Digital Duty of Care Bill Names AI Services but Leaves Model Testing Out of the Act

The federal government introduced the Online Safety Amendment (Digital Duty of Care) Bill 2026 on 15 October, and the Senate referred it to committee the same day, with submissions closing on 30 October and a report due on 20 November. A line-by-line comparison by the Australian outlet AI Geek finds the bill now treats any service that generates material using artificial intelligence as an online service in its own right, a change from September’s exposure draft that matters for standalone chatbots.

The draft only clearly caught AI services whose output was shared through social media or another listed service. The introduced bill drops that condition, so the new duty of care, backed by penalties of up to 60,000 penalty units, and the annual written risk assessment both reach a chatbot whose answers stay between the user and the model. A new section also requires at least two age-assurance options where children could foreseeably reach pornography.

What did not make it into the Act is model testing. The 105-page explanatory memorandum lists testing before deployment, testing against foreseeable misuse and safeguards on prompts and outputs as controls a generative AI provider may use. Yet the bill still repeals every industry code and standard 12 months after Royal Assent, including the standard that now requires high-impact generative AI services to test their models and differentiate AI outputs, and nothing keeps that rule alive. AI Geek found no reference to watermarking or output labelling in either document.

What it means in practice

Communications Minister Anika Wells told the House that services complying with the 17 existing codes and standards will be well placed to meet the new duty. The gap lands in a busy month for AI oversight, after the AI committee’s call for embedded safety experts and early ASD access to new models, Anthropic’s offer to let the AI Safety Institute test its models independently and Tim Ayres’s signal of more AI security funding.

For providers, the practical message is that pre-release testing remains expected rather than mandated. Unless the eSafety Commissioner sets risk-assessment requirements that name it, nothing in the Online Safety Act will expressly require a generative model to be tested before release, or its output to be marked, once the codes lapse.

What to watch: submissions to the Senate Environment and Communications Legislation Committee, whether the committee recommends writing model testing and output marking into the risk-assessment section, and the first guidance the eSafety Commissioner issues under the new duty.