Australia’s Digital Duty of Care Bill 2026 will if enacted introduce new online safety duties, risk assessments and age assurance requirements, alongside important carve-outs for media and entertainment organisations.
This update provides an overview of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (the Bill) which, if enacted, will introduce a digital duty of care to Australian law.
The Bill was tabled in Parliament on 15 October 2026 and subsequently amended and passed by the House of Representatives on 28 October 2026. It was referred to the Senate Environment and Communications Legislation Committee on 15 October 2026, which is due to report on 20 November 2026, at which point further changes may be considered. It follows the Australian Government’s release in September 2026 of an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (the Exposure Draft), which is summarised in our previous article. The Bill maintains the core principles of the Exposure Draft but also contains some significant changes, including carve-outs for certain media and entertainment content.
Much like the Exposure Draft, Schedule 2 of the Bill provides that a person responsible for an online service has a digital duty of care (DDC) to ensure a safe online environment for Australians, including to protect adults and children from seriously harmful material and conduct and protect children from material, conduct and design features that are harmful to them.
However, the Bill has since changed the requirements imposed by the digital duty of care and the measures that online services must take:
- New definition of digital duty of care: The Exposure Draft required a person to ensure, "so far as is reasonably practicable", a safe online environment. Now, a person responsible for an online service must "take appropriate action to ensure a safe online environment, including by taking effective measures to mitigate risks identified in risk assessments";
- Age assurance and access controls: New sections 27D to 27F require each person responsible for an online service, where there is a reasonably foreseeable risk that children could access pornography or fetish material, to implement a choice of one of at least two appropriate age assurance measures, together with access control measures. These requirements apply regardless of the excluded material and class 2 material carve-outs discussed below; and
- Risk assessments: Each person responsible for an online service now has a standalone obligation to conduct, make available and retain written risk assessments. Importantly, these requirements also apply regardless of the excluded material and class 2 material carve-outs.
There are also some important changes since the Exposure Draft was released which reduce the regulatory impact of the Bill:
- Limited Ministerial powers: The Minister can no longer add new categories of “seriously harmful material” or material “harmful to children” by legislative instrument. The list of “seriously harmful material” is now exhaustive and closely aligned with Class 1A material and the Criminal Code, while the list of material “harmful to children” retains only a residual category of material or conduct that “may cause serious harm to children”.
- Harm carve-outs: The Bill now carves out specific categories of excluded material and class 2 material (broadly, X 18+ and R 18+ films and games and restricted publications) from the harmful material definitions, though to different extents.
These new carve-outs are particularly relevant to the media sector. Under section 25F, the categories of excluded material apply to both "seriously harmful material or conduct" and material that is "harmful to children" and include:
- material that is produced or disseminated in connection with the performance by a public official of the official’s duties or functions;
- material that is used for the purposes of proceedings in a court or tribunal;
- material that is produced for the sole or dominant purpose of entertaining individuals and is contained in:
- audiovisual content made available by an on-demand program service; or
- material contained in a film or computer game that has been classified under the Classification (Publications, Films and Computer Games) Act 1995, other than class 1 material or class 2 material;
- professional news material;
- material that is necessary for, or of assistance in, conducting scientific, medical, academic or historical research;
- material that is produced, performed or disseminated for a literary, artistic or educational purpose and is not contrary to the public interest;
- material that is necessary for, or of assistance in, protecting or promoting public health and safety;
- material that is necessary for, or of assistance in, reducing harms to individuals;
- material that is in the public interest.
Following the House amendments, the Bill also provides that class 2 material is not seriously harmful material or conduct (s 25D(2)(b)). This means that X 18+ and R 18+ films and computer games, and restricted publications, cannot of themselves be seriously harmful material. However, this carve-out does not extend to material or conduct that is harmful to children (see further below).
At a glance: how has the digital duty of care changed?
