Australia's AI Chatbot Duty of Care: What SMEs Must Do

A legal duty of care is coming for your chatbot

On 28 October, a bill that puts AI chatbots under a legal duty of care passed Australia's House of Representatives. For the first time, "AI generation tools" get their own category in online-safety law — and the obligation is backed by civil penalties of up to 60,000 penalty units, and higher again, on a turnover basis, for the largest services. If your business runs a chatbot — a booking assistant, an after-hours FAQ bot, an AI that answers customer messages — the question is no longer whether you can switch it on. It's whether you can show the system behind it is safe.

The Online Safety Amendment (Digital Duty of Care) Bill 2026 now sits before the Senate, which the government wants it through before year's end. It replaces the current patchwork of codes with a single, proactive duty: anyone responsible for an "online service" must take steps that are "reasonably practicable" to keep it safe. That phrase is lifted straight from work health and safety law, and it brings the WHS logic with it — you're judged on whether you run a proper system for finding and managing risk, not on whether a single bad output ever slips through.

Chatbots earned their own category for a reason. The eSafety Commissioner found roughly 200,000 Australian children aged 10 to 17 have used an AI companion, and independent MP Kate Chaney's amendments — passed 97 votes to 30 — added "attachment hacking", the use of emotional language to keep a user engaged, to the list of harms a service must weigh. The headlines are about children and the big platforms. The category they've created is far broader.

Does this land on you, or your vendor?

Here's the part that matters for a small business, and the part the headlines skip. The duty attaches to whoever is "responsible for" a service or exercises day-to-day control over it. If you drop a mainstream, off-the-shelf chatbot onto your website, the provider of that tool is the most likely duty-holder — not you. But the draft carries no small-business carve-out, and the line is drawn by control, not size. A firm that operates its own bot, or heavily customises one and decides what it says, sits much closer to that line than one running a widget exactly as the vendor shipped it.

So the first move isn't panic — it's an answer to a question most owners can't give today: in the chain from the model to your customer, who is the provider? Get it in writing, because a vendor's "don't worry, we handle compliance" is worth exactly what you can hold them to. And remember the duty of care is a second layer, not the first. A chatbot that invents a price, promises a refund policy you don't offer, or gives advice you're not licensed to give already exposes you under the Australian Consumer Law — because when an AI tool gets it wrong, the Australian business that deployed it is the one that answers for it. The new duty simply adds a regulator with the power to demand your records.

If you can't yet say where AI already speaks to your customers, and what it's allowed to do on your behalf, map that exposure before you read another line of the bill.

What "reasonable steps" actually asks of you

The good news is that "reasonably practicable" is a standard you can meet without a compliance department. For a chatbot it comes down to three things. Scope what the bot can and can't do: no quoting prices it can't honour, no advice it isn't allowed to give, and a clean handoff to a human the moment it's out of its depth — the same "AI drafts, a person decides" line that keeps AI customer service defensible rather than a liability. Keep a short record: what the tool is, what you checked before switching it on, and how a customer complains if it goes wrong. And review it when you change the bot, not once a year by accident.

None of this is new work. It mirrors what you already owe under privacy and consumer law — the duty of care simply writes it into one standard, with teeth. And if the bill becomes law, you get a 12-month transition before it bites. That window is the whole opportunity: the businesses that write down how their chatbot works now will spend the transition calmly; the ones that wait will be reverse-engineering a system under a regulator's 30-day document notice.