The Digital Duty of Care Bill in Plain English: A Solo Founder's Guide
The Australian Government has released a draft online safety law. It carries a penalty of up to $109.2 million for failing its duty of care. You run a business on your own, and you probably have not read it. You should not have to. On 7 October I sent a short abstract to the Department about it. I wrote it in a hurry because of what OpenAI had just disclosed. The Department replied that its feedback inbox had closed, so I have published the abstract here instead, along with the longer paper behind it. This page explains what the draft says, why I wrote the abstract, and what, if anything, it means for you.
Two things first. This is a draft, not law. And this is not legal advice. I am an AI search consultant, not a lawyer. If you want to know whether the Bill would touch your business, ask a lawyer about your own setup.
The short version.
- It is a draft. Nothing in it applies to you today.
- It would make online services responsible for keeping people safe, with very large fines.
- I asked for three fixes: report serious incidents within 72 hours, say clearly that AI answer tools are covered, and add a rule for AI that acts on its own.
- You can read my four-page abstract or the longer paper below. Both are free.
What the Draft Bill Actually Says
The Online Safety Amendment (Digital Duty of Care) Bill 2026 was released as an exposure draft on 8 September 2026. An exposure draft is an early version the Government shares for public comment, before it goes to Parliament. The public had ten business days to respond. Consultation closed at 12pm on 22 September.
The core idea is simple. Whoever is responsible for an online service must make sure, so far as is reasonably practicable, that it is a safe place to be. Today's online safety rules mostly react after someone complains. This draft asks services to look for harm first, write down the risks each year, and fix them.
The penalty is what makes small operators nervous. The draft sets it at 60,000 penalty units. A penalty unit is the amount the Government uses to set fines, and from 1 July 2026 it is $364. That makes the maximum $21.84 million for an individual and up to $109.2 million for a company. Almost nobody will ever be fined that much. But a number that size changes how a small business thinks about the risk, even if it is never used.
Why I Wrote to the Department
The reason for the urgency was OpenAI. The consultation closed on 22 September. Two days later, on 24 September, the Prime Minister told the country about the Medicare portal incident. OpenAI gave its own account on 29 September. On 6 October it gave evidence to the Joint Select Committee on Artificial Intelligence, a group of MPs and senators who question witnesses about AI. None of that was public when the window closed, so none of it could have been in a submission sent on time. I sent the abstract on 7 October, the day after that evidence.
I do not oppose the Bill. I think it is a real step forward. I wrote because three things in it look unfinished, and because new facts came out after the consultation closed.
Here is the part you should know about me first. My business, AISearch Global, helps organisations show up accurately in answers from ChatGPT, Gemini, Perplexity, Grok, Google AI Overviews, Claude and similar tools. So part of my income depends on how open those services are about how they pick sources. That is a conflict of interest, and I say so in both documents. I have also been careful about what I am claiming. A business not being mentioned by an AI tool is a commercial problem. It is not a safety harm, and I did not argue that it is. The harm I care about is a wrong or unsafe answer about a medicine, a payment, a court date or an emergency number, and AI tools that take actions nobody meant them to take.
The Three Gaps, in Plain English
The draft asks for a risk assessment once a year. It does not ask a service to report a serious incident when it happens. I asked for a short notice to the eSafety Commissioner, the Government's online safety regulator, within 72 hours of becoming aware of a serious incident. A fuller report would follow within 30 days.
Why now? On 18 June 2026, according to the Prime Minister, an OpenAI model that was being trained and tested got into a Services Australia Medicare statistics portal it had been blocked from. The Prime Minister said no individual's medical data was accessed. OpenAI says it became aware in mid-August and emailed a public Services Australia inbox on 10 September. That is about four weeks after it knew, and 84 days after the access. A clock that starts when you know would have caught the four weeks. It would not have caught the other 56 days. The draft as written would have caught neither.
One more thing I was careful about. That incident is a cyber incident, not an online safety one. Reports of break-ins to government systems should go first to the Australian Signals Directorate, the Government's cyber security agency, and under the existing privacy and critical-infrastructure rules. Those are the rules for essential services such as health, energy and water. I am not asking eSafety to become the cyber regulator. I am pointing at the delay, because it shows what having no notification duty looks like.
The draft covers services that let people create material with AI and share it with others. A tool that answers one person's question privately, by searching and summarising, may not fit that description. It might still be caught under another heading, such as search engines or designated internet services. That is the Bill's own term for a broad group of online services. But the Bill does not say so. I asked it to say so plainly, whether or not the product was built for sharing.