The table below sets out at a glance some key differences between the Exposure Draft and the Bill:
| Issue | Exposure Draft | Bill |
| Standard of the digital duty of care | A person responsible for an online service must ensure, "so far as is reasonably practicable", a safe online environment (s 26(1)). | A person responsible for an online service must "take appropriate action" to ensure a safe online environment, including by taking "effective measures" to mitigate risks identified in risk assessments (ss 26, 26A). |
| Excluded material | No equivalent. | On-demand program service entertainment, classified films and games (other than class 1 and class 2 material), professional news, artistic, public interest and other material carved out of both harm definitions (s 25F). Class 2 material is also carved out of seriously harmful material only (s 25D(2)) (see above and below). |
| Cost of compliance | Costs may be relevant if grossly disproportionate to risk. | Costs of any action or measures must not be taken into account (s 26A(3)). The Explanatory Memorandum explains that cost was excluded because, on large platforms with millions of users, even a small percentage of harmful content can still have a significant harmful impact on Australians. |
| Risk assessments and user empowerment tools | Managing design features (including providing user empowerment tools) and conducting risk assessments were mandatory elements of the duty itself, so that a failure was a breach of the duty (s 26(3)). | Conducting risk assessments (s 27) and providing user empowerment tools required by Ministerial instrument (s 27A) are now standalone obligations. A failure to conduct, make available and retain risk assessments, or to provide required user empowerment tools, attracts a civil penalty of up to 60,000 penalty units (s 27B), in addition to the separate penalty for breach of the duty itself (s 26C). User empowerment tools must also be prominent and accessible (s 27BA, 6,000 penalty units). |
| Ministerial power to add harms | The Minister could add new seriously harmful and harmful-to-children categories. | The Minister’s power to add new categories of harm by legislative instrument has been removed, so both lists are now closed and can only be expanded by amending legislation. The harmful-to-children list retains a residual category of other material or conduct that “may cause serious harm to children” (s 25E(1)(f)) and, following crossbench amendments, now includes AI companion-style material that fosters a child’s emotional dependence (s 25E(1)(da)). |
| Age assurance and access controls | Not in the DDC. | Where there is a reasonably foreseeable risk that children could access pornography or fetish material, the person responsible must, where technically feasible and reasonably practicable, implement a choice of one of at least two age assurance measures plus access control measures (s 27D), with a civil penalty of up to 60,000 penalty units for non-compliance (s 27E) and 6,000 penalty units for breaching a remedial direction (s 27F). |
| Who is responsible | Provider or anyone with day-to-day control | Provider or the person with the greatest degree of day-to-day control (s 25B(2)). |
| Exemptions | Previously, the Minister could exempt online services where the services posed little risk to users, or where there was minimal use in Australia. | The exemption now only applies where there is little risk posed to users, not where there is minimal use (s 25B(3)). |
| Remedial direction, infringement notices and information requirements | Failure to comply with a remedial direction attracted 60,000 penalty units (s 26D(3)), and infringement notices could be issued for breach of the duty itself (s 163A). | The penalty for breaching a remedial direction falls from 60,000 to 6,000 penalty units (section 26E(3) of the Bill). Infringement notices now cover remedial directions, risk assessments and user empowerment tools, age assurance, complaints, design feature notices, transparency and data access obligations, rather than breach of the duty itself (s 163(1)), with the amounts payable set by s 163AA. Further, the Commissioner can also require information about recommendation and moderation algorithms (section 28A(3) of the Bill). |
What are the new carve-outs under the Bill?
The introduction of the new carve-outs is a welcome development for media and entertainment organisations. They address concerns that legitimate, heavily regulated news and media content which is prepared by professionals or is classified could otherwise have been inadvertently captured as seriously harmful material or material harmful to children.
However, it is important to note that these are not blanket carve-outs for media and entertainment organisations. Care must be taken to assess the application of each exclusion to particular content. Moreover, even where content falls within the excluded material carve-out, online services remain subject to the risk assessment and age assurance obligations in sections 27 and 27D, discussed below.
