Australia's duty of care bill now reaches AI chatbots

What happened

Australia's Online Safety Amendment (Digital Duty of Care) Bill 2026 goes before Senate committee hearings in Canberra on 9 and 10 November. The submissions reported this week show how contested the bill's scope still is. The Senate referred the bill to its Environment and Communications Legislation Committee on 15 October, and the committee's report is due on 20 November. The House of Representatives passed the bill on 28 October, so Senate support is the remaining hurdle.

Biometric Update counted 126 submissions to the inquiry, with Meta, Google, Snap and TikTok each objecting to parts of the bill. Snap went after the core standard. The September exposure draft asked providers to keep users safe "so far as reasonably practicable", and the introduced bill dropped that qualifier. According to Pinsent Masons, the replacement test is "appropriate and effective", and cost can't be counted when judging whether a provider's measures meet the duty.

Most coverage has centred on social media and children. For ordinary businesses, the definition of an online service matters more. MinterEllison's analysis of the exposure draft flagged a new ninth category covering services that let users generate material using AI. In the draft, that category applied only where the AI output could be shared through another listed service. Webcoda's reading of the bill before the Senate is that proposed section 25B(1)(h) now covers any service that generates material using artificial intelligence, without the sharing condition. During the House debate, independent MP Kate Chaney won an amendment targeting chatbot designs that encourage a child's dependence on the bot as a substitute for human relationships.

What the bill would require

The person responsible for an online service would have a duty to provide a safe online environment. Under the exposure draft, as MinterEllison summarised it, providers would complete a written risk assessment at least once a year and before any change that could introduce new risks. They'd keep each assessment for six years and hand it to the eSafety Commissioner within 30 days of a request. MinterEllison also noted that the responsible person can include anyone with day-to-day control of a service, which may extend to underlying technology providers. Webcoda reads section 25B(2) of the current bill as allowing more than one person to be responsible for the same service.

Webcoda found no user-number, turnover or small-business threshold in the relevant Part. The only exit it identified is a ministerial power to exempt services that pose little risk to users, and the minister hasn't made any exemptions yet. Communications Minister Anika Wells has put the maximum penalty for a body corporate at A$109.2 million. The duty itself would start 12 months after Royal Assent.

Readers should weigh one point of disagreement before acting. Webcoda argues that a support chatbot on an ordinary business website is caught twice, once as part of the website and again as an AI service. Streamline's analysis is more cautious. Streamline expects public-facing tools that young people can reach to be the most likely targets, and staff-only internal tools to be less exposed. Neither reading has been tested, and the Senate could still amend the definitions.

Will the bill pass?

The Senate outcome is uncertain. Pinsent Masons reported that the Coalition has said it will oppose the bill, which leaves the government relying on crossbench votes. The Canberra Times reported that the Greens support the bill's principles but want people to have a right to sue platforms, and that Wells is willing to consider the Greens' proposals. The same report says the government wants the bill passed before the end of 2026 and expects the duty to take effect in late 2027. A private right of action would change the risk calculation for any business running a public chatbot, so the committee's 20 November report is worth reading closely.

Why NZ businesses should pay attention

New Zealand still has no AI-specific legislation. MinterEllison's NZ team noted in July that New Zealand relies on existing law. The same analysis said NZ businesses operating across the Tasman may need to consider Australian compliance obligations wherever they're headquartered. The published analyses don't settle whether an NZ-hosted chatbot serving Australian customers falls within the bill. The final definitions and the eSafety Commissioner's approach will decide that, and neither has been published.

Exposure is most likely for NZ firms that run customer-facing AI on Australian websites or apps. Examples include retailers with AI shopping assistants, software companies that embed generative features in products sold into Australia, and service businesses using chatbots for Australian enquiries. Many of these firms rely on a vendor's chatbot platform. Under the bill, both the business and the vendor could count as the responsible person, so the contract should say who does the risk assessment and who answers eSafety.

The bill also sets a useful governance benchmark even for firms that never trade in Australia. The bill's requirements are an annual written risk assessment, a fresh assessment before significant changes, and records kept for six years. A New Zealand organisation could adopt the same discipline voluntarily for any public-facing AI. If the organisation later faces regulation in either country, those records will already exist.

Next steps

• List every customer-facing AI feature that Australian users can reach, including website chatbots, AI-written product content and support assistants. Note which features people under 18 could plausibly use.
• For each feature, write a short risk assessment covering foreseeable harms, design choices and current controls. Date the assessment and store it where it can be retrieved for six years.
• Review chatbot personas and conversation design for anything that simulates emotional intimacy or encourages users to keep returning. The House amendment targets those design patterns where children are involved.
• Check vendor contracts to confirm who controls the chatbot day to day, who updates the model and prompts, and who would produce documents for a regulator within 30 days.
• Track the committee report due 20 November and the Senate vote. If the bill passes, set a compliance plan against the 12-month start date that follows Royal Assent.

For help mapping AI features and setting up proportionate governance, see our AI consultancy page. Firms that are planning AI agents for customer service should build the risk assessment into the design work from the start.