Digital Duty of Care: What It Means for AI Chatbots

Australia’s digital duty of care is now a bill, and it names AI chatbots. On 15 October 2026, Communications Minister Anika Wells introduced the Online Safety Amendment (Digital Duty of Care) Bill 2026, which the government says will set minimum safety standards for online services such as games, apps and AI chatbots. Coverage has focused on social platforms, but if your business runs a public-facing chatbot or any feature that generates content for customers, read the fine print now, while the bill is before Parliament.

Here is what was introduced, which services it covers, the AI safeguards the explanatory memorandum lists, and a checklist for Australian teams running AI chatbots.

What was introduced on 15 October

The bill amends the Online Safety Act 2021. According to the Parliament bill page, it was introduced and read a first time in the House of Representatives on 15 October 2026 and referred the same day to the Senate Environment and Communications Legislation Committee, with a report due on 20 November 2026.

The explanatory memorandum summarises the core changes:

• An overarching duty on online service providers to provide a safe online environment for all Australians.
• Regular written risk assessments of the risk of harm a service poses in Australia, plus effective measures to mitigate the risks identified.
• Design features must be managed effectively, including user empowerment tools if the Minister requires them by legislative instrument.
• A civil penalty of 60,000 penalty units for breaching the duty. The Minister’s release puts the maximum at up to $109.2 million.
• Delayed start: the duty takes effect 12 months after Royal Assent, when the Basic Online Safety Expectations and the existing industry codes and standards are repealed.

The bill also covers nudify app removals, faster cyberbullying responses and the “My Feed, My Way” social media opt-in. For most businesses, the AI chatbot provisions are the part to watch.

Does the digital duty of care cover AI chatbots?

As introduced, the definition is broad. Proposed section 25B lists the “online services” covered. Alongside social media, messaging, search, hosting and app stores, it includes designated internet services and “a service that generates material using artificial intelligence” that uses an internet carriage service. The explanatory memorandum says the AI limb is there “for the avoidance of doubt”, and that “the Duty applies to all online services under the Act”.

Three details narrow or shape that scope:

1. Who is responsible. The duty sits with the person who provides the service or, for some services, the person with the greatest day-to-day control over it. If you embed a vendor’s chatbot, work out now whether that is you, the vendor or both.
2. Low-risk exemptions. The Minister can exempt a service or class of services by legislative instrument if satisfied it poses little risk to users in Australia. None exist yet, so do not assume you are out.
3. What “harm” means. The duty targets seriously harmful material and conduct, closely aligned with illegal and refused-classification material, plus a wider set of harms to children. The memorandum says the scope is not intended to capture content that is defamatory or may lead to financial loss unless it also meets those thresholds. A chatbot quoting the wrong price is a consumer law problem, not the target here.

The memorandum names the problem directly: “chatbots providing inappropriate and harmful responses”.

What the duty asks providers to do

The working core is the written risk assessment in proposed section 27. As described in the explanatory memorandum, each assessment must:

• identify reasonably foreseeable risks, what causes them (including design features) and who may be affected
• assess the likelihood and potential severity of each risk
• document the measures in place, or proposed, to mitigate those risks
• record how effective those measures are expected to be, and why
• be reviewed regularly, at least annually, and before any significant change that could add new risks
• be kept for at least six years and handed to the eSafety Commissioner within 30 days of a request.

Two points stand out for anyone shipping AI features. First, the test is systemic. A single harmful output will not necessarily breach the duty. The question is whether you identified reasonably foreseeable risks and maintained effective systems to reduce them, although harmful content can be evidence of a systemic problem. Second, the memorandum says the cost of a measure must not be taken into account when deciding what action is appropriate. Courts setting penalties must consider factors including the size of the organisation.

The AI safeguards spelled out in the explanatory memorandum

The explanatory memorandum lists features that rely on or interact with AI as an example of a high-risk feature. It says a provider of a public-facing generative AI service may need to assess the risk that the service will generate harmful material or be used to facilitate harmful activity. The relevant controls it lists are:

• testing before deployment
• testing against reasonably foreseeable misuse
• safeguards applying to user prompts and generated outputs
• processes for users to report harmful outputs
• monitoring after deployment
• review of whether safeguards remain effective as the service and patterns of use change.

Adding a generative AI tool to an existing service is its example of a change that may require reassessment; routine updates and security patches are not.

None of this is exotic. Good teams already do it for customer-facing AI chatbots. What changes is that you may need it written down, dated and ready to show a regulator.

Timing: not law yet, but the clock is visible

The bill still has to pass both houses. The Conversation’s first-read analysis (15 October) reports that the Coalition remains critical and is unlikely to support it. It also reports that the Greens support it in principle but want steeper penalties and a right for Australians to sue tech companies directly. Since the 8 September exposure draft, the bill has added exclusions for news, educational, research and public-health material, and new harm categories would now need Parliament to amend the law.

If it passes as drafted, the duty starts 12 months after Royal Assent. Risk assessments, logging and reporting flows take time to build, and designing them in now is far cheaper than retrofitting them later.

A practical checklist for Australian teams running AI chatbots

1. Inventory every AI feature that generates content. Website chat, support assistants, AI search, content tools: if it talks to the public, list it.
2. Decide who is the “person responsible”. Check your vendor terms: who controls the model, the prompts, the filters and the logs day to day?
3. Draft a section 27-style risk assessment. Use the bill’s structure: risks, causes, affected people, likelihood and severity, controls, expected effectiveness and review dates. An AI business audit is a practical way to produce one. Here is what an AI audit includes.
4. Narrow what the bot can say. Ground answers in your own approved content with RAG knowledge assistants, restrict topics and add input and output filtering through a governed LLM integration layer.
5. Test for misuse before launch. Red-team prompts that try to push the bot into harmful, sexual or self-harm territory, especially if children could plausibly use it.
6. Add a report button and a human escalation path. Make it easy to flag a bad answer, and route serious flags to a person quickly.
7. Log, monitor and review. Keep conversation logs and safeguard metrics under a clear retention policy, and keep the risk assessment for six years as the bill would require.
8. Reassess before new features. Treat a new model, new tools or a move from chatbot to agent as a reassessment trigger. If you are weighing that step, see AI agent vs chatbot.
9. Train the people who run it. Our free AI customer service course covers running support bots well, and more options are on the courses hub.

Want a quick score? Take the free Duty of Care chatbot readiness check.

How it fits with other Australian AI rules

The digital duty of care is one strand of a busy few months. The OAIC’s automated decision-making transparency obligations apply from 10 December 2026; see our guide to automated decision-making and the Privacy Act. Assistant Minister Andrew Charlton has flagged national AI standards by the end of the year and legislation in 2027, the ABC reported on 8 October. On 13 October the ABC also covered the parliamentary AI committee’s early advice on independent safety checks and incident reporting for frontier developers. Those rules target labs; the duty of care reaches services that put AI in front of the public. Our note on AI agent safety in Australia covers the agent side.

The common thread is evidence: a documented system that identifies risks and shows the controls work.

This is general information about a bill before Parliament, not legal advice. The bill may change before it passes. Check your obligations with a qualified adviser.

Featured image: Photo by Kaboompics.com on Pexels.