Class 2 material
Government amendments passed by the House on 28 October 2026 provide that seriously harmful material or conduct does not include excluded material or class 2 material (s 25D(2)). Class 2 material is defined in section 107 of the Online Safety Act 2021 (Cth) and covers, in broad terms, films classified (or likely to be classified) X 18+ or R 18+, publications classified Category 1 or Category 2 restricted, and computer games classified R 18+. Adult-rated films, series, games and publications therefore cannot, of themselves, be treated as seriously harmful material for the purposes of the duty owed to all Australians.
However, online services should note two important limits:
- The class 2 carve-out does not extend to material or conduct that is harmful to children (s 25E(2) continues to exclude only “excluded material”).
- The same amendments narrowed the classified-content limb of the entertainment exclusion so that it no longer covers class 1 or class 2 material (s 25F(1)(c)(ii)).
The practical result is that an R 18+ film or game is not seriously harmful material, but it is also not excluded material for child-safety purposes. Services carrying R 18+ or X 18+ content will need to assess that content against the harmful-to-children categories (for example, pornography or material that glorifies crime) and take appropriate action to protect children from it, including through age assurance where section 27D is triggered.
Excluded material
Under section 25F of the Bill, the categories of excluded material most relevant to media and entertainment organisations are:
1. Professionally produced entertainment (section 25F(1)(c))
Material produced for the sole or dominant purpose of entertaining individuals will be excluded material where it is:
- audiovisual content made available by an on-demand program service; or
- material contained in a film or computer game classified under the Classification (Publications, Films and Computer Games) Act 1995 (Cth), other than class 1 material or class 2 material.
The government amendments passed by the House of Representatives replaced the original entertainment limb, which had covered television and radio programs provided by national and commercial broadcasting services and audiovisual content made available by a “broadcasting video on demand service”. Those references, and the associated Broadcasting Services Act 1992 (Cth) definitions, have been removed.
The limb now refers to an “on-demand program service”, as defined in section 18 of the Online Safety Act 2021 (Cth). This is an internet-delivered service, to the extent that it provides material identical to a program that has been, or is being, transmitted on:
- a commercial television broadcasting service;
- a licensed subscription television broadcasting service;
- a subscription television narrowcasting service; or
- an ABC or SBS television service.
This is a meaningful change for broadcasters and pay TV operators, as catch-up and on-demand versions of programs already transmitted on free-to-air, national or subscription television are now covered, including subscription television content that was not captured by the former BVOD limb.
However, the limb no longer extends to radio, and original content made available only on a streaming service (that is, not identical to a broadcast program) will not fall within the on-demand limb. Streaming platforms will instead need to rely on the classified film and game limb, the artistic purpose limb (which carries a "not contrary to the public interest" qualifier) or the general public interest limb.
A new note to section 25F(1) confirms that certain films classified under other Acts are taken to be classified under the Classification (Publications, Films and Computer Games) Act 1995 (see section 6HA of that Act).
There are also important carve-outs for computer games from this exclusion. Section 25F(2) provides that material generated by a person using a feature of a computer game is not excluded material, notwithstanding the game's classification. The Explanatory Memorandum states that this is intended to capture user-generated material, including chat functions, whose nature or impact may not align with the game's classification. Game publishers therefore obtain protection for the classified game itself, but not for what players create or say within it.
2. Professional news material (section 25F(1)(d))
To qualify as professional news material, the content must be "news material" (material that reports, investigates or explains issues relevant to public debate and democratic decision-making, or current issues or events of public significance or interest) and must be produced by a person who:
- publishes news online as a newspaper, magazine, television or radio program or channel, website, or internet-distributed audio, visual or audiovisual program;
- is subject to the Australian Press Council Standards of Practice, the Independent Media Council Code of Conduct, the commercial television, commercial radio, community radio or subscription television codes of practice, the ABC or SBS codes, or analogous rules or internal editorial standards relating to the provision of quality journalism; and
- has editorial independence from the subjects of its news coverage.
