Small businesses face mandatory online safety audits under proposed federal laws

COSBOA seeks exemptions for low-risk operators as compliance costs could run to thousands

By LineZotpaper

Published22 October 2026

Read Time2 min

Hundreds of thousands of Australian small businesses could be forced to undertake annual risk assessments under proposed federal online safety laws, with the small business sector warning the compliance burden could reach even local hairdressers, cafes and tradies. The Council of Small Business Organisations Australia (COSBOA) is calling for exemptions for low-risk operators.

The federal government's proposed Digital Duty of Care legislation, introduced to Parliament on October 15, aims to strengthen online safety by requiring covered online services to take steps to prevent foreseeable harm to users. The bill covers broadly defined online services, potentially including ordinary business websites, and does not automatically exempt operators based on their size or turnover.

COSBOA CEO Skye Cappuccio said that if the draft bill passes in its current form, the number of businesses required to undergo annual audits would be in the hundreds of thousands. "We are very concerned that, as drafted, the bill will increase the compliance burden on small businesses that are exceedingly low risk," Cappuccio said.

Karl Morris, managing director of digital agency Goop Digital and deputy chair of the Geelong Chamber of Commerce, warned compliance costs could be substantial for individual businesses. "We're thinking probably a couple of hundred bucks, but it could be thousands," Morris said. He is concerned the legislation could affect all 800 websites managed by his agency, whose clients range from tradespeople and medical practices to funeral homes, accountants and lawyers.

The proposed assessments would not automatically require businesses to hire external auditors. Covered operators would be required to document their online safety risks, retain records for six years and provide them to the eSafety Commissioner within 30 days if requested.

The government has said low-risk websites would face minimal obligations, but the legislation does not contain an automatic exemption for small businesses. COSBOA wants low-risk operators explicitly excluded from annual risk assessments. "A local hairdresser's website is incredibly low risk and additional requirements such as annual risk assessments don't make sense," Cappuccio said.

Morris called for exemptions for businesses with fewer than 50 employees or annual turnover below $5 million. "Regulate the risk," Morris said. "Don't regulate every business that has a website."

If passed, the legislation would provide a 12-month transition period before the new obligations take effect. COSBOA said it had not calculated the potential costs and is calling on the government to undertake and publish an assessment.

Analysis

Why This Matters

Annual risk assessments could apply to hundreds of thousands of small businesses, including local hairdressers, cafes and tradies with simple websites
Compliance costs could range from hundreds to thousands of dollars per business
The proposed laws are part of a broader online safety package that could also affect how businesses advertise and engage with customers online

Background

The Digital Duty of Care legislation, introduced to Parliament on October 15, is part of a broader package of Australian online safety reforms. It would require covered online services to take steps to prevent foreseeable harm to users, with the eSafety Commissioner overseeing compliance. The bill covers broadly defined online services and does not automatically exempt operators based on size or turnover, which has sparked concern from the small business sector.

Key Perspectives

COSBOA (small business sector): Wants low-risk operators explicitly excluded from annual risk assessments and is calling on the government to undertake and publish a cost assessment before the bill proceeds. Karl Morris (Goop Digital and Geelong Chamber of Commerce): Questions whether very small businesses should face compliance duties at all, arguing most client websites are "set and forget" digital shopfronts and that small businesses are "collateral damage" in a push aimed at major platforms. He wants exemptions based on employee numbers or turnover. Government: Has said low-risk websites would face minimal obligations, but has not built an automatic small business exemption into the legislation.

What to Watch

Whether Parliament amends the bill to include a small business exemption before it passes
Whether the government responds to COSBOA's call for a published cost assessment
The 12-month transition period, and how the eSafety Commissioner applies the record-keeping and 30-day disclosure requirements in practice

Sources

Small businesses face mandatory audits under costly new online safety rules · SmartCompany

Checked

12 claims in this story checked against 1 source: 12 supported.

Show each claim

SupportedSmall businesses face mandatory online safety audits under proposed federal laws.SmartCompany: “Small businesses face mandatory audits under costly new online safety rules. ... Hundreds of thousands of Australian small businesses could be forced to undertake annual risk assessments under proposed federal online safety laws”
SupportedCOSBOA seeks exemptions for low-risk operators, and compliance costs could reach thousands.SmartCompany: “COSBOA wants low-risk operators explicitly excluded from annual risk assessments. ... “We’re thinking probably a couple of hundred bucks, but it could be thousands,” Morris told SmartCompany.”
SupportedHundreds of thousands of Australian small businesses could be forced to undertake annual risk assessments.SmartCompany: “Hundreds of thousands of Australian small businesses could be forced to undertake annual risk assessments under proposed federal online safety laws”
SupportedThe proposed laws could expose local hairdressers, cafes and tradies to costs and regulations.SmartCompany: “potentially exposing even local hairdressers, cafes and tradies to new costs and regulations.”
SupportedThe Digital Duty of Care legislation was introduced to Parliament on October 15 and aims to prevent foreseeable harm to users.SmartCompany: “The federal government’s proposed Digital Duty of Care legislation, introduced to Parliament on October 15, aims to strengthen online safety by requiring covered online services to take steps to prevent foreseeable harm to users.”
SupportedCappuccio said the bill would increase the compliance burden on exceedingly low-risk small businesses.SmartCompany: ““We are very concerned that, as drafted, the bill will increase the compliance burden on small businesses that are exceedingly low risk,” Cappuccio said.”
SupportedMorris said costs could be a couple of hundred dollars but could reach thousands.SmartCompany: ““We’re thinking probably a couple of hundred bucks, but it could be thousands,” Morris told SmartCompany.”
SupportedMorris is concerned the legislation could affect all 800 websites managed by his agency.SmartCompany: “Morris is concerned the legislation could affect all 800 websites managed by his digital agency”
SupportedThe proposed assessments would not automatically require external auditors; covered operators would document risks, retain records for six years and provide them to the eSafety Commissioner within 30 days if requested.SmartCompany: “As they stand, the proposed assessments would not automatically require businesses to hire external auditors. Covered operators would be required to document their online safety risks, retain records for six years and provide them to the eSafety Commissioner within 30 days if requested.”
SupportedThe government says low-risk websites would face minimal obligations, but the bill has no automatic small-business exemption.SmartCompany: “The government has said low-risk websites would face minimal obligations, but the proposed legislation does not contain an automatic exemption for small businesses.”
SupportedMorris called for exemptions for businesses with fewer than 50 employees or annual turnover below $5 million.SmartCompany: “Morris also called for exemptions for businesses with fewer than 50 employees or annual turnover below $5 million.”
SupportedIf passed, the legislation would provide a 12-month transition period before obligations take effect.SmartCompany: “If passed, the legislation would provide a 12-month transition period before the new obligations take effect.”