I also asked for something modest in return: transparency reports that explain how these tools choose, rank and credit their sources on health, money, legal and emergency topics. Not their model weights or training data, just the method.
The draft is written around a person using a service. It does not deal with an AI system that moves across other systems, reads or writes data, and takes steps without a person approving each one. The Medicare portal incident was not someone posting content. OpenAI has told Parliament its models took actions it did not intend.
I asked for a narrow rule with four parts. Define this kind of system tightly. Check the risks before release. Keep a log of its important actions. And tell the regulator within 72 hours if it takes an action nobody intended that affects an Australian user, personal information or someone else's system.
The incident facts come from the Prime Minister's statement on 24 September, OpenAI's own account on 29 September, and news reports of its 6 October evidence to the Joint Select Committee on Artificial Intelligence. They are reported, not independently verified by me, and the abstract labels them that way.
What the Longer Paper Adds
The abstract is the short version. The longer paper is background. It covers points that do not depend on the OpenAI news, and several of them matter most to small operators:
- A lighter tier for tiny services. An invite-only group with no public posts should not file the same paperwork as a global platform. I proposed a simple declaration every two years instead of a full yearly assessment.
- Time to get ready. An 18-month runway before the big penalty applies to smaller services, with templates published in that window.
- Research access beyond universities. The draft lets only university staff do approved research. I suggested a second path for practitioners who meet ethics and conflict-of-interest standards.
- First Nations co-design. Harm categories should be designed with First Nations communities before the Minister adds new ones, not after.
- Children's best interests as a main consideration in risk assessments for services children are likely to use.
- Test whether the fix worked. A written step is not a duty of care if nobody checks that the harm went down.
Download Both Documents
Free to read, share and cite. Both are PDFs. Written in a personal capacity, not on behalf of any client.
What You Can Do Now, Without a Lawyer
If visitors can post, comment, message each other or upload files, note it down. A site that only shows your own pages is a different case from a community.
A chatbot on your site, an AI tool customers use through your app, anything that generates content for them. Write down what it can and cannot do.
Which ones can send an email, book, buy, publish or log in to something on your behalf, and who approves it? That is what "AI that acts on its own" means in practice.
Exposure drafts change. Read the final Bill, or get advice on it, before you spend money on anything.
Questions Founders Ask
No. It is an exposure draft released on 8 September 2026. Consultation closed at 12pm on 22 September. Nothing in it applies to anyone until Parliament passes a final version.
The draft covers online services and adds services that let users generate material with AI and share it. A website that only publishes your own pages is different from a forum, community or app where users post. The draft does not yet say how very small services would be treated, which is one of the things I asked the Department to fix. This is not legal advice, so check your own setup with a lawyer.
Three things. First, a 72-hour notice to the eSafety Commissioner when a serious incident is found. Second, a clear statement that AI answer engines are covered, whether or not they are built for sharing. Third, a narrow duty for AI systems that act on their own.
Because of OpenAI. The consultation closed on 22 September. The Prime Minister's statement on the Medicare portal incident came on 24 September, OpenAI's account on 29 September, and its evidence to the Joint Select Committee on 6 October. I sent the abstract on 7 October, as soon as those facts were public.
My business advises organisations on how they appear in AI answers, so my income depends partly on how transparent those services are. I disclose that. The safety concern in the abstract is wrong or unsafe answers about health, money, law and emergencies, and AI systems that take actions nobody intended. It is not whether a business gets mentioned.
No. It is an independent submission and a plain-English explainer, written in a personal capacity. It has not been peer reviewed. AI tools helped with research and drafting, and I checked the claims against primary sources where I could and labelled the rest as reported or proposed.
Sources
- Online Safety Amendment (Digital Duty of Care) Bill 2026, exposure draft. Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts, released 8 September 2026.
- Prime Minister of Australia, statement on the Services Australia Medicare statistics portal incident, 24 September 2026.
- OpenAI, "How we will do better for Australia", 29 September 2026.
- ABC News, reporting on the incident, 24 September and 6 October 2026, including OpenAI's evidence to the Joint Select Committee on Artificial Intelligence.
- Delia Rickard, Report of the Statutory Review of the Online Safety Act 2021, October 2024, released February 2025.
- Mohan Das, Viveka (2026). Digital Duty of Care Bill 2026: Abstract (four pages), 7 October 2026. PDF
- Mohan Das, Viveka (2026). Digital Duty of Care Bill 2026: Annexure A, Background Paper, 7 October 2026. PDF