The “analogous rules or internal editorial standards” limb would open the exclusion to independent publishers that are not members of a press council or covered by a broadcasting code. However, neither the Bill nor the Explanatory Memorandum explains which standards would be considered “analogous”, or what constitutes “quality journalism”. Content creators, podcasters and newsletter publishers will need to consider whether their editorial policies are sufficiently formal and robust to qualify.
The editorial independence requirement is a separate, additional condition. Brand-funded, sponsored or in-house corporate “news” content, and newsworthy material from commentators or outlets without recognised or analogous standards, may therefore fall outside the exclusion.
3. Literary, artistic or educational purpose (section 25F(1)(f))
Under this limb, material will be excluded material if it is: (a) produced, performed or disseminated for a literary, artistic or educational purpose, and (b) not contrary to the public interest. Unlike the entertainment exclusion, this limb is not tied to any particular format or distribution channel.
Neither the Bill nor the Explanatory Memorandum explains what “contrary to the public interest” means or how a provider should assess it. Separately, “material that is in the public interest” is itself excluded material under section 25F(1)(i), so the public interest operates both as a standalone exclusion and as a condition on this limb. This leaves uncertainty for online services hosting creative or educational content (such as documentaries, true crime podcasts or artistic works) that touches on the harms in sections 25D and 25E.
4. Public interest (section 25F(1)(i))
Section 25F(1)(i) treats any "material that is in the public interest" as excluded material, functioning as a residual catch-all.
It is potentially very broad, but it is also the least certain of the exclusions. Neither the Bill nor the Explanatory Memorandum defines "public interest" or gives any guidance on how to apply it, beyond a general statement that section 25F is meant to exempt lawful and legitimate communications on matters such as news reporting, professionally produced entertainment or the public interest.
Online services may look to rely on this limb to protect legitimate but difficult subject matter. We expect the eSafety Commissioner to address it in guidelines on the duty, and ultimately the courts will decide its scope. Until then, relying on the public interest limb alone is riskier than relying on a more specific limb.
Risk assessments
Under section 27, a person responsible for an online service must ensure that written risk assessments are conducted for the service.
The assessments must:
- identify reasonably foreseeable risks, the material or conduct, design features and other systems or processes giving rise to them, and the persons who may be affected;
- assess the likelihood and potential severity of those risks;
- document mitigation measures and their expected effectiveness; and
- provide for regular review.
They must be conducted at least annually (or at shorter intervals set by the Commissioner) and before any significant change to the service that could introduce new risks. They must also be retained for at least six years and provided to the Commissioner within 30 days of a request.
The government amendments confirm that any additional requirements and shorter intervals are those determined by the Commissioner by legislative instrument under section 27(4), and extend the 60,000 penalty unit civil penalty in section 27B so that it applies to a failure to conduct, make available and retain risk assessments.
Importantly for media providers, excluded material does not remove a service from the risk assessment obligation. This is particularly pertinent as the risk assessment is the mechanism through which a service identifies whether, for example, children could be exposed to adult content, and therefore whether the age assurance obligation is triggered.
Age assurance and access controls
Sections 27D to 27F introduce an obligation that did not appear in the Exposure Draft’s DDC provisions. The obligation is triggered where there is a reasonably foreseeable risk that a child could access, or be exposed to, pornography or material that describes or depicts specific fetish practices or fantasies through an online service (s 27D(1)).
Where triggered, each person responsible for the service must, where technically feasible and reasonably practicable, ensure that the following are implemented for users of the service in Australia (s 27D(2)):
- a choice of one of at least two appropriate age assurance measures, being a method, or range of methods, used by an online service to determine or assess a user’s age; and
- access control measures, being design features that prevent an Australian user who is not age assured as an adult from accessing, attempting to use, or being exposed to, that material.
