On 28 October 2026 Australia's House of Representatives passed the Online Safety Amendment (Digital Duty of Care) Bill 2026. It is not yet law. The Senate Environment and Communications Legislation Committee is due to report on 20 November, and the government hopes to pass the bill by the end of the year. The bill matters well beyond Australia because it is among the first to write a specific AI chatbot design harm into a general online safety duty, with penalties of up to A$109.2 million.
The strongest case for the bill
The argument for acting is serious. Today's regime is a patchwork of Basic Online Safety Expectations, industry codes and standards, and critics have long said it is slow and easy to game. MinterEllison's analysis of the exposure draft says the new duty sweeps away those instruments and is enforceable directly by the eSafety Commissioner. One duty that regulators can actually enforce is simpler than dozens of overlapping codes.
The evidence on children and chatbots also gives regulators a reason to move. An eSafety survey of 1,950 Australian children aged 10 to 17, as reported by the University of Sydney, found that 78% had used an AI chatbot, and 54% of those used one for personal or social reasons. A product built to be a child's confidant, and tuned to keep that child returning, is a plausible design-level harm. Product safety law has always regulated design, not only content.
What the chatbot amendment actually does
The amendment from independent MP Kate Chaney, accepted by the government on 28 October, adds a harm to the bill's list: material or conduct that simulates emotional intimacy and encourages or fosters a child's dependence on it in place of human relationships. The Next Web reports that the wording covers children and does not reach adults who use AI companions. Some headlines call this a world-first ban on AI emotional manipulation. That overstates it. The text, as reported, is one item within a general duty of care, and the duty is enforced through the eSafety Commissioner's regulatory process. It is not a standalone criminal prohibition.
That narrowness is a point in its favour. A rule aimed at design features that exploit minors is far easier to defend than one aimed at "harmful" chatbot output in general. It leaves adult users, and the large market in legitimate coaching, tutoring and language-practice bots, alone.
Where the design goes wrong
First, the duty is open-textured. The bill covers a long list of services, including those that let users generate material with AI and share it. MinterEllison notes that the Commissioner's guidance will not provide safe harbour. A company that follows the guidance can still be found in breach. A start-up cannot budget for a duty whose content is settled after the fact, and the large incumbents can. Allens observed of the exposure draft that there was no general small-business carve-out. Compliance costs of this kind tend to entrench the largest platforms.
Second, the same duty cuts both ways on safety. Henry Fraser and Raffaele Ciriello argue that the bill would do a good job of protecting children from harmful design features, but that it is not clear whether it would protect children from harms arising from repeated interactions with chatbots. They want companies to manage all reasonably foreseeable risks. Even supporters therefore doubt whether the drafting captures the harm it was written for. A rule that is both too vague to guide engineers and too narrow to catch the real problem is the worst combination.
Third, speech. The Coalition and One Nation voted against the bill in the House, and opponents called it censorship. Some of that is rhetoric, and the government rejects the label. But the concern has a real core. The bill makes the eSafety Commissioner the central regulator of a very wide range of services, and a duty framed around "harm" invites over-removal by risk-averse platforms. Reports of the introduced bill describe carve-outs for matters such as professional news, research and court proceedings. Those are welcome, but Parliament should confirm in the Senate that they are written into the text and not left to guidance.
What the Senate should change
The committee has about three weeks of evidence and should concentrate on four fixes.
- Keep the chatbot provision narrow. Define "child" and "dependence" precisely, and require that the Commissioner point to design features, such as engagement-maximising prompts and simulated romantic attachment, instead of treating any warm conversational tone as a breach.
- Give predictability for good-faith compliance. If published guidance is not a safe harbour, provide a documented risk-assessment route that gives firms a real presumption of compliance.
- Phase in the duty. The exposure-draft materials describe a commencement 12 months after Royal Assent. The committee should keep that period and resist pressure to shorten it.
- Weigh the Greens' demands carefully. The Greens support the bill but want higher penalties and a private right of action. Private litigation over a vague duty would multiply uncertainty, and penalties already reach A$109.2 million. If an external complaints route is needed, an ombudsman model is a better fit than courts.
The bottom line
Targeting manipulative design aimed at minors is a proportionate use of regulatory power, and Australia deserves credit for naming the problem. The risk lies in everything around it: a sweeping duty, a powerful single regulator and no guaranteed safe harbour. The Senate has a narrow window to keep the chatbot rule and tighten the rest before it becomes law.