conduct, keep or hand over a risk assessment would itself be a breach, separate from the general duty (section 27B). The maximum civil penalty is the same as for the duty: 60,000 penalty units, currently $21.84 million.
eSafety would have lighter tools as well. It could issue a formal warning, a remedial direction, or an infringement notice. An infringement notice for one breach would be 12 penalty units for an individual, currently $4,368, and 600 penalty units for a company, currently $218,400.
Sources
Last updated 14 November 2026