The Explanatory Memorandum indicates that providers must implement these measures before permitting access to the relevant material, should test, monitor and review their effectiveness annually or whenever the service changes materially, and must ensure that children cannot access age-inappropriate content where the service can be used in a logged-out state. It also states that the obligation aligns with the existing industry codes (which the Bill will repeal) and is not expected to require the collection of personal information beyond what providers already collect.
Three features are particularly significant for media and entertainment clients:
- Neither the excluded material carve-out nor the class 2 carve-out applies to section 27D, which operates by reference to “pornography” and fetish material rather than the defined harm categories. Classified or professionally produced content may therefore still require age gating.
- The terms “pornography” and “material that describes or depicts specific fetish practices or fantasies” are not defined; given the stated alignment with the industry codes, we expect them to be interpreted consistently with the National Classification Scheme.
- Unlike the core duty, the obligation retains a “technically feasible and reasonably practicable” qualifier.
Non-compliance carries a civil penalty of 60,000 penalty units (s 27E). The Commissioner may also issue formal warnings (s 27E(2)) and remedial directions, non-compliance with which attracts a further 6,000 penalty units (s 27F), and both provisions are subject to infringement notices, enforceable undertakings and injunctions.
Other amendments
- AI companions: Crossbench amendments have added to the list of material “harmful to children” any material or conduct that simulates emotional intimacy and encourages or fosters a child’s dependence on it in place of human relationships (s 25E(1)(da)). This addresses what Kate Chaney MP described as “attachment hacking” by AI chatbots and companions. Studios and game publishers deploying interactive AI characters, franchise chatbots or companion-style features should factor this new harm into their risk assessments.
- User empowerment tools: Crossbench amendments also insert section 27BA, which requires user empowerment tools to be accessible, easy to use, prominently available, functional and available on an ongoing basis, without affecting the general functionality of the service or impairing user experience. Non-compliance attracts a civil penalty of 6,000 penalty units, and the provision is also subject to formal warnings, remedial directions, infringement notices, enforceable undertakings and injunctions.
- Fake nude material: Government amendments broaden the Commissioner’s new power to require removal of apps and websites that generate fake nude material (s 86B). As introduced, the power applied only where an app or website was designed for the predominant purpose of generating fake nude material and was predominantly used for that purpose. It now applies where either limb is satisfied. This lowers the threshold for action, although the Explanatory Memorandum previously stated that the power is not intended to restrict access to AI services providing broader legitimate functions.
- Industry codes and standards: Government amendments provide that the validity of industry codes and industry standards registered before the relevant provisions commence is not, and is taken never to have been, affected by a failure to comply with the consultation requirements in section 140 (publishing a draft code, inviting submissions and allowing at least 30 days for them) or section 148 (public consultation on industry standards) of the Online Safety Act 2021 (Cth). The amendments validate existing codes and standards during the transition period; however, they do not create an ongoing exemption from consultation and Schedule 3 of the Bill will ultimately repeal the online content scheme codes and standards.
Key takeaways
Schedule 2 of the Bill is proposed to commence 12 months after Royal Assent, but the Senate Committee’s report may yet lead to further amendments. Broadcasters, pay TV operators, streaming services, studios and game publishers may consider getting ahead of the changes by:
- mapping their catalogues against each excluded material limb, noting that the entertainment limb now turns on on-demand program services and non-class 2 classified content;
- identifying R 18+ and X 18+ titles, which are not seriously harmful material but remain subject to the harmful-to-children protections;
- building the risk assessment process now, given the annual cycle, six-year retention period and 30-day production requirement;
- assessing whether any service carries a reasonably foreseeable risk of children accessing pornography or fetish material, and if so planning for at least two age assurance options and access controls; and
- reviewing AI-driven and interactive features, including user-generated content in games and companion-style chatbots, against the new AI companion harm and fake nude material restrictions.