What is worth doing now, while it is still a Bill?
Take stock. None of these steps changes your website, and all of them are useful whether or not the Bill passes.
- List what visitors can do on your site. Note reviews, comments, forums, uploads, messaging and chatbots. See which features matter.
- Weigh up what each feature is worth to you. Note which ones bring in business and which are rarely used. You do not need to change anything yet. This is so the decision is easy if the Bill passes.
- Check who holds the logins. The website, domain, plugins and chatbot accounts should be in the business's name.
- Note how a harmful post would be reported and removed today, and who would do it.
- Note whether children are likely to use the site.
- If you have a chatbot, see how it behaves off topic, and keep what it says. Chatbot guide.
- Save your notes with a date. They become the first draft of a risk assessment.
What would change if the Bill passes?
You would have 12 months between Royal Assent and the duty starting. That is the time to act on your notes:
- Decide which features to keep. A feature that earns its place can stay, with safeguards. One that is rarely used may not be worth the added risk.
- Put safeguards in place for the features you keep, such as approving posts before they appear.
- Complete your risk assessment once eSafety publishes its requirements, which it aims to do at least six months before the duty starts.
The Bill could still be amended or fail, and an exemption for low-risk sites is possible. That is the reason to prepare now and decide later.
What can wait?
Changing your website can wait, and so can writing a formal risk assessment. eSafety has not published the form or its requirements, so anything written now may need redoing.
Should I pay for a risk assessment now?
No. Nobody can sell you a compliant risk assessment today, because the requirements do not exist yet. Be cautious of any offer that says otherwise. For low-risk sites, the Department has described the assessment as a short checkbox process.
Do I need a lawyer?
Most small businesses with a simple website will not need one for this. Consider advice if your site has a forum, user uploads, messaging between users, adult content or child users, or if an agency controls your site and it is unclear who is responsible.
What should I ask my web agency or developer?
- Which features on my site let visitors post or upload?
- Who has admin access, and in whose name are the accounts?
- Can comments and reviews be held for approval?
- Will you tell me before adding a feature such as a chatbot?
What dates should I watch?
| When | What |
|---|---|
| 20 November 2026 | Senate committee report |
| Not yet known | Senate vote and Royal Assent |
| About six months after Royal Assent | eSafety aims to publish risk assessment requirements by then. Decide on features and safeguards |
| 12 months after Royal Assent | The duty starts |
We keep the status page up to date.
Do any online safety rules apply to my website today?
Yes. eSafety's existing industry codes and standards already apply to websites and apps, and eSafety can already require removal of some seriously harmful material. For an ordinary small business site the practical effect today is small.
Sources
- Parliament of Australia: the Bill, its explanatory memorandum and progress
- Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts: Digital Duty of Care
- Senate inquiry submissions: COSBOA (no. 65), the eSafety Commissioner (no. 129), the Department (no. 130) and DIGI (no. 90)
- Senate committee public hearing, Canberra, 10 November 2026 (our account is drawn from the broadcast; the official Hansard transcript was not yet published when we checked)
Last updated 14 November 2026