You’ve got a website, an Instagram account and maybe an online booking page. Now there’s a new online-safety Bill in the headlines, and there is some chatter that every business with a website will need to undertake an annual risk assessment. So do you need to do anything now and what should you budget for?
Well based on what we now so far the simple answer is “Not yet”. Here’s what is known, what isn’t, and the one decision worth making this week.
What the Bill is
The Online Safety Amendment (Digital Duty of Care) Bill 2026 has been introduced into federal Parliament. In broad terms it would put a legal duty on the people responsible for online services to take reasonable steps to keep those services safe, with a regular written risk assessments and to take action on the risks they find.
The targets named in the public commentary are the big ones: social media platforms, search engines, app stores, hosting services and AI tools. That’s where the debate is currently.
What isn’t clear
The open question for most owners is scope. The Bill uses wide categories of “online service”, and the summaries we have read do not settle whether an ordinary business website (a café’s menu page, a consultant’s contact form, a small online shop) is caught, or only the platforms that host and carry other people’s content.
So the headline you may have seen, “every business with a website”, is not confirmed. It might turn out to be partly true for some sites. It might not apply to you at all. Anyone saying for certain who is caught in this additional red tape today is guessing.
Where it’s up to
The Bill has been sent to a Senate committee for inquiry, with a report due in late November. Bills often change in committee, and this one still has to pass both houses. Even once it passes, the duty itself is not designed to start straight away: there is a transition period of about a year.
That gives a small business time. Nothing needs to be bought, signed or lodged because of this Bill today.
What to do while it’s still being discussed
Approach it as you would any proposal that isn’t settled yet: get the facts about how your own business uses its digital assets now, so the decision is quick when the answer arrives.
1. List what you actually run online. Your website, your socials, any booking or ordering system, any customer login, any place customers can post comments, reviews or photos. Most businesses have never written this down.
2. Note who controls each one. Your web developer, a platform such as Shopify or Squarespace, a booking app, or you. If a rule does land on “the person responsible” for a service, this is the list that tells you whether that’s you or your supplier.
3. Flag anything where the public can post. Comment sections, forums, review walls and customer uploads are the features the new online-safety rules care most about. A plain brochure site with a contact form is not what is being captured here.
4. Put a date in the diary, not a line in the budget. Check back when the committee reports. If the final law reaches businesses like yours, you’ll know what it costs and can plan for it then, instead of paying for advice on a version that may change.
Why this belongs under Clarity
Compliance done properly starts with knowing what applies to you and what doesn’t. New rules arrive every year, and most of them are noise for a small business. The skill worth building is sorting the noise from the obligations quickly, without panic and without ignoring them.
Most accountants stop at producing the numbers. We produce them, then make sure you can act on them. That includes keeping an eye on rules like this one and telling our clients plainly when something does, or doesn’t, need their attention.
Get the foundations right before your next growth decision. Visit cyrepartners.com.au and get in touch →
Cyre Partners — Empowering Smarter Business